Two rooms.
One incident.
The OEM's Incident Command sees the fleet. Each affected project runs its own Incident Management. Both work the same trace on the same graph — nothing lost in handover, and the R155 report is written by what actually happened.
Fleet events,
clustered and typed.
Vehicle SOC events land on the fleet map with geography and pattern clustering. A CVE match from Sheet 03 can raise the same alarm — one detection surface, two inputs.
The program room.
Fleet-wide picture.
Promote a cluster to an incident and scope it across programs, projects and suppliers in one action. Every decision lands on the command timeline.
The engineering room.
Project-level fix.
Each affected project works its slice: incidents attach to model nodes, impact analysis reuses the TARA, treatment tracks to verification. Findings convert to risks or vulnerabilities without duplication.
The report writes itself.
The TARA gets smarter.
Authority reporting is generated from the incident record, not reconstructed. Closed incidents feed back: affected threat scenarios and feasibility ratings update on the paths that were actually attacked.