ISO/TR 23786:2019 PDF

Overview

ISO/TR 23786:2019 - Road vehicles - Solutions for remote access to vehicle - Criteria for risk assessment is an ISO Technical Report that identifies criteria to assess risks arising from remote access solutions for road vehicles, including extended vehicles (ExVe). It provides a consolidated checklist of risk criteria for use by standardizers, vehicle manufacturers, implementers and stakeholders without prescribing a specific risk assessment methodology. The report is intended to support coherent mitigation where necessary, while clarifying several explicit scope exclusions.

Key topics and technical focus

• Risk categories covered: safety risks, cybersecurity (security) risks, competition risks, responsibility and liability risks, and data protection (resource/data owner) risks.
• Scope limits: internal in-vehicle communications, VM infrastructure components outside the ExVe, and road-side equipment cybersecurity are explicitly out of scope.
• Criteria for RCS-specifications: the criteria are applicable both to concrete implementations and to Remote Communication Solution (RCS) specifications (for example technical standards). The document helps answer whether an RCS or its implementation presents risks for specific use cases.
• Safety risk examples: potential overload of vehicle electronic systems (numerous, frequent or unexpected requests), illicit/malicious remote control, incompatibility with existing systems, failures in remote communication components, and incomplete vehicle life-cycle consideration.
• Guidance, not a methodology: ISO/TR 23786:2019 does not define a risk-assessment method or replace domain-specific standards (for example detailed cybersecurity standards); it offers a sufficiently comprehensive-but not exhaustive-list of assessment criteria.
• Supplementary tools: includes a template proposal (Annex A) to help structure risk assessments and cross-reference with related ISO design methodologies (e.g., ISO 20077 series).

Practical applications and users

Who will use ISO/TR 23786:2019:

• Vehicle Manufacturers (VMs) evaluating remote access features and ExVe implementations.
• Standards developers and ISO working groups creating or updating RCS-specifications.
• System integrators and service providers designing remote vehicle services, telematics, or back-end systems.
• Cybersecurity analysts, safety engineers and compliance teams conducting risk reviews, gap analyses and requirements traceability.
• Legal, privacy and product managers assessing liability, data protection and competition impacts of remote access solutions.

Practical uses:

• Scoping risk assessment checklists for design reviews and specifications.
• Identifying non-technical risks such as market dominance or data-owner concerns.
• Supporting requirements and test-case definition when developing remote-access standards or implementations.

Related standards

• ISO 20077 (ExVe terminology and design guidance)
• ISO 20078-1 (ExVe web services / RCS-specification examples)
• ISO/TC 22/SC 31 and related ISO work on vehicle data communication and cybersecurity

Keywords: ISO/TR 23786:2019, remote access to vehicle, extended vehicle, ExVe, risk assessment, vehicle cybersecurity, safety risks, data protection, RCS-specification.