[GM SSQ Readiness Practical Guide (1)] What Are GM TPCR·SSQ? Information Security Requirements Automotive Parts Suppliers Need to Know
GM SSQ Readiness Practical Guide — Four-Part Series This four-part series explains the information security requirements of the global automotive supply chain and examines practical response strategies suited to the size and circumstances of small and mid-sized manufacturers. In an Automotive Parts Supply Contract, Information Security Is a Baseline Qualification The competitiveness of automotive parts manufacturers has long been evaluated around Quality, Cost, and Delivery. With the digital transformation of the automotive industry and the growing connectivity of global supply chains, it is now an established fact that information security is also a basic qualification for sound management. Automotive parts manufacturers handle a wide range of information, including customers’ design drawings and technical data, production information, and quality-control data, and they also operate IT systems connected to ERP, MES, production equipment, and suppliers. An information security incident in this environment can go beyond a simple system failure and lead to leakage of technical information, production stoppages, delivery delays, and a loss of trading confidence. Following global automakers such as BMW, Volkswagen, and Daimler, General Motors (GM) also maintains information security policies and requirements for suppliers. Depending on the scope of a supplier’s contract, GM presents either the Third Party Cybersecurity Requirements (TPCR) or the Standard Security Questionnaire (SSQ) and requires a response. This practical guide series sets TPCR aside and is limited to the SSQ. It provides practical guidance on where to start, what to prepare, and how to prepare for GM’s small and mid-sized automotive parts suppliers that do not have sufficient information security specialists or budget. 1. Understanding GM’s Supplier Information Security SSQ The SSQ is not met by document preparation alone The GM SSQ consists of five domains (Governance, Identify, Protect, Detect, Response) and 36 questions, and a related explanation is required when an item is not in a Compliant state. Simply having the relevant policies and guidelines in place is unlikely to be recognized as a Compliant state. Recognition requires connected evidence submitted in a three-tier structure (policies and procedures – execution and evidence – leadership review and improvement evidence). In addition, a confirmation meeting follows the submission of evidence for each question, so it is also important that actual operating conditions match the evidence submitted. Looking at an actual question as an example makes the meaning easier to understand. [SSQ Actual Question Example — Detect Section, Question 4] “Is the network infrastructure monitored and logs captured, analyzed and investigated? (Is the network infrastructure monitored, are logs collected and analyzed, and are identified anomalies investigated?)” If preparation for this question consists only of deploying a centralized log server and collecting logs from the network infrastructure, the item is very likely to be assessed as Partial or Not Compliant. To be assessed as Compliant, the following core activities and evidence are required. Therefore, specialists must first interpret the precise meaning of all 36 questions. On that basis, targets can be set for what to prepare, to what level, and how. 2. SSQ readiness must cover not only documents but actual operating conditions. SSQ readiness does not end when evidence is submitted for each question. It also includes a confirmation-meeting stage and stages for assessment results and corrective action. In addition, GM plans to repeat this management cycle regularly every year and therefore requires continuous maintenance of the information security level. With this in mind, the phased procedure we propose is as follows. Phased preparation activities for the SSQ assessment The phased procedure below is the practical preparation process we propose. 3. Practical Difficulties Faced by Small and Mid-Sized Automotive Parts Suppliers SSQ readiness is therefore not a simple administrative task of answering information security questions. It is a combined undertaking that requires interpreting the requirements, implementing the necessary security controls, securing operating evidence, and being able to explain the actual state of implementation. However, not every automotive parts supplier has sufficient specialists and investment capacity to carry out these activities. According to 2025 statistics from the Korea Auto Industries Cooperative Association, 392 (55.9%) of the 701 tier-1 automotive parts suppliers that deliver directly to automakers in Korea are classified as small enterprises in those statistics. In this industrial structure, the information security challenge facing small and mid-sized manufacturers is not simply recognizing the importance of security. It is the need to implement multiple requirements to an actually operable level with limited staff and budget. According to the “2025 Information Security Status Survey” published by the Ministry of Science and ICT and the Korea Information Security Industry Association, 80.6% of companies in Korea recognize information security as important, but only 52.6% have an information security policy and only 32.7% have conducted information security training. Among companies that perform information security work, only 35.3% have a security organization. These figures are not the result of a survey limited to automotive parts suppliers, but they show that companies in Korea face a gap between awareness of the importance of information security and actual response capability. (1) Shortage of Information Security Specialists and Operating Capability Among companies that perform information security work, 35.3% have a separate information security organization, and even among those that do, concurrent (dual-role) operation is common. In addition, 45.7% of companies cited operation and management of an information security management system as a major difficulty. If an IT staff member at a manufacturer must handle the internal network, servers, business systems, and user support while also covering information security policy, vulnerability analysis, security monitoring, and incident response, the workload inevitably grows. Rather than securing every dedicated security specialist in-house, it is necessary to draw a reasonable line between the role of internal staff and the scope of support from an external specialist organization. (2) Difficulty Gaining Visibility into IT Assets and the Security Environment To meet SSQ requirements, an organization must first confirm which IT·OT assets and systems exist and which security controls are applied where. Manufacturers may operate systems with different characteristics, including not only general business PCs and servers but also ERP, MES, production equipment, and industrial networks. In particular, equipment managed by equipment suppliers and OT environments in which production stoppages must be minimized are difficult to manage in the same way as ordinary IT assets. The information security survey also found that 42.6% of companies have difficulty searching for the security products and services they need. This suggests that, beyond simply choosing a new solution, it is important to identify precisely the assets that must be protected today and the security functions that are required. A technical survey of existing IT·OT assets and the security environment should therefore come before the selection of security products. (3) Implementation Cost of Security Solutions and the Ongoing Operating-Cost Burden In the “2025 Information Security Status Survey,” the greatest difficulty cited by companies was securing an information security budget (49.1%), and only 54.8% of all companies reported that they actually use an information security budget. When license, maintenance, system-upgrade, and operating-staff costs are considered together with the initial purchase cost of a security solution, the burden on the company grows further. In particular, if log management, asset management, vulnerability management, access control, and backup and recovery must all be invested in at the same time for SSQ readiness, a phased approach that reflects the company’s size and capacity to invest is required. It is important to review whether existing IT resources can be reused and to compare the total cost of ownership (TCO) of open-source and commercial solutions so that the required security controls can be implemented at a reasonable cost. (4) Limited Experience with Evidence Management and On-Site Verification Response Introducing an information security policy or system alone does not sufficiently demonstrate that management activities are actually taking place. The information security survey in Korea found that 52.6% of companies have an information security policy and 32.7% conduct training, showing that differences among companies exist even in basic management activities. That survey result does not, however, directly measure the level of SSQ evidence management. Responding to an SSQ assessment requires, together with policy documents, materials that prove actual operation, such as system configuration records, inspection records, security-event investigation results, and corrective-action history. In an on-site interview, the responsible staff must also be able to explain how security controls are operated and what results have been achieved. It is therefore preferable to establish an evidence-management system so that routine security activities are recorded and can be verified whenever needed, rather than rushing to draft documents just before an assessment. These difficulties are not unique to small and mid-sized manufacturers. They are a practical management challenge that small information security companies, which deliver professional security services with limited staff and budget, can also understand. As a small enterprise ourselves, we understand the constraints of staffing and investment cost. Rather than recommending unconditional new investment or an excessive security system, we place importance on practical solutions that use existing capabilities and resources.