Aurora’s Safety Case Framework
A Safety Case Framework combines guidance from government organizations, best practices from safety-critical industries, voluntary industry standards, academic research, and what an organization has learned in its own work. In the autonomous vehicle industry, it’s an essential tool for developing self-driving vehicles that operate safely on public roads.
Aurora’s Safety Case Framework was the first to address the safety of both autonomous trucks and passenger vehicles, and it spans the entire development lifecycle. It evolves as we expand to new environments, platforms, and operating modes — with and without a human driver. We’re sharing the public portion here so our partners, customers, and the public can understand why we’re confident in the Aurora Driver.
Our Voluntary Safety Self-Assessment explains how we apply the Framework in practice.
G1
Proficient
The Self-Driving Vehicle is acceptably safe during nominal operation
G1.1
The Self-Driving Enterprise uses appropriate development processes for a complex safety critical system
S1.1.1
safety risk is reduced through a defined process approach
G1.1.1.1
Systems engineering process is established, standardized, and there is evidence that the process is being used
G1.1.1.1.1
Systems engineering follows a defined process
G1.1.1.1.2
Systems engineers are trained and continually educated on the systems engineering process
G1.1.1.1.3
Systems engineering process compliance audits are periodically conducted for all appropriate functions / sub-systems
G1.1.1.1.4
The systems engineering process is appropriate for safety critical design
G1.1.1.2
Hardware development process is established, standardized, and there is evidence that the process is being used
G1.1.1.2.1
Hardware engineering follows a defined process
G1.1.1.2.2
The hardware engineering development process is appropriate for safety critical design
G1.1.1.2.3
Hardware engineering development process compliance audits are periodically conducted for all appropriate functions / sub-systems
G1.1.1.2.4
Hardware engineers are trained and continually educated on the hardware engineering process
G1.1.1.3
Manufacturing process is established, standardized, and there is evidence the process is being used
G1.1.1.3.1
Manufacturing follows a defined process
G1.1.1.3.2
Manufacturing and production processes are established for externally sourced system hardware
G1.1.1.3.3
Manufacturing personnel are trained and continually educated on the manufacturing process
G1.1.1.3.4
Manufacturing process compliance audits are periodically conducted for all appropriate functions
G1.1.1.3.5
The Manufacturing process is appropriate for safety critical design
G1.1.1.4
Maintenance / Service processes is established, standardized, and there is evidence the process is being used
G1.1.1.4.1
Maintenance and service follows a defined process
G1.1.1.4.2
Maintenance / service personnel are trained and continually educated on the maintenance process
G1.1.1.4.3
Maintenance / service process compliance audits are periodically conducted for all appropriate functions
G1.1.1.4.4
The maintenance / service process is appropriate for safety critical design
G1.1.1.5
Software development process is established, standardized, and there is evidence that the process is being used
G1.1.1.5.1
Software engineering follows a defined process
G1.1.1.5.2
Software Engineers are trained and continually educated on the software development process
G1.1.1.5.3
Software development process compliance audits are periodically conducted for all appropriate functions / sub-systems
G1.1.1.5.4
The Software development process is appropriate for safety critical design
G1.1.1.6
Quality management process is established, effective, standardized, and there is evidence that the process is being used
G1.1.1.6.1
Quality management follows a defined process
G1.1.1.6.2
Quality management measures are effective in controlling quality
G1.1.1.6.3
Quality management ensures all defined processes are followed
G1.1.1.6.4
The quality management process is appropriate for safety critical design
G1.1.1.7
Supply chain processes is established, standardized, and there is evidence the process is being used.
G1.1.1.7.1
Supply chain teams follow a defined process
G1.1.1.7.2
Supply chain staff are trained and continually educated on the supply chain process
G1.1.1.7.3
Supply chain process compliance audits are periodically conducted for all appropriate functions / sub-systems
G1.1.1.7.4
The supply chain process is appropriate for safety critical design
G1.1.1.8
Vehicle operations processes is established, standardized, and there is evidence the process is being used.
