Security and Compliance

Least-privilege access, multi-factor authentication, and role-based controls across all systems, with regular access reviews.

Data is encrypted at rest and in transit using industry-standard algorithms, with defined key management and rotation practices.

Risks are identified, assessed, and tracked on a continuous basis. Findings feed directly into our control environment and remediation priorities.

Regular scanning and time-bound remediation identify, assess, and patch vulnerabilities before they can be exploited.

A documented IR plan with defined escalation paths and customer notification procedures ensures incidents are contained and communicated promptly.

Disaster recovery and business continuity plans are tested regularly to ensure resilience and minimize customer impact during disruptions.

Threat Analysis and Risk Assessment is performed for every product before development begins. Attack paths, damage scenarios, and Cybersecurity Assurance Levels (CAL) are assigned per Clause 15. Findings directly drive cybersecurity goals and requirements.

Cybersecurity goals derived from TARA are decomposed into verifiable engineering requirements. A cybersecurity concept defines the countermeasures allocated to each system and software component per Clauses 9 and 10.

Attack surface analysis and defense-in-depth principles are applied at the architecture level. Security requirements are allocated to components before implementation, with design reviews gating each development phase.

Test cases are derived from TARA attack paths and include fuzz testing, interface testing, and independent penetration testing. Coverage is verified against CAL level requirements per Clause 11.

CVEs and security advisories are continuously monitored across all software components. Defined triage SLAs, coordinated disclosure processes, and customer notification procedures are maintained per Clause 8.

Third-party components are assessed for cybersecurity compliance before integration. Interface agreements with development partners define cybersecurity responsibilities and requirements per Clause 7 distributed development.

Our software elements are developed to ASIL B and ASIL D levels with documented decomposition. ASIL allocation per component is included in the safety plan provided to customers.

Each product is delivered with a structured safety case, HARA outputs, and verification evidence that customers can reference directly in their own ISO 26262 submissions.

Every safety-relevant product is delivered with a safety manual that defines assumptions of use, integration constraints, and required measures for the customer's environment.

SIL and HIL testing campaigns verify safety requirements under nominal and fault-injection conditions. Full test records are included in the safety evidence package.

Development tools used in safety-relevant processes are qualified per ISO 26262 Part 8. Qualification reports are available for customer review during supplier audits.

We work with customers to formally document the distribution of safety responsibilities between Applied Intuition and the integrating organization, including SEooC assumptions and interface agreements.

Software requirements are systematically elicited, analyzed, and traced to customer needs. Changes are managed and communicated across the development team with full traceability.

Architecture and detailed design are documented, reviewed, and baselined before implementation. Design decisions are traceable to requirements and verified through structured review.

Software units are implemented against defined specifications and verified through unit testing. Test results are documented and linked to the requirements they cover.

Software components are integrated incrementally and tested against architecture specifications. Integration test results are baselined and available for customer review.

All work products are identified, stored, and controlled under configuration management. Baselines are established at defined milestones and accessible for supplier audits.

Development activities are planned with defined objectives and tracked against actuals. Deviations are identified early and corrective actions are documented and followed through.

Before any release reaches our customers, it goes through a series of quality checks including peer reviews, automated testing, regression validation, and release readiness reviews. Our objective is to identify and address issues earlier in the process, ensuring stable and predictable releases.

We proactively identify, assess, and manage risks throughout the product lifecycle to prevent impact on delivery and customers. Risks are regularly reviewed and mitigated through defined actions, supporting stable execution and business continuity even in challenging or changing conditions.

Customer feedback plays a central role in our quality strategy. We regularly review quality performance, support trends, and customer input to drive product enhancements, process improvements, and a better overall customer experience.

When issues are identified, our teams work to understand the impact, determine the root cause, and implement effective resolutions. We prioritize clear communication and collaborate closely with customers whenever an issue may affect their deployment or operations.

We maintain end-to-end traceability throughout the development lifecycle. Every release can be traced back to its requirements, design decisions, reviews, and verification activities, providing transparency and confidence in the delivered product.

We view every issue, lesson learned, and customer feedback opportunity as a chance to improve. Root causes are systematically analyzed, corrective actions are tracked to completion, and improvements are incorporated into our processes and products.