NOTE 1    An objective of the PAS is to integrate security into safety for risk management of the automotive ecosystem. Broadly speaking, security management identifies the threat, vulnerability and potential mitigation of a safety-related issue, whilst safety management is responsible for assessing the impact and consequences and managing the safety risk. However, this broad outline is not fixed, as through the application of continuous risk management it is likely that safety management could also inform security, e.g. identify new vulnerabilities, and security management could also inform safety, e.g. identify new hazards.

NOTE 2    The ecosystem includes vehicles (both those used solely on public roads, such as cars, and those used occasionally on public roads, such as farming and construction equipment), as well as road-side and other static infrastructure, communication channels between vehicles and infrastructure, servicing and repair facilities, digital services, data and information and other services that support the proper operation of road transport. The focus is on digital communication between the vehicle and the outside world, which includes the use of computer vision systems to read road signs as well as more conventional services provided to the vehicle such as navigation and traffic information.

NOTE 3    In this context, a product is something that is installed in the vehicle whereas a service is something external to the vehicle that is accessed via an interface. A product can be an item, component or complete sub-system in its own right and can include both hardware and software. A service is a means of providing distinct functionality to the vehicle from an external source and requires a suitable interface to be installed in the vehicle. It is important to ensure the integrity and authenticity of both products and services to avoid compromising the safety and security of the vehicle.