G1.1.1.8.1
Vehicle operations teams follow a defined process
G1.1.1.8.2
Operations personnel are trained and continually educated on the operations process and tools
G1.1.1.8.3
Operations process compliance audits are periodically conducted for all appropriate functions
G1.1.1.8.4
Operations processes are appropriate for safety critical design
G1.1.1.9
System Safety engineering process is established, standardized, and there is evidence that the process is being used
G1.1.1.9.1
System Safety engineering follows a defined process
G1.1.1.9.2
System safety engineers are trained and continually educated on the system safety engineering development process
G1.1.1.9.3
System safety engineering process compliance audits are periodically conducted for all appropriate function / subsystems
G1.1.1.9.4
The System Safety engineering process is appropriate for safety critical design
G1.2
The Self-Driving Vehicle is acceptably performant to operate in the defined ODD
G1.2.1
The Self-Driving Vehicle is designed to safely operate in the intended Operational Design Domain (ODD)
G1.2.1.1
The product requirements sufficiently define the full scope and entire lifecycle of the product
G1.2.1.1.1
The product requirements address all lifecycle stages of the product (design to disposal)
G1.2.1.1.2
The product requirements define the concept of operations for the product
G1.2.1.1.3
The product requirements define the Operational Design Domain (ODD) the product will operate in
G1.2.1.2
The System Requirements sufficiently define a system that can operate in the defined ODD
G1.2.1.2.1
The system requirements considers the needs of all external actors (e.g. Riders, Pedestrians, Motorists, Law Enforcement)
G1.2.1.2.2
The system requirements considers the needs of all internals actors (e.g. vehicle operators, system maintainers, engineers, remote assistant)
G1.2.1.2.3
System requirements appropriately address nominal operation
G1.2.1.2.4
System requirements appropriately address off-nominal operation
G1.2.1.2.5
Traceability confirms the system requirements satisfy the product and safety requirements
G1.2.1.3
The Safety Requirements sufficiently define the allowable behavior of the system to ensure safe operation in the defined ODD
G1.2.1.3.1
Functional Hazard Analysis sufficiently identifies system functions that are safety critical / relevant
G1.2.1.3.2
Peer reviews of Functional Hazard Analysis confirms the correctness of the analysis
G1.2.1.3.3
Hazards associated with each safety function have been thoroughly identified
G1.2.1.3.4
Hazards associated with AV Operations have been thoroughly identified
G1.2.1.3.5
All identified fault-based hazards are ranked
G1.2.1.3.6
All identified non-fault based hazards are ranked
G1.2.1.3.7
All identified reasonably foreseeable misuse hazards are ranked
G1.2.1.3.8
All hazard rankings are re-evaluated periodically
G1.2.1.3.9
Safety requirements comprehensively mitigate identified hazards and scenario / situation / triggering event
G1.2.1.3.10
All safety requirements have analysis justifying the metrics, thresholds, or margins used in the requirements
G1.2.1.3.11
Safety requirements are verified for gaps and omissions
G1.2.1.3.12
Safety requirements are verified to be internally and externally consistent
G1.2.1.4
System requirements are appropriately developed from product requirements
G1.2.1.4.1
System requirements are comprehensive
G1.2.1.4.2
System requirements are verified for gaps and omissions
G1.2.1.4.3
System requirements are verified to be internally and externally consistent
G1.2.1.4.4
System requirements errors follow a systematic process for root cause and mitigation
G1.2.1.4.5
An accurate, complete, configuration-managed system architecture model is developed and maintained
G1.2.1.5
Hardware requirements are appropriately developed from system and safety requirements
G1.2.1.5.1
Hardware requirements are comprehensive
G1.2.1.5.2
Hardware requirements are verified for gaps and omissions
G1.2.1.5.3
Hardware requirements are verified to be internally and externally consistent
G1.2.1.5.4
Hardware requirements errors follow a systematic process for root cause and mitigation
G1.2.1.5.5
An accurate, complete, configuration-managed hardware architecture model is developed and maintained
G1.2.1.6
Software requirements are appropriately developed from safety and system and safety requirements
G1.2.1.6.1
Software requirements are comprehensive
G1.2.1.6.2
Software requirements are verified for gaps and omissions
G1.2.1.6.3
Software requirements are verified to be internally and externally consistent
G1.2.1.6.4
Software requirements errors follow a systematic process for root cause and mitigation
G1.2.1.6.5
An accurate, complete, configuration-managed software architecture model is developed and maintained
