SAE J3005-2_202003

The scope of the document is to define the cyber-security best practices to reduce interference with normal vehicle operation, or to minimize risk as to unauthorized access of the vehicle's control, diagnostic, or data storage system; access by equipment (i.e., permanently or semi-permanently installed diagnostic communication device, also known as dongle, etc.) which is either permanently or semi-permanently connected to the vehicle's OBD diagnostic connector, either SAE J1939-13, SAE J1962, or other future protocol; or hardwired directly to the in-vehicle network. This document only specifies requirements and guidance for those diagnostic communication devices and not for the vehicle. Refer to SAE J3138 for requirements for the vehicle side. SAE J3005-2 is being published as a new document as security and privacy recommended practice permanently or semi-permanently installed diagnostic communication devices.The design of modern vehicle electrical architecture where the OBD diagnostic protocol is an open protocol, and the fact that vehicle manufacturers may have direct connection to the control bus of the vehicle in the connector, has been the enabler for various new use cases, but can also open up the car to hacking.This document is a cyber-security recommended practice for manufacturers of permanently and semi-permanently installed diagnostic communication devices.