Overview
ISO/PAS 5112:2022 - "Road vehicles - Guidelines for auditing cybersecurity engineering" provides practical guidance for auditing a Cybersecurity Management System (CSMS) across the automotive supply chain. Building on ISO 19011 (management system audit guidance) and aligned with the processes described in ISO/SAE 21434, this PAS focuses on organizational-level cybersecurity audits: establishing and managing an audit programme, conducting audits, defining auditor competencies, and evidencing audit results. It is explicitly not a guide for technical cybersecurity assessments of products or projects.
Key topics and requirements
- Audit programme management
- Establishing objectives, scope and extent of a CSMS audit programme
- Identifying and evaluating audit programme risks and opportunities
- Assigning roles, resources and responsibilities for programme management
- Monitoring, reviewing and improving the programme
- Conducting audits
- Initiation, feasibility, planning and preparation (document review, assigning team roles)
- On-site/remote audit activities: information access, interviews, sampling and evidence collection
- Generating findings, forming conclusions, conducting opening/closing meetings
- Reporting, distributing results and conducting follow-up
- Auditor competence and evaluation
- Personal behaviour, knowledge and skills required for CSMS auditors
- Criteria and methods for evaluating and maintaining auditor competence
- Requirements for audit team leaders
- Evidence and audit criteria
- Using audit criteria derived from ISO/SAE 21434 objectives
- Guidance on what constitutes acceptable organizational evidence
- Supporting material
- Annex A: example audit questionnaire (adaptable)
- Annex B: auditor competences (informative)
Applications and who uses it
ISO/PAS 5112:2022 is intended for organizations and professionals who need to understand, set up or run CSMS audits across the automotive supply chain:
- Automotive OEMs and tiered suppliers establishing supplier assurance and compliance programmes
- Quality, compliance and cybersecurity teams managing an audit programme for organizational cybersecurity
- Internal auditors, second‑party (supplier) auditors and third‑party/certification bodies conducting CSMS audits
- Auditor trainers and personnel certification bodies developing competency criteria and training curricula
Practical uses include designing audit checklists based on ISO/SAE 21434 objectives, planning internal CSMS audits, objectively evaluating auditor competence, and documenting evidence to support compliance and supplier oversight.
Related standards
- ISO/SAE 21434:2021 - Road vehicles - Cybersecurity engineering (process and technical objectives referenced for audit criteria)
- ISO 19011:2018 - Guidelines for auditing management systems (general auditing principles extended by ISO/PAS 5112:2022)
Keywords: ISO/PAS 5112:2022, CSMS audit, cybersecurity management system, ISO/SAE 21434, ISO 19011, road vehicles, auditor competence, audit programme, supply chain cybersecurity.