NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles

The National Highway Traffic Safety Administration (NHTSA), the auto-safety regulator inside the United States Department of Transportation, published Cybersecurity Best Practices for the Safety of Modern Vehicles in September 2022 (NHTSA-2021-0029). The 2022 document updates the original 2016 best practices and is hosted at nhtsa.gov. The text is non-regulatory guidance, not a rule, but it functions as the practical baseline because NHTSA can open a defect investigation and order a recall under 49 U.S.C. 30118 when a cybersecurity vulnerability affects motor vehicle safety. The 2022 update references vehicle cybersecurity research that NHTSA conducted in partnership with the National Institute of Standards and Technology, including its alignment with the NIST Cybersecurity Framework. The document applies to all motor vehicle and motor vehicle equipment manufacturers and is recommended for suppliers, aftermarket companies, and fleet operators. The guidance covers the full vehicle lifecycle: design, development, production, service, decommissioning, and post-incident response. NHTSA specifies that the document complements the SAE J3061 Cybersecurity Guidebook for Cyber-Physical Vehicle Systems (issued by SAE International in 2016) and ISO/SAE 21434 Road Vehicles Cybersecurity Engineering (issued in 2021), which together provide the engineering process standard for automotive cybersecurity. The layered defense approach in Section 3 is the core technical content. NHTSA recommends protection at four boundaries: vehicle entry points (USB, OBD-II, wireless interfaces, infotainment connectivity), inter-vehicle and vehicle-to-cloud communications, in-vehicle networks (CAN bus, Ethernet, FlexRay), and individual electronic control units (ECUs). Each layer should fail safely, log security events, and resist privilege escalation across boundaries. The guidance specifically calls out the need for code authentication, secure boot, hardware-rooted device identity, and protection of debug interfaces. Incident response in Section 3.4 requires documented processes, a vulnerability disclosure program, and coordination with the Automotive Information Sharing and Analysis Center (Auto-ISAC). Auto-ISAC was established in 2015 and publishes the Automotive Cybersecurity Best Practices document that pairs with NHTSA guidance for industry-led detail. The Auto-ISAC operational playbook covers information sharing, vulnerability handling, and threat-actor monitoring. Over-the-air updates in Section 3.6 require cryptographic authentication, integrity verification of update packages, rollback capability, secure key storage, and protection against unauthorized modifications. Hardware-rooted trust (typically a Hardware Security Module on each ECU that can perform OTA update verification) is the recommended baseline. The guidance pairs OTA security with the UNECE WP.29 R155 (Vehicle Cybersecurity) and R156 (Software Updates) regulations, which are mandatory for new vehicle type approvals in EU, UK, Japan, and South Korea since 2022 and 2024 respectively. The document is not a substitute for substantive regulation. NHTSA can act in three ways: open a preliminary evaluation and engineering analysis of a safety-related defect (49 CFR Part 554), order a recall (49 U.S.C. 30118 to 30120), and pursue civil penalties (49 U.S.C. 30165) up to USD 26,315 per violation per day with a maximum civil penalty of USD 131,564,183 for a related series of violations (2024 adjusted figures). The first significant vehicle cybersecurity recall was Fiat Chrysler's 2015 recall of 1.4 million Jeep Cherokees after the Miller and Valasek demonstration, which remains the standard reference case. NHTSA has since opened cybersecurity-adjacent investigations into Tesla Autopilot, GM OnStar systems, and Hyundai/Kia anti-theft (TikTok challenge) software.