Case Study: North American Vehicle Manufacturer Strengthens SDV Governance with NCC Group

Strengthening a Bus & Coach Manufacturer's Governance around Software Defined Vehicles

North American Vehicle Manufacturer worked with NCC Group to address governance and security risks as its transit bus and coach fleet became increasingly software-defined. The company faced challenges managing hundreds of ECUs across multiple suppliers, with concerns that human error in software updates and configuration changes could affect vehicle safety, compliance, and functionality.

NCC Group implemented a Software Release Management Policy (SRMP) and supporting governance model aligned to ISO 21434, ISO 24089, and UN R156. The solution included ECU inventory tracking, release review boards, cyber-relevancy checks in ECN workflows, traceability through Teamcenter and Git, and stronger supplier assurance via CDIA requirements. As a result, North American Vehicle Manufacturer gained a scalable SDV governance process that reduced cyber risk, improved supplier confidence, and enabled more secure, compliant, and auditable software releases.