Purpose And Scope

This Recommended Practice (RP) defines a guideline for identifying security risks associated with an electronic driver log system. The suggested risk analysis approach serves to identify potential vulnerabilities for which to consider whether appropriate security controls have been effectively implemented.

As a guideline, this document provides a broad context for electronic driver log system definition and potential security threats. It provides a general framework for system characteristics to guide target system definition in terms of technical configuration, services ecosystem, and enforcement access. The potential security threats to be considered for the system are catalogued and are based on a collaborative review of identified potential threats and known security measures to address such vulnerabilities. There may be additional threats related to the specific nature of some systems and related services.

This document is not intended to define a set of security requirements for electronic driver log systems or to define a standard security level or certification criteria by a third party organization.

In May 2020, the Federal Motor Carrier Administration (FMCSA) issued a document entitled Cybersecurity Best Practices for Integration/Retrofit of Telematics and Aftermarket Electronic Systems into Heavy Vehicles  . The document reviews and applies existing transportation best practices from the National Highway Safety Administration (NHTSA) and other organizations to heavy vehicles. The focus is on telematics devices, as they are a common attack vector, and requirements for electronic logging devices (ELDs) in the United States have increased the rate at which such devices are being deployed. The FMCSA's document has two primary focus areas:

• policy and procedure recommendations, and;
• technical recommendations.

The document is intended for use by truck/bus manufacturers, telematics service providers (TSPs), motor carriers, heavy truck dealers/installers, fleet managers, mechanics, drivers and government regulators. The document may also be useful to original equipment manufacturers (OEMs) who build tractors, trailers, engines and other systems for trucks, as it will help them consider how their systems might be accessed, legitimately or maliciously.

This FMCSA document includes a subset of requirements recommended by the National Motor Freight Traffic Association, Inc. (NMFTA) in their report Cybersecurity Requirements for Telematics Systems, May 2020  . The report is a comprehensive list of cybersecurity requirements for telematics, fleet management information systems (FMIS) and/or ELDs with the core objective of providing information to owners of telematics, FMIS and/or ELDs during the procurement phases of these systems so they can manage security risks. An additional objective is to provide comprehensive cybersecurity requirements that can be consulted by owners and potential vendors to provide sufficient information for prioritizing cybersecurity needs in telematics, FMIS and/or ELDs and validate the presence of the controls upon system delivery.