Diploma in CSMS: Governance, Threat Modelling and Evidence
Online postgraduate diploma of 800 hours in CSMS governance, threat modelling and evidence. 8 modules covering UNECE R155, ISO/SAE 21434, cybersecurity governance, TARA, threat modelling, verification, audit evidence and post-production operations, with an assigned technical tutor.
Diploma in CSMS: Governance, Threat Modelling and Evidence — studying from Singapore
Singapore has a strong regulatory culture, with specialised agencies overseeing transport, health products, workplace safety and the environment. Reliability, availability, maintainability and safety (RAMS) and homologation work is essential in aviation, rail, marine and medical sectors. Engineers in this area prepare safety cases, certification evidence and compliance documentation. Enterprise Singapore manages the national standards system, and employers include regulators, consultancies and manufacturers seeking market approval.
Fees for Singapore: S$2,130 (Singapore dollar), with instalments and employer sponsorship available.
Relevant bodies in Singapore
Typical roles
Questions from Singapore
Will this qualification be recognised by professional bodies in Singapore?
SEIUM's qualifications are private, not official state degrees, and are not accredited by any national body in Singapore. Singapore's regulators vary by sector, and engineers can seek Professional Engineer status through the Professional Engineers Board. Recognition of a private qualification is decided by employers or the relevant body, so confirm this with them before enrolling.
How might this training be used by employers in Singapore?
Reliability, safety and compliance skills are valued across Singapore's engineering, transport, medical and industrial sectors. This programme may support roles in RAMS or certification support, but it does not guarantee a position. Employers commonly weigh project evidence, professional experience and familiarity with relevant standards.
Can I study this alongside a full-time job, and can my employer help fund it?
The course is online and in English, so you can study from Singapore while working, and no student visa is required. Plan for the hours, which range from 300 to 1,900 depending on the programme. Fees can be paid in instalments, and employer sponsorship is possible; compliance and safety teams in many firms may support relevant study.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Understand the requirements of a CSMS.
Design cybersecurity governance.
Carry out TARA analyses.
Apply threat modelling techniques.
Define security requirements and verification activities.
Prepare evidence for audit.
Manage cybersecurity operations in post-production.
Who it's for
- Automotive cybersecurity engineers.
- CSMS auditors.
- Threat analysts.
- Product security managers.
- Penetration testing engineers moving into the automotive sector.
- Compliance managers.
- Engineering or science graduates seeking to work for vehicle manufacturers.
What you'll work with
- UNECE Regulation No. 155 (cybersecurity)
- ISO/SAE 21434 (road vehicle cybersecurity engineering)
- UNECE Regulation No. 156 (software updates)
- ISO/PAS 5112 (cybersecurity auditing)
- ISO 26262 (functional safety)
- Regulation (EU) 2018/858 (type approval)
- ANSYS medini analyze
- Microsoft Threat Modeling Tool
- Vector CANoe
- Synopsys Defensics
- Jira
8 modules
1.1Cybersecurity in connected vehicles1.2Requirements of UNECE Regulation No. 1551.3Structure of ISO/SAE 214341.4Scope of the CSMS management system1.5Cybersecurity across the life cycle1.6Relationship with type approval1.7Cybersecurity organisation and roles1.8Cybersecurity culture in the company1.9CSMS certification audits1.10Case study: analysis of a CSMS certificate
2.1Corporate policies and procedures2.2Assignment of responsibilities2.3Organisational risk management2.4Competences and training plans2.5Supplier management and interface agreements2.6Cybersecurity incident management2.7Periodic management review2.8Cybersecurity governance indicators2.9Continuous improvement of the system2.10Workshop: product cybersecurity policy
3.1Identification of assets and properties3.2Definition of damage scenarios3.3Definition of threat scenarios3.4Attack path analysis3.5Attack feasibility rating3.6Impact rating3.7Determination of risk level3.8Risk treatment decisions3.9Definition of cybersecurity goals3.10Practical: TARA of a telematics unit
4.1STRIDE methodology applied to vehicles4.2Building attack trees4.3Data flow diagrams4.4Identification of attack surfaces4.5Threats in Annex 5 of R1554.6Reusable threat libraries4.7Threat modelling tools4.8Peer review of the model4.9Continuous updating of the model4.10Lab: threat model of a gateway
5.1Item cybersecurity concepts5.2Technical cybersecurity requirements5.3Secure architecture principles5.4Verification planning5.5Vehicle penetration testing5.6Protocol fuzz testing5.7Secure code review5.8Vulnerability management during development5.9Verification and validation report5.10Practical: penetration test plan
6.1Building the cybersecurity case6.2Required work products6.3Traceability between requirements and tests6.4Evidence provided by suppliers6.5Document management of evidence6.6Preparing for type-approval audits6.7Handling audit findings6.8Responses to the approval authority6.9Retaining evidence throughout the service life6.10Workshop: cybersecurity case for an ECU
7.1Fleet cybersecurity monitoring7.2Vehicle security operations centre7.3Incident response across the fleet7.4Vulnerability management in service7.5Software updates and R1567.6End of support and decommissioning7.7Communication with approval authorities7.8Lessons-learned register7.9Security operations indicators7.10Case study: response to a published vulnerability
8.1Definition of the system scope8.2Governance structure8.3System TARA8.4Definition of requirements8.5Verification plan8.6Evidence plan8.7Post-production operations plan8.8Audit preparation8.9Report and presentation8.10Final project: final review with the tutor
How you'll learn
Training is 100% online on the SEIUM campus, with downloadable materials, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within each intake, so it fits around your job.
Each module combines theory, guided reading of the original standards and applied exercises. The working software is ANSYS medini analyze, Microsoft Threat Modeling Tool, Vector CANoe, Synopsys Defensics and Jira, in free, academic or evaluation versions. Practical work is based on real procedures for TARA of telematics units, penetration testing of control units and preparation of CSMS audits. Assessment is continuous by module, plus the final project.
Standards covered: UNECE Regulation No. 155, ISO/SAE 21434, UNECE Regulation No. 156, ISO/PAS 5112, ISO 26262, Regulation (EU) 2018/858.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- An internet connection and a computer capable of running the programme software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours over 6–8 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with ANSYS medini analyze, Microsoft Threat Modeling Tool, Vector CANoe, Synopsys Defensics, Jira, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute diploma, awarded on passing the continuous assessment and the final project. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed are recognised in a higher programme in the same area (postgraduate diploma or master's). Ask about the recognition policy when you enrol.
Prior technical training or professional experience in the sector (no university degree required), plus English sufficient to read technical standards.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Diploma in Dynamos/Alternators and Mechanical Regulators
600-hour online postgraduate diploma in classic vehicle charging systems: dynamo and alternator repair, setting mechanical contact regulators, batteries, wiring and instrumentation, with an assigned technical tutor.
Diploma in ADR/RID/IMDG/IATA-DGR: Classification and Packaging
Online postgraduate diploma of 800 hours in ADR/RID/IMDG/IATA-DGR classification and packaging. 8 modules covering UN classification, hazard classes, differences between transport modes, approved packaging and its…
Diploma in Reversible Modernisation: Pumps, Filters and Wiring Harness
Online postgraduate diploma of 800 hours in reversible modernisation of pumps, filters and wiring harnesses. 8 modules covering ISO 26262, ISO 21448 (SOTIF), ISO/SAE 21434 and…
More in Regulation, Safety, RAMS & Homologation
All Regulation, Safety, RAMS & Homologation programmes → · How to apply · Fees & financing · Scholarships