Diploma in CSMS: Governance, Threat Modelling and Evidence
Online postgraduate diploma of 800 hours in CSMS governance, threat modelling and evidence. 8 modules covering UNECE R155, ISO/SAE 21434, cybersecurity governance, TARA, threat modelling, verification, audit evidence and post-production operations, with an assigned technical tutor.
Diploma in CSMS: Governance, Threat Modelling and Evidence — studying from South Africa
Regulation, safety and homologation skills are essential across South African industry, from road vehicles and aviation to energy and mining. Engineers must demonstrate compliance with national standards set by the South African Bureau of Standards and sector regulators. Reliability, availability, maintainability and safety analysis is applied in infrastructure, rail, energy and manufacturing projects. Specialists support certification, type approval and risk assessment for both local and export markets.
Fees for South Africa: R 27 900 (South African rand), with instalments and employer sponsorship available.
Relevant bodies in South Africa
Typical roles
Questions from South Africa
Will a SEIUM qualification be recognised by the professional bodies in South Africa for this area?
SEIUM qualifications are private, not official state degrees, and are not accredited by any South African body. Homologation and standards work in South Africa involves the SABS and the National Regulator for Compulsory Specifications (NRCS), while ECSA handles engineering registration. Whether a SEIUM qualification is recognised is for employers or these bodies to decide, so check beforehand.
How might this qualification be used by employers in South Africa in regulation, safety and RAMS roles?
Employers in automotive, rail, energy and industrial sectors value RAMS and compliance expertise, often tied to recognised certifications and experience. A private qualification may strengthen your profile but will not replace formal requirements. Its value depends on each employer's preference, so ask hiring managers how they would assess it.
Can I study this programme alongside full-time work from South Africa, and is there a time zone or language issue?
Yes, the programme is delivered fully online in English, so you can study from South Africa without a student visa. Master's programmes require 1,900 hours, postgraduate diplomas 800 hours and specialist courses 300 hours, with an assigned technical tutor. Fees can be paid in instalments and employer sponsorship is possible. Confirm time-zone and weekly workload expectations with SEIUM before enrolling.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Understand the requirements of a CSMS.
Design cybersecurity governance.
Carry out TARA analyses.
Apply threat modelling techniques.
Define security requirements and verification activities.
Prepare evidence for audit.
Manage cybersecurity operations in post-production.
Who it's for
- Automotive cybersecurity engineers.
- CSMS auditors.
- Threat analysts.
- Product security managers.
- Penetration testing engineers moving into the automotive sector.
- Compliance managers.
- Engineering or science graduates seeking to work for vehicle manufacturers.
What you'll work with
- UNECE Regulation No. 155 (cybersecurity)
- ISO/SAE 21434 (road vehicle cybersecurity engineering)
- UNECE Regulation No. 156 (software updates)
- ISO/PAS 5112 (cybersecurity auditing)
- ISO 26262 (functional safety)
- Regulation (EU) 2018/858 (type approval)
- ANSYS medini analyze
- Microsoft Threat Modeling Tool
- Vector CANoe
- Synopsys Defensics
- Jira
8 modules
1.1Cybersecurity in connected vehicles1.2Requirements of UNECE Regulation No. 1551.3Structure of ISO/SAE 214341.4Scope of the CSMS management system1.5Cybersecurity across the life cycle1.6Relationship with type approval1.7Cybersecurity organisation and roles1.8Cybersecurity culture in the company1.9CSMS certification audits1.10Case study: analysis of a CSMS certificate
2.1Corporate policies and procedures2.2Assignment of responsibilities2.3Organisational risk management2.4Competences and training plans2.5Supplier management and interface agreements2.6Cybersecurity incident management2.7Periodic management review2.8Cybersecurity governance indicators2.9Continuous improvement of the system2.10Workshop: product cybersecurity policy
3.1Identification of assets and properties3.2Definition of damage scenarios3.3Definition of threat scenarios3.4Attack path analysis3.5Attack feasibility rating3.6Impact rating3.7Determination of risk level3.8Risk treatment decisions3.9Definition of cybersecurity goals3.10Practical: TARA of a telematics unit
4.1STRIDE methodology applied to vehicles4.2Building attack trees4.3Data flow diagrams4.4Identification of attack surfaces4.5Threats in Annex 5 of R1554.6Reusable threat libraries4.7Threat modelling tools4.8Peer review of the model4.9Continuous updating of the model4.10Lab: threat model of a gateway
5.1Item cybersecurity concepts5.2Technical cybersecurity requirements5.3Secure architecture principles5.4Verification planning5.5Vehicle penetration testing5.6Protocol fuzz testing5.7Secure code review5.8Vulnerability management during development5.9Verification and validation report5.10Practical: penetration test plan
6.1Building the cybersecurity case6.2Required work products6.3Traceability between requirements and tests6.4Evidence provided by suppliers6.5Document management of evidence6.6Preparing for type-approval audits6.7Handling audit findings6.8Responses to the approval authority6.9Retaining evidence throughout the service life6.10Workshop: cybersecurity case for an ECU
7.1Fleet cybersecurity monitoring7.2Vehicle security operations centre7.3Incident response across the fleet7.4Vulnerability management in service7.5Software updates and R1567.6End of support and decommissioning7.7Communication with approval authorities7.8Lessons-learned register7.9Security operations indicators7.10Case study: response to a published vulnerability
8.1Definition of the system scope8.2Governance structure8.3System TARA8.4Definition of requirements8.5Verification plan8.6Evidence plan8.7Post-production operations plan8.8Audit preparation8.9Report and presentation8.10Final project: final review with the tutor
How you'll learn
Training is 100% online on the SEIUM campus, with downloadable materials, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within each intake, so it fits around your job.
Each module combines theory, guided reading of the original standards and applied exercises. The working software is ANSYS medini analyze, Microsoft Threat Modeling Tool, Vector CANoe, Synopsys Defensics and Jira, in free, academic or evaluation versions. Practical work is based on real procedures for TARA of telematics units, penetration testing of control units and preparation of CSMS audits. Assessment is continuous by module, plus the final project.
Standards covered: UNECE Regulation No. 155, ISO/SAE 21434, UNECE Regulation No. 156, ISO/PAS 5112, ISO 26262, Regulation (EU) 2018/858.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- An internet connection and a computer capable of running the programme software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours over 6–8 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with ANSYS medini analyze, Microsoft Threat Modeling Tool, Vector CANoe, Synopsys Defensics, Jira, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute diploma, awarded on passing the continuous assessment and the final project. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed are recognised in a higher programme in the same area (postgraduate diploma or master's). Ask about the recognition policy when you enrol.
Prior technical training or professional experience in the sector (no university degree required), plus English sufficient to read technical standards.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Diploma in Supplier Auditing and Declarations of Conformity
Online postgraduate diploma of 800 hours in supplier auditing and declarations of conformity. 8 modules covering supplier management, supplier auditing, automotive quality requirements, declarations of conformity,…
Diploma in Automotive Cybersecurity Testing and Pen-Testing
Online postgraduate diploma of 800 hours in automotive cybersecurity testing and pen-testing. 8 modules covering fundamentals, ISO 26262 and ISO 21448 (SOTIF), analysis with Medini Analyze,…
Diploma in Multi-Region NCAP Protocols and Injury Criteria
Online postgraduate diploma of 800 hours in multi-region NCAP protocols and injury criteria. 8 modules covering impact injury biomechanics, injury criteria and dummies, Euro NCAP, North…
More in Regulation, Safety, RAMS & Homologation
All Regulation, Safety, RAMS & Homologation programmes → · How to apply · Fees & financing · Scholarships