TSE ISO/PAS 5112

TSE ISO/PAS 5112 is a guideline document for auditing cybersecurity engineering in road vehicles. Its focus is the audit programme for a Cybersecurity Management System (CSMS), the conduct of organizational CSMS audits, auditor competence, and the way evidence is presented during those audits. In practical terms, it gives an audit-oriented view of how cybersecurity objectives are traced through the vehicle supply chain.

How CSMS auditing is framed

In addition to ISO 19011 audit guidance, this document is intended for organizations that need to understand or perform internal or external audits of a CSMS. A CSMS is the management-system layer that organizes cybersecurity responsibilities, planning, oversight, and continual improvement. In general technical terms, such audits focus less on the product’s design details and more on governance, process control, role assignment, records, and objective evidence.

What the document covers, and what it does not

• Guidance for managing a CSMS audit programme.
• Guidance for conducting organizational CSMS audits.
• Support for defining auditor competence for CSMS auditing.
• Guidance on providing evidence during CSMS audits.
• No guidance on cybersecurity assessments; the scope is auditing, not assessment methods.

In the automotive context, this kind of document helps align cybersecurity responsibilities across OEMs, suppliers, and other contributing organizations. The value of the CSMS concept is that it turns cybersecurity into a managed, auditable set of processes rather than a collection of isolated technical controls. That distinction matters because audit evidence usually needs to show not only that controls exist, but that they are planned, implemented, monitored, and retained within the management system.