G1.2.1.7
System safety requirements are sufficient
G1.2.1.7.1
System safety requirements are comprehensive
G1.2.1.7.2
System safety requirements are verified for gaps and omissions
G1.2.1.7.3
System safety requirements are verified to be internally and externally consistent
G1.2.1.7.4
System safety requirements errors follow a systematic process for root cause and mitigation
G1.2.1.7.5
System safety requirements are allocated to safety critical components within the off-board systems of the Self-Driving Enterprise
G1.2.1.8
Requirements for manufacturing are sufficient
G1.2.1.8.1
Manufacturing requirements are comprehensive
G1.2.1.8.2
Manufacturing requirements are verified for gaps and omissions
G1.2.1.8.3
Manufacturing requirements are verified to be internally and externally consistent
G1.2.1.8.4
Manufacturing requirements errors follow a systematic process for root cause and mitigation
G1.2.1.8.5
An accurate, complete, configuration-managed manufacturing process / architecture model is developed and maintained
G1.2.1.9
Requirements for maintenance / service are sufficient
G1.2.1.9.1
Maintenance / service requirements are comprehensive
G1.2.1.9.2
Maintenance / service requirements are verified for gaps and omissions
G1.2.1.9.3
Maintenance / service requirements are verified to be internally and externally consistent
G1.2.1.9.4
Maintenance / service requirements errors follow a systematic process for root cause and mitigation
G1.2.1.9.5
An accurate, complete, configuration-managed maintenance / service process architecture model is developed and maintained
G1.2.1.10
The product requirements meet or exceed the needs of the defined ODD
G1.2.2
The Self-Driving Vehicle is operated with appropriate vehicle dynamics safety margins
G1.2.2.1
The Self-Driving Vehicle maintains appropriate reserve vehicle dynamic actuation capability in nominal and all degraded modes
G1.2.2.2
The frequency and duration of reduced vehicle dynamic reserve capability is acceptably low
G1.2.3
Self-Driving Vehicle subsystems provide acceptable functional performance in the defined ODD
G1.2.3.1
Perception provides acceptable functional performance in the defined ODD
G1.2.3.1.1
Self-Driving Vehicle sensors provide acceptably correct, complete, and current data
G1.2.3.1.2
The Perception subsystem is designed with sufficient availability and redundancy to detect objects in the ODD
G1.2.3.1.3
The performance of the perception system is suitable for the ODD
G1.2.3.1.4
Perception machine learning development follows best practices for safety-critical systems
G1.2.3.2
Online Maps provides acceptable functional performance in the defined ODD
G1.2.3.2.1
The Online Map subsystem is designed with sufficient availability and redundancy to appropriately represent map infrastructure features in the ODD
G1.2.3.2.2
The performance of the Online Map subsystem is suitable for the ODD
G1.2.3.3
Motion planning provides acceptable functional performance in the defined ODD
G1.2.3.3.1
The Motion Planning subsystem design has sufficient availability and redundancy to determine trajectories in the ODD
G1.2.3.3.2
The Motion Planning subsystem predicts future actions of other actors sufficiently for the ODD
G1.2.3.3.3
Motion planning performance is suitable for the ODD
G1.2.3.3.4
Motion Planning machine learning development follows best practices for safety-critical systems
G1.2.3.4
Localization provides acceptable functional performance in the defined ODD
G1.2.3.4.1
The Localization subsystem design has sufficient availability and redundancy for the ODD
G1.2.3.4.2
Localization performance is suitable for the ODD
G1.2.3.4.3
Offline map performance is suitable for the ODD
G1.2.3.5
Vehicle Control provides acceptable functional performance in the defined ODD
G1.2.3.5.1
The Vehicle Control subsystem design has sufficient availability and redundancy for the defined ODD
G1.2.3.5.2
Vehicle Control performance is suitable for the ODD
G1.2.3.6
System notifications provide acceptable functional performance in the defined ODD
G1.2.3.6.1
Notifications to NVO users of the Self-Driving Vehicle communicate a clear message or status
G1.2.3.6.2
Notifications to NVO users of the Self-Driving Vehicle are suitably robust
G1.2.3.6.3
Notifications to NVO users of the Self-Driving Vehicle are suitable for the ODD
G1.2.3.6.4
Notifications to NVO users of the Self-Driving Vehicle are suitably effective
G1.2.3.7
System timing / latency provide acceptable functional performance in the defined ODD
G1.2.4
Off-board systems provide acceptable functional performance in the defined ODD
G1.3
The Self-Driving Vehicle is appropriately tested and released for self-driving operations
S1.3.1
Traceability will be used to demonstrate all requirements have been tested.
