Skip to content

Implementer Guidance

ITS implementers include engineers, system integrators, and field technicians responsible for deploying and maintaining secure infrastructure components. This page provides practical guidance for ensuring that key cybersecurity requirements are met during deployment and operation

This section provides guidance on security implementation strategies for both European (EU) and North American ITS environments.

1. Configure and Maintain a Secure Environment

Devices such as OBUs and RSUs must be correctly set up before they can securely communicate within a certificate-based trust system. This setup includes installing issued certificates, enabling secure message protocols, and protecting private keys using secure storage.

Key Actions:

  • Install valid certificates issued by the appropriate PKI authority (e.g., SCMS, CCMS) using approved enrollment processes.

  • Enable secure communication protocols, such as IEEE 1609.2 for signed V2X messages, and TLS for infrastructure and back-office connections.

  • Apply secure defaults to networked devices: disable unused interfaces, require mutual authentication, and configure firewall rules.
  • Support certificate lifecycle processes, including revocation and renewal, in accordance with policy from the PKI provider.

Tools like the Mobile ITS Security Application and the ITS Cybersecurity Framework Profile provide deployment checklists and configuration templates.

2 Deploy Hardened Devices

ITS hardware must include safeguards against both physical and logical attacks. This includes protection of cryptographic keys and enforcement of secure startup and update processes.

Key Actions

  • Use tamper-resistant hardware: OBUs and RSUs should include secure elements or hardware security modules (HSMs) for key protection.
  • Support secure boot: Devices must verify firmware signatures during startup.
  • Enforce signed software updates: Over-the-air (OTA) updates should include cryptographic verification and rollback protection.
  • Apply role-based access control (RBAC): Limit administrative interfaces to authenticated and authorized users only.
  • Enable system logging and monitoring: Support detection of unauthorized changes or unexpected behavior.

Security requirements can be guided by Protection Profiles such as the C2C-CC V2X HSM PP or national regulatory frameworks such as UNECE R155.

3. Secure Software and Firmware Updates

Unpatched systems are a common attack vector. Implementers should verify that every device supports a secure update mechanism and that procedures are in place for scheduled updates.

Key Actions

  • Verify authenticity of all updates before installation (e.g., digital signature checks).
  • Apply secure OTA updates using approved channels and tools.
  • Restrict update privileges to trusted administrators using authentication and access control.

Learn More