## 3 Methods
### The Proposed Model  
The research model for evaluating the relative importance of items based on the autonomous vehicle security-level check items is shown in Figure 2. The goal of the research model is the first layer, and the second layer is divided into three areas of autonomous vehicle security-level check items: management, technology, and physical areas. These areas are used to form the sub-criteria for evaluation. The third layer consists of 13 items. The sub-items for conducting the management security-level check are CSMS establishment and implementation, cybersecurity risk assessment, autonomous vehicle concept, development and verification, mass production and operation security, and supply chain cybersecurity. Sub-items of the technical security-level check include authentication and authorization management, access control, autonomous driving data encryption, development security,  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Items** & **Checklists** & **Description** \\ \hline \multirow{7}{*}{Administrative level check} & Establishment and implementation of Cyber & Establishment of a comprehensive management system for establishing and implementing CSMS, supervising CSMS implementation, etc. \\  & Cybersecurity risk assessment of & Asset identification, risk assessment, and risk \\  & autonomous vehicles & scenario planning \\  & Autonomous vehicles & Establishment and implementation of cybersecurity requirements during project \\  & concept/development/verification & planning/concept/development/verification phases \\  & Security in mass production and operation & Establishment and implementation of cybersecurity \\  & Security in mass production and operation & incident response during mass production and operation, and establishment and implementation of \\  & & update management \\  & Supply chain cybersecurity & Specification of cybersecurity items in the business \\  & Supply chain cybersecurity & agreement, security activity evaluation during \\  & & Supplier development and after development \\ \hline \multirow{7}{*}{Authentication and authority management} & Authentication and authority management & Authentication and authority management \\  & & including authority management when accessing vehicle resources and secure authentication in \\  & & case of vehicle communication channel threat \\  & Access control & Control user access to autonomous vehicles and \\  & Access control & backend servers, access control such as secure \\  & & network access and network separation \\  & Data encryption & Encryption when transmitting/receiving data when \\  & & storing data for vehicle, communication channels \\ Technical level check & & and backend servers \\  & Development security & Establishment and implementation of security \\  & & policies when developing vehicles, communication \\  & & channels, backend servers, etc. \\  & Vehicle security operation management & Security operation management of SW update, \\  & Vehicle security operation management & vaccine, operation to prevent CAN \\  & & flooding/malicious V2X, etc. \\  & Logging and security monitoring & Storage and monitoring about security logs of \\  & Logging and security monitoring & autonomous vehicles, communication channels, \\  & & backend servers, etc. \\ \hline \multirow{2}{*}{Physical level check} & Physical access control for vehicles & Control of unauthorized hardware access to \\  & Physical access control for backend servers & vehicle modules \\ \hline \hline \end{tabular}
\end{table}
Table 1: Level checklists derived by this study for autonomous vehicle security.  
logging and security monitoring, and vehicle-security operation management. The sub-items of the physical security-level check are physical access control for vehicles and physical access control for backend servers.