Samsung Automotive Storage: Industry’s First to Achieve CSMS ML3 Certification

Today, the automotive industry is rapidly evolving with electrification and software-driven innovation. Vehicles are no longer just a means of transportation—they are transforming into hyper-connected platforms that generate, process, and share vast amounts of data. With the integration of advanced information and communication technologies (ICT) such as vehicle-to-everything (V2X) communication, artificial intelligence (AI), and autonomous driving, new vehicle concepts such as smart, connected, and autonomous cars are emerging. As a result, the importance of a robust cybersecurity management system (CSMS) to protect the enormous amount of data generated by vehicles has become greater than ever.

CSMS is a standardized framework for cybersecurity governance across the automotive sector, covering the entire product lifecycle—from development to operation and maintenance. Unlike evaluations focused on individual product security, CSMS assesses how effectively an organization has embedded security into its culture and management system. In other words, it verifies whether a company implements cybersecurity not as a single function, but as a core element of its organizational DNA.

This regulatory framework is rapidly spreading across the global automotive industry. The United Nations Economic Commission for Europe (UNECE) has mandated CSMS certification under Regulation No. 155 (R155) as a prerequisite for vehicle type approval. South Korea is aligning its national standards with UNECE regulations, with the following implementation timelines:

• EU: Applied to new vehicle types in July 2022 → Expanded to all new vehicles by July 2024
• Korea: Applied to new vehicle types in August 2025 → Expanded to all new vehicles by August 2027

As global automotive cybersecurity regulations tighten, achieving internationally recognized security management certification has become an essential requirement for all vehicle-related components, including storage, memory, and semiconductor devices.

In response to these changes, Samsung Electronics has become the first in the storage industry to achieve CSMS ML3 certification, setting a new benchmark for security in automotive semiconductors. CSMS ML3 represents the highest level of cybersecurity maturity, demonstrating a company’s ability to implement continuous improvement and maintain a systematic, organization-wide security management process. It is a distinction reserved for companies that integrate security into every operational process, rather than treating it as a one-time compliance effort.

This achievement officially recognizes that all of Samsung’s automotive storage products—including UFS and SSD solutions— comply with the industry’s highest CSMS ML3 standards. Scheduled for release next month, Automotive UFS 4.1 serves as a core storage solution for securely storing and processing massive volumes of data generated by driving, infotainment, and autonomous driving algorithms. Designed with a Security by Design approach from the earliest stages of development, it was engineered to eliminate potential vulnerabilities across various environments, including over-the-air (OTA) updates, V2X communication, and cloud connectivity—ensuring enhanced reliability and safety across the entire automotive system.

As data utilization in vehicles continues to grow exponentially, cybersecurity has become a defining factor for both product reliability and corporate competitiveness. Through its CSMS ML3 certification, Samsung strengthens global customer trust and continues to build upon its proven expertise in automotive storage security. Moving forward, Samsung will continue to advance its security management framework, further solidifying its position as a global leader in automotive data protection and digital transformation.