AUTOSIFU · AUTOMOTIVE CYBERSECURITY

Every vehicleis a computer.

We secure the ones India drives — and the rules they must pass.

01 / 5

A vehicle is a network with wheels.

Twelve electronic control units and eleven buses, drawn from public standards. Not any manufacturer's architecture.

    The page opens on a studio view of a reference vehicle. As it scrolls, the body turns transparent and its electrical architecture appears: 12 electronic control units connected by 9 buses through a central gateway, the five externally exposed surfaces UN R155 Annex 5 enumerates, and one attack path traced from telematics through the gateway to the ADAS domain. The same information is written in the chapter card and can be stepped through with the buttons. The section ends with the vehicle beside the page's main heading.
    Engineers from11 OEMs & Tier-1sAs published by CIRT · November 2025
    In partnership withCIRTCentral Institute of Road Transport · est. 1967 · under MoRTH
    India's firstSUMS WorkshopCIRT Pune · November 2025

    02 — Strategic partnerships

    The regulator and the implementer. Both in the same room.

    How CIRT describes the alliance

    Central Institute of Road Transport · Pune

    Established in 1967 by the Ministry of Road Transport & Highways and ASRTU. India's government-recognised Approval Body for AIS-189, and the threshold every vehicle type in India crosses. Together we built India's first SUMS workshop and the CSIP certification.

    • Est. 1967
    • Under MoRTH
    • AIS-189
    • Homologation

    AUTOCRYPT Co., Ltd. · Seoul

    Strategic partnership across the EU Cyber Resilience Act, V2X security, and UN R155 and R156. Autocrypt brings V2X, PKI and security-testing depth built for European type approval. Between us, the Indian route and the European one become the same conversation.

    • CRA
    • V2X
    • UN R155
    • UN R156

    — The platform

    The evidence chain, screen by screen.

    Where a programme's evidence actually sits — classification, bills of materials, traceability, the reporting clocks, the technical file. Every screen we have, in the order the work happens.

    Across the portfolio

    Every product registered, each carrying its own score, its own bills of materials and its own open CVEs.

    CRA dashboard · score, open actions, critical alerts
    Product register · compliance per product

    Classify, and route

    The class decides the conformity procedure. The wizard asks the Annex III questions and routes the product on the answer, instead of leaving it to a reading of the regulation.

    Product classification · question 1 of 5 · CRA Annex III
    Product configuration · item type, then CRA class

    Collect the BOMs

    CycloneDX and SPDX for software; part numbers and end-of-life dates for hardware. A component going end-of-life is a conformity problem, so it is tracked as one.

    SBOM viewer · CycloneDX and SPDX releases · 47 components
    HBOM manager · component end-of-life

    Trace the analysis

    Annex I coverage by domain, and every finding followed through to the requirement it touches and the action opened against it.

    Technical requirements · Annex I coverage by domain
    Traceability · CVE to risk to requirement to evidence

    Watch, and report on the clock

    An exploited component starts a clock the regulation sets, not one you choose — twenty-four hours, seventy-two hours, one month, each owed to a named authority.

    PSIRT view · three CVEs marked actively exploited
    Vulnerability handling · the four remediation deadlines
    Article 14 reporting · 24 hours, 72 hours, one month

    File, and declare

    The assessment stages, the evidence behind each one, and the declaration rendered at the end of the chain rather than retyped into it.

    Conformity assessment · four stages to the declaration
    Document registry · evidence and its approval state
    See the Compliance Platform

    A demo tenant with demo data. The products, components and findings in these screens are a worked example, not a customer.

    2National programmes with CIRTIndia's first SUMS workshop, and the CSIP certificationas of 2025–26
    11OEMs and Tier-1s representedOrganisations whose engineers attended, as published by CIRTas of Nov 2025
    40hGuided hours per cohort27.5 instructor-led + 7.5 clinics + 20 self-studyas of CSIP 2026
    5Standards we deliver againstR155, R156, AIS-189, AIS-190, ISO/SAE 21434as of Aug 2026

    — The regulatory map

    One vehicle. Several rulebooks.

    A UN type approval is not a global licence, and it travels less far than most programmes assume. Every market below names its own instrument, its own authority and its own date — and an exporting programme answers to each one it ships into.

    India

    National regime
    Instrument
    AIS-189 (CSMS) · AIS-190 (SUMS)
    Authority
    MoRTH — testing agencies notified under CMVR Rule 124 & Rule 126, CIRT Pune among them
    Status
    Draft notification — not yet final
    In force
    Phasing proposed from October 2026

    India is not a Contracting Party to the 1958 Agreement. A UN R155 approval issued elsewhere confers nothing here, and an Indian approval does not travel — which is exactly why an exporting programme carries two files rather than one.

    07 — Where we are

    Four cities. One file.

    Homologation runs on proximity — to the plant, to the test house, to the authority. We sit close to all three.

    Registered officeJaipurRajasthan
    Office · with CIRTPuneMaharashtra
    Virtual officeBengaluruKarnataka
    Virtual officeDelhi NCR

    09 — Start here

    Bring us the file you are least sure about.

    Most conversations start with a gap assessment, or a type approval submission that is closer than it feels. Either is a good place to begin.

    Direct

    Jaipur · registered office

    Plot No. 8, ABS Plaza, Chanakya PuriJagatpura, Jaipur – 302017, RajasthanAUTOSIFU Pvt Ltd · India

    Required