Peer review, test phases of unit test, subsystem test, and vehicle testing combined industry best practice on test case development are used to demonstrate appropriate rigor in the tests have been performed.
Industry best practices will address functional, regression testing, and stress testing. The combination of traceability and rigor arguments meet the parent goal.
This efficacy in meeting this goal is measured by the frequency of hazardous events measured during testing. The following process follows for the initial development and the ongoing update and enhancement of the Self-Driving Enterprise.
G1.3.1.1
Traceability of testing demonstrates comprehensive requirements coverage
G1.3.1.2
Peer review minimizes human error in work product development
G1.3.1.3
All anomalies are analyzed to ensure requirements are comprehensive
G1.3.1.4
The Self-Driving Vehicle is comprehensively evaluated on a set of validated and representative tests
G1.3.1.5
The frequency of potentially harmful events (PHE) are below a target metric(s)
G1.3.1.6
All identified hazards have been appropriately mitigated
G1.4
The Self-Driving Vehicle is operated in accordance with its operational concept
G1.4.1
During testing and development, Vehicle Operators enforces the operational concept and reduces safety risk to acceptable level
G1.4.1.1
The Vehicle Operator can take control of the Self-Driving Vehicle at any time
G1.4.1.1.1
Manual control of the vehicle steering can be achieved in all vehicles operated under the supervision of Vehicle Operators
G1.4.1.1.2
Manual control of the vehicle braking can be achieved in all vehicles operated under the supervision of Vehicle Operators
G1.4.1.1.3
Manual control of the vehicle accelerator pedal can be achieved in all vehicles operated under the supervision of Vehicle Operators
G1.4.1.1.4
CLAIM DELETED.
G1.4.1.2
The Vehicle Operator hiring process accepts suitable candidates
G1.4.1.3
Only Vehicle Operators with appropriate driving licenses are allowed to operate the vehicle
G1.4.1.4
Only Vehicle Operators are able to operate Self-Driving Vehicles
G1.4.1.4.1
The Vehicle Operator is properly verified and identifiable to both the Self-Driving Vehicle and the business/security infrastructure prior to engagement of auto mode
G1.4.1.4.2
Access to vehicles and vehicle keys are restricted to qualified Vehicle Operators
G1.4.1.5
The Vehicle Operator has an appropriate set of responsibilities when operating a Self-Driving Vehicle
G1.4.1.6
The Vehicle Operator is appropriately trained for manual driving
G1.4.1.7
The Vehicle Operator is appropriately trained in support of safe Self-Driving Vehicle monitoring / operation
G1.4.1.8
The Vehicle Operator is effectively informed of expected system behavior, including Self-Driving Vehicle capabilities and limitations
G1.4.1.9
The Vehicle Operator is alert and attentive to the road environment
G1.4.1.9.1
A Driver Monitoring System alerts the Vehicle Operator to inattention
G1.4.1.9.2
The Self-Driving Vehicle design does not create undue Vehicle Operator distraction
G1.4.1.9.3
The Vehicle Operator is capable of identifying and mitigating unintended operations outside the ODD
G1.4.1.10
The Vehicle Operator demonstrates ability to plan and execute correct driving responses
G1.4.1.10.1
Fault Injection Testing demonstrates Vehicle Operator's control capability during a fault
G1.4.1.10.2
The Vehicle Operator is appropriately periodically evaluated for required level of performance
G1.4.2
The Self-Driving Vehicle is operated within a defined Operational Domain (OD) within the System's Operational Design Domain
G1.4.2.1
Departures from the ODD are detected
G1.4.2.2
Departures from the ODD are safely mitigated
G1.4.3
