Overview
ISO 19299:2020 - Electronic fee collection - Security framework defines an information security framework for Electronic Fee Collection (EFC) systems. Based on the system architecture in ISO 17573-1, the standard sets out security requirements, associated security measures, and guidance for implementing trust and key management across all organizational and technical entities of an EFC scheme. It also includes annexes with threat analysis, security profiles, conformance templates, and privacy recommendations (including GDPR considerations).
Key topics and technical requirements
- Trust model: Defines stakeholder trust relations and technical trust architectures (e.g., TC - Toll Charger, TSP - Toll Service Provider, interoperability management).
- Security requirements: High-level and component-specific requirements for information security management, communication interfaces, data storage, toll chargers, toll service providers and interoperability management.
- Security measures / countermeasures: Concrete protections for interfaces and end‑to‑end security covering DSRC-EFC, CCC, LAC, ICC, front-end/back-end components, and roadside equipment (RSE).
- Key management: Lifecycle, generation, exchange, protection and use of asymmetric and symmetric keys, session key handling and certificate processes (issuance, revocation, CRLs).
- Interface specifications: Security specifications for interoperable interfaces and recommended signature/hash algorithm use, plus profiles for on-board equipment (OBE) and RSE.
- Threat analysis & privacy: Annex D lists potential threats and maps them to security requirements; Annex G offers privacy-focused implementation guidance aligned with GDPR.
Practical applications and who uses ISO 19299:2020
ISO 19299:2020 is used to design, evaluate and certify secure EFC systems and implementations. Typical users include:
- Toll operators and national authorities setting security policies for tolling and EETS (European Electronic Toll Service).
- Toll Service Providers (TSPs) and system integrators implementing back-end and front-end components.
- Vendors of on‑board equipment (OBE), roadside equipment (RSE) and interoperable interface products.
- Security architects, risk assessors and compliance officers conducting threat analysis and deriving security measures.
- Certification bodies and test labs using the Implementation Conformance Statement (ICS) proforma and security profiles.
Related standards
- ISO 17573-1 (EFC system architecture) - referenced as the architectural basis.
- ISO/TS 21193 - common payment media guidance referenced in the 2020 revision.
- Other ITS and cryptographic guidance relevant to interface and key management decisions.
ISO 19299:2020 delivers a practical, standards-based security framework for interoperable and privacy-aware EFC deployments, helping stakeholders reduce risk and implement robust, auditable security controls.
