GB44495 is a mandatory national standard but excludes CCC certification mechanism without standalone official certificate or unique certification serial number. Compliance is verified by accredited lab test report serving as core attachment for China MIIT whole-vehicle announcement application. Misinformation claiming three-year report validity is widely circulated; neither GB44495 standard clauses nor MIIT access regulation specifies fixed expiry date, with test report permanently valid for matching vehicle model unless core security design modification occurs requiring partial supplementary testing.

Full GB44495 Required Documentation List sorted by three categories

Category1: Pre-test Technical Documentation (core submission files for lab & MIIT)

·Complete vehicle electronic network architecture diagram marking all ECU interconnection topology, CAN/LIN/Ethernet bus type and gateway deployment position verified against actual mass-production configuration for lab interface inspection.

·Comprehensive cybersecurity protection scheme detailing targeted countermeasures for four major defense layers (external access safety, in-car communication security, OTA upgrade protection and user data governance), specifying concrete encryption, access-control and anti-tampering implementation instead of general ambiguous security descriptions.

·TARA Threat Analysis & Risk Assessment Report compiled under ISO/SAE 21434 methodology covering full-lifecycle threat identification, risk grading, mitigation plan and residual risk recording per GB44495 mandatory requirement.

·OTA upgrade specification document (only for OTA-equipped models) elaborating firmware signature verification, rollback recovery strategy, upgrade authorization rule and abnormal interruption repair mechanism; omitted for non-OTA vehicles.

·Vehicle data security management plan aligning with GB/T44464 regulating user personal data classification, in-vehicle encrypted storage, cross-border data transmission compliance and end-user data deletion policy.

·Customized lab test plan highlighting high-risk weak points screened from prior gap analysis as priority verification items during official testing.

·Manufacturer conformity self-declaration confirming submitted documents consistent with physical vehicle hardware configuration with legal liability for mismatched specification leading to test rejection.All above technical documents must be compiled in Simplified Chinese instead of raw English technical datasheet.

Category2: Information Security Assurance System Documentation (renamed post No.1 Amendment, standalone CSMS certificate canceled)

·Core system compliance file consisting of full-lifecycle risk management archive and upstream component supplier cybersecurity conformity statement requiring ISO/SAE21434 compliance certification from T-BOX, domain controller and wireless module vendors.

·Internal process record files (reserved for random lab audit instead of MIIT submission): R&D security requirement document, design review log, internal verification record and vulnerability closed-loop management archive with traceable version control; inconsistent on-site document check results lead to immediate test suspension.

Category3: Test-Generated Evidence (issued after lab inspection for announcement filing)

·Official full-test stamped lab report itemizing pass/not applicable status of all four defense-layer test items with bound VIN range and verified vehicle configuration for traceability.

·Independent penetration testing report (full mandatory inspection from July 1, no random sampling) documenting simulated attack path, vulnerability severity rating and verified corrective proof of all identified loopholes.

  Document Update & Supplementary Retest Trigger Conditions

Original valid certification documents require revision and partial targeted retest under following design changes:

·Fundamental electronic architecture upgrade including gateway hardware replacement or core domain-controller security logic revision.

·T-BOX/communication module supplier replacement with different hardware model: Minor specification swap retaining identical security framework only requires component-level supplementary testing; new hardware introducing extra Wi-Fi/5G/V2X communication triggers full external interface & communication security retest plus updated supplier conformity paperwork.

·OTA mechanism upgrade from basic partial-update to full multi-ECU remote upgrade leading to revised OTA specification document and supplementary software security inspection.

·Model production discontinuation: Related test report exits MIIT announcement database without in-use vehicle recertification obligation while OEM retains permanent document archiving accountability.

·Homologation failure: Sub-model hardware revision breaking same-type certification prerequisites demands full new document compilation and independent certification submission.

Test documentation remains permanently effective as long as vehicle core cybersecurity design stays unchanged. Blueasia supports document sorting, pre-submission file review and homologation qualification judgment. Contact Blueasia expert consultant:13534225140