A set of operational safety policies and procedures support safe operations
G1.4.3.1
Operational safety policies and procedures support safe test track operations
G1.4.3.2
Operational safety policies are reviewed and version controlled
G1.4.3.3
Operational safety policies and procedures support safe on-road operations
G1.5
The Self-Driving Vehicle addresses all applicable legal requirements and guidance through compliance or justification of non-compliance
G1.5.1
The Self-Driving Vehicle complies or justifies non-compliance with applicable local, state, federal regulation including "rules of the road"
G1.5.1.1
The Self-Driving Vehicle is designed to comply with all appropriate federal, state, and local regulation in its intended ODD
G1.5.1.2
The Self-Driving Vehicle is evaluated for compliance with all appropriate federal, state, and local regulation in its intended ODD
G1.5.1.3
All federal, state, and local regulations in our ODD and without compliance have appropriate justification, documentation and approval
G1.5.3
Non-regulatory guidance is reviewed and implemented where appropriate
G2
Fail-Safe
The Self-Driving Vehicle is acceptably safe in presence of faults and failures
S2.1
We mitigate hazards by identifying faults and failure modes, ensuring the system is able to detect them, and take action to minimize safety risk when they occur. We also ensure the overall failure rate of the system is acceptably low.
G2.1.1
The rate of failure of the system is reasonably low
G2.1.1.1
The frequency of unplanned / unexpected minimal risk maneuvers (MRM) is sufficiently low
G2.1.1.2
The Self-Driving Vehicle and subsystems have environmental qualification requirements designed to exceed the intended ODD
G2.1.1.3
The Self-Driving Vehicle and subsystems are tested against industry standards and best practices for environmental qualification and reliability
G2.1.1.4
Identified Faults and Failure Modes are systematically tracked
G2.1.2
The effectiveness of fault mitigation is acceptably high
G2.1.2.1
The rate of successful fault detection and response activation is acceptably high
G2.1.2.1.1
Diagnostic coverage is acceptably high
G2.1.2.1.2
The Fault Management System provides dependable fault detection
G2.1.2.2
The selected fault response is effective in reducing safety risk to acceptable levels
G2.1.2.2.1
The system transitions to the specified fault response state (e.g. degraded mode) with a sufficient response time
G2.1.2.2.2
Minimum risk maneuvers are reliably executed when triggered
G2.1.2.2.3
The minimal risk manuever(s) used to respond to the fault are reasonably low in risk
G2.1.2.2.4
The system does not have an unreasonable level of safety risk when executing an MRM with a system fault present.
G3
Continuously Improving
All identified potential safety issues posing an unreasonable risk to safety are evaluated, and resolved with appropriate corrective and preventative actions
G3.1
Safety performance indicators are measured, analyzed, and used to monitor safety
G3.1.1
Safety performance indicators are defined for all safety related functional areas of the Self-Driving Enterprise
G3.1.2
Safety performance indicators are defined for safety related performance of the autonomy system
G3.1.3
Safety performance indicators are defined for the off-board systems of the Self-Driving Enterprise
G3.1.4
Safety performance indicators are defined for Self-Driving Enterprise safety culture
G3.1.5
Safety performance indicators are measured appropriately
G3.1.6
Safety performance indicators are appropriately analyzed
G3.1.7
Safety performance indicators are effective
G3.2
Utilize proactive safety risk identification and resolution processes in place throughout testing, development and production in order to minimize anomalies.
