Six subject areas, but rarely six separate problems. A cybersecurity finding turns out to be a requirements-engineering finding. A safety argument falls over because the open-source component underneath it has no provenance.
We are usually brought in for one of these and end up working across two or three. That is the reason a small practice can be useful here: the same person sees the process, the safety case and the security evidence, instead of three consultancies handing findings to each other.
Where we work
Automotive SPICE®
Assessments · gap analyses · engineer training
Formal assessment by an INTACS Principal Assessor, informal gap analysis before anyone official asks, and the improvement work that follows a rating.
Functional Safety
ISO 26262 · IEC 61508
Safety plan and concept, the work products a confirmation review will ask for, and preparation for the review itself — for road vehicles and industrial E/E alike.
Automotive Cybersecurity
UNECE R155 · R156 · ISO/SAE 21434
CSMS build-up and audit readiness, moderated TARA, and the evidence structure that type approval depends on. Twenty years of vehicle security behind it.
Cyber Resilience Act
Regulation (EU) 2024/2847
Whether the regulation applies to your product, which class it falls in, what Annex I actually requires, and which conformity route is open to you.
Safety & Security Co-Engineering
ISO 26262 × ISO/SAE 21434
The interface nobody owns: shared items, requirements that pull against each other, and a finding that is a hazard and a threat at the same time.
Software Compliance
ISO/IEC 5230 · OpenChain · SBOM
Open-source licence compliance and an SBOM practice that survives supplier hand-off, due diligence and the CRA’s reporting duties.
How engagements start
Small first, then as far as it needs to go
Most work begins with two or three days: a gap analysis, a second opinion on a concept, or a look at whether a deadline is realistic. That is usually enough for both sides to tell whether a longer engagement makes sense — and sometimes the honest answer is that you do not need one. From there it can run to accompanying a type-approval programme over months.
Automotive SPICE® is a registered trademark of the Verband der Automobilindustrie e. V. (VDA).