ACT BACKGROUND

The automobile industry faces increasing challenges in addressing active cybersecurity threats and meeting the demands for enhanced automotive safety and resiliency. NHTSA has stressed that workforce practices focused on professional education are crucial to improving motor vehicle cybersecurity. Nevertheless, that essential knowledge isn’t the same as traditional enterprise/information systems-focused cybersecurity. Therefore, a systematic, comprehensive, and fully validated curriculum targeted explicitly at industry needs is necessary to guide motor vehicle cybersecurity training and education. The Auto-ISAC addressed that need through the ACT Program. The ACT Program is the outcome of careful and extensive work. It has mapped the requisite fundamental and advanced automotive cybersecurity best practices, standards, and regulatory knowledge and created a unified solution. A Tiger Team composed of Auto-ISAC members developed the technical training content. This team met weekly over two years to research the current state of automotive training. In addition, the ISAC sponsored a year-long research study to create an R-155 and R-156-compliant teaching curriculum based on ISO/SAE 21434 stipulations. Following the development stage, experts in each topic produced content and instructional materials for their specialty area. During 2021, over two-hundred Auto-ISAC and governmental representatives participated in the Alpha and Beta validation studies for these courses. Course, content, and delivery were reviewed and updated after each pilot study. Thus, Auto-ISAC’s Automotive Cybersecurity Training (ACT) Program is a fully validated and continuously improving learning experience.

The unique technologies in automotive design require unique cybersecurity expertise, and the Auto ISAC / NHTSA ACT certification program responds to that need.

The program addresses a broad range of security topics and is delivered in engaging and interesting sessions that I enjoyed. The ACT curriculum and hands-on training deserve two thumbs up.
— Steve Adams, AT&T Chief Security Officer