G3.2.1
The Company employs a safety risk management process and has evidence the process is being used
G3.2.1.1
An internal safety concern reporting system and resolution process exists supporting anomaly identification
G3.2.1.2
All functional areas of the Self-Driving Enterprise identify safety risk
G3.2.1.3
Thresholds for safety risk level decision making and criteria are defined
G3.2.1.4
All identified safety risks are sufficiently mitigated
G3.2.1.4.1
The safety risk register is updated for all mitigation actions
G3.2.1.4.2
The Company performs safety risk monitoring
G3.2.1.4.3
The Company performs an internal evaluation program for compliance to safety risk management process
G3.2.1.5
The Company has a defined safety risk management process
G3.2.1.5.1
The Company has defined safety risk owners and an accountable executive
G3.2.1.5.2
The Company safety risk owners are empowered to affect change
G3.2.1.5.3
The Company cross-functionally reviews safety risks
G3.2.1.5.4
The safety risk stakeholder review outputs are communicated to affected stakeholders
G3.2.1.6
The Company measures efficacy of the safety risk management processes
G3.2.2
Metrics regarding safety performance indicators and safety risk are used to proactively identify trends for continuous improvement
G3.3
Utilize reactive anomaly identification and resolution processes in place throughout testing, development, service, operations, and production in order to decrease recurrence of anomalies
G3.3.1
Appropriate resolution processes identify and appropriately resolve all observed / reported anomalies
G3.3.2
Anomaly health status is appropriately reviewed by relevant internal stakeholders
G4
Resilient
The Self-Driving Vehicle is acceptably safe in case of reasonably foreseeable misuse and unavoidable events
G4.1
Potential harm incurred during and after a vehicle collision is mitigated
G4.1.1
Vehicle platform safety features reduce potential harm
G4.1.2
The Aurora Driver functions appropriately during and after a vehicle collision
G4.1.3
Personnel operating vehicles can appropriately respond to Self-Driving Vehicle emergency situations
G4.1.3.1
On road incident response procedures are documented
G4.1.3.2
Personnel operating or interacting with vehicles are trained on road incident response
G4.1.4
The Self-Driving Vehicle detects when a vehicle collision occurred
G4.1.5
Public safety officials have information to be able to appropriately respond to Self-Driving Vehicle emergency situations
G4.1.6
Riders can appropriately respond to Self-Driving Vehicle emergency situations
G4.2
Potential harm from reasonably foreseeable misuse is mitigated
G4.2.1
Reasonably foreseeable misuse mitigations are designed and implemented
G4.2.1.1
Reasonably foreseeable misuse mitigations are verified and validated
G4.2.1.2
CLAIM DELETED. Use G4.2.1.1 instead
G4.2.2
Insider threat mitigations are designed and implemented
G4.2.2.1
Mitigations for insider threat are verified
G4.2.2.2
Mitigations for insider threat are validated
G4.3
Potential hazards arising from adversarial cybersecurity threats is appropriately mitigated
G4.3.1
The Self-Driving Vehicle design follows appropriate processes to minimize security risks while operating in the intended Operational Design Domain (ODD)
G4.3.1.1
Safety and cybersecurity system architectures and component actions holistically minimize cybersecurity risks while avoiding reasonably foreseeable safety hazards.
G4.3.1.2
Security design principles and approaches are employed in hardware, firmware and software that are designed to minimize risk from potential failures.
G4.3.1.3
The design process identifies architectural sources of cybersecurity risk.
G4.3.1.4
Mitigations for potential architectural sources of risks to safety-critical Vehicle Control systems are employed and documented
G4.3.1.5
The systems security architecture and design should specify reactive measures to ensure the vehicle and fleet can mitigate and minimize safety risks when security controls indicate threats are detected.
G4.3.1.6
Cryptographic credentials that provide an authorized, elevated level of access to vehicle computing platforms are appropriately managed and protected from disclosure
G4.3.2
The Self-Driving Enterprise employs best-practice secure software development and operational security practices designed to minimize risks to Self-Driving Vehicles operating in all active Operational Design Domains (ODD)
G4.3.2.1
Off-board system architecture design sufficiently mitigates safety and cybersecurity risks
G4.3.2.2
Off-board vehicle services release processes and operational controls sufficiently mitigate cybersecurity risks
G4.3.2.3
Building and testing of Self-Driving Vehicle software, firmware and artifacts (models, maps, ...) employ architectures, documented release processes and operational controls which minimize cybersecurity risks in the ODD
G4.3.2.4
Development practices align with relevant cybersecurity industry standards and best-practices
G4.3.2.5
The software and firmware release processes implement cybersecurity controls that enable software to vehicle traceability and vulnerability identification
G4.3.2.6
Third party services and software are periodically reviewed for cybersecurity risks
G4.3.2.7
Cryptographic credentials that control authorized, elevated level of access to Self-Driving Enterprise systems are appropriately managed and protected from disclosure
G4.3.3
A cybersecurity risk management approach and process are employed to continually identify threats and risks as well as recommend and evaluate mitigation strategies.
G4.3.3.1
The cybersecurity risk management system and process are consistent with standards and industry best practices
G4.3.3.2
The cybersecurity risk management system and process are employed throughout the organization’s concept and development process.
G4.3.3.3
A cybersecurity risk assessment is completed for each operational design domain and confirms resilience to defined threats
G4.3.3.4
The cybersecurity risk management system and process is successfully employed and effective in driving corrective actions across the organization.
G4.3.4
The Self-Driving Enterprise is prepared to manage and mitigate impacts from identified cybersecurity incidents or known risks within the Enterprise and the Vehicle.
G4.3.5
The Self-Driving Enterprise periodically reviews and audits its security practices and approaches against industry peers, best practices and standards.
G5
Trustworthy
The Self-Driving Enterprise is trustworthy
S5.1
The organization will promote a good safety culture. Internal and External stakeholders are engaged participatively. External communication about the self-driving enterprise is appropriate and verifiable.
G5.1.1
The organizational environment is appropriate for safety-critical systems
S5.1.1.1
Argument is based on addressing competence alongside safety culture, remaining current with the state of the industry
G5.1.1.1.1
Safety culture and personnel are appropriate for safety-critical systems
G5.1.1.1.2
Persons developing the Self-Driving Enterprise have the required competencies corresponding to their responsibilities
G5.1.1.1.3
Prevailing industry best practices and standards are reviewed and adherence documented, on a continual basis
G5.1.1.1.4
Persons developing the Self-Driving Enterprise are engaged in broader applicable industry proceedings
G5.1.2
Stakeholders are engaged regularly throughout the lifecycle of the Self-Driving Enterprise
G5.1.2.1
Stakeholders are identified with defined interaction relationships
G5.1.2.2
Stakeholders are consulted at appropriate stages of testing and development of the Self-Driving Enterprise
G5.1.2.3
Stakeholders are partnered with at appropriate stages of testing and development of the Self-Driving Enterprise
G5.1.2.4
Stakeholders are informed at appropriate stages of testing and development of the Self-Driving Enterprise
G5.1.2.5
Stakeholder engagement occurs on a consistent and frequent cadence
G5.1.3
Appropriate, verifiable evidence of safety and performance is provided outside the Self-Driving Enterprise
G5.1.3.1
Multimodal communication methods are used
G5.1.3.2
A Safety Case framework for the Self-Driving Enterprise is publicly available
G5.1.3.3
Credible periodic reports and updates are published or released at key points of transition, testing, and development of the Self-Driving Enterprise
G5.1.3.4
Verifiable evidence that the Self-Driving Enterprise is capable of appropriately complying with applicable rules, regulations, and guidance is maintained
G5.1.4
The Self-Driving Enterprise is independently reviewed and audited
G5.1.4.1
A safety advisory board of third-party experts is established
G5.1.4.2
The Self-Driving Enterprise is appropriately reviewed and audited both internally and externally
updated as of 09/15/2026
icon.