ISO/SAE 21434 — Road Vehicles Cybersecurity Engineering

Why does it matter?

The Introduction says the document aims to enable the engineering of E/E systems to keep up with state-of-the-art technology and evolving attack methods, and that it provides vocabulary, objectives, requirements and guidelines as a foundation for common understanding throughout the supply chain. Its three stated aims are to define cybersecurity policies and processes, to manage cybersecurity risk and to foster a cybersecurity culture. It can be used to implement a cybersecurity management system that includes cybersecurity risk management, which is the kind of system UN Regulation No. 155 asks a vehicle manufacturer to demonstrate.

Key benefits include:

• One vocabulary across the supply chain

Defined terms such as item, component, asset, damage scenario and cybersecurity goal let a vehicle maker and a supplier describe the same risk the same way.

• A clear split of responsibility

Clause 7 assigns responsibilities for cybersecurity activities between customer and supplier, recorded in a cybersecurity interface agreement.

• Risk managed across the whole life

Clauses 9 to 14 run from concept through product development, validation, production and operations to end of cybersecurity support and decommissioning.

• Traceable evidence

Work products, identified as WP, are the results of cybersecurity activities that fulfill one or more requirements.

• A base for a management system

The Introduction states the document can be used to implement a cybersecurity management system with risk management.

How does it work?

Management comes first. Clause 5 covers organizational cybersecurity management, meaning the cybersecurity policies, rules and processes of the organization. Clause 6 covers cybersecurity management and activities at the project level, and clause 7 sets requirements for assigning responsibilities between customer and supplier. Clause 8 covers continual cybersecurity activities that feed ongoing risk assessment, and the vulnerability management of E/E systems until end of cybersecurity support.

Engineering then follows the item through its life. Clause 9 (concept) determines cybersecurity risks, cybersecurity goals and cybersecurity requirements for an item. Clause 10 (product development) defines the cybersecurity specifications and implements and verifies the requirements, and clause 11 validates the item at the vehicle level. Clause 12 covers production, clause 13 operations and maintenance including cybersecurity incident response and updates, and clause 14 end of cybersecurity support and decommissioning.

Clause 15 provides threat analysis and risk assessment (TARA) methods: modular methods for analysis and assessment that determine the extent of cybersecurity risk so that treatment can be pursued. Prerequisites are mandatory inputs consisting of work products from a previous phase, while further supporting information is information that can be considered. Provisions use the identifiers RQ for a requirement, RC for a recommendation, PM for a permission and WP for a work product.

Key Elements

• Item, component and asset

An item implements a function at the vehicle level; an asset has value and one or more cybersecurity properties (confidentiality, integrity, availability) whose compromise can lead to damage scenarios.

• Cybersecurity goals and concept

A cybersecurity goal is a concept-level requirement tied to one or more threat scenarios; the cybersecurity concept adds requirements on the operational environment and information on controls.

• TARA methods (clause 15)

Threat analysis and risk assessment built on damage scenarios, impact, attack paths and attack feasibility.

• Cybersecurity interface agreement (clause 7)

The agreement between customer and supplier concerning distributed cybersecurity activities.

• Cybersecurity case and claim

A cybersecurity case is a structured argument supported by evidence to state that risks are not unreasonable; a cybersecurity claim is a statement about a risk.

• Work products and identifiers

Provisions and work products carry unique identifiers; [RQ-05-14] is the 14th provision in clause 5 and is a requirement.

What does it cover?

Clause 1 specifies engineering requirements for cybersecurity risk management regarding concept, product development, production, operation, maintenance and decommissioning of E/E systems in road vehicles, including their components and interfaces. It defines a framework that includes requirements for cybersecurity processes and a common language for communicating and managing cybersecurity risk. The document applies to series production road vehicle E/E systems whose development or modification began after its publication, and it does not prescribe specific technology or solutions related to cybersecurity.

What are its objectives?

The Introduction states what the document enables an organization to do.

Define cybersecurity policies and processes.

Manage cybersecurity risk across the life of an E/E system.

Foster a cybersecurity culture.

Keep the engineering of E/E systems abreast of evolving attack methods.

Give the whole supply chain a common understanding of road vehicle cybersecurity.

Framework in Context

The Foreword states that the first edition of ISO/SAE 21434 cancels and supersedes SAE J3061:2016, and its only normative reference is ISO 26262-3:2018 on the concept phase of functional safety. UN Regulation No. 155, in force since January 22, 2021, requires a vehicle manufacturer to hold a valid Certificate of Compliance for a cybersecurity management system (paragraph 7.3.1) that covers development, production and post-production (7.2.2.1) and manages dependencies on suppliers (7.2.2.5). It lists ISO/SAE 21434 only as an example in a footnote to paragraph 5.3.1(a), so the standard is not a stated requirement of the regulation. ISO/PAS 5112:2022 gives guidelines for auditing such a system, based on the processes in ISO/SAE 21434.

Common Framework Mappings

Organizations map ISO/SAE 21434 to the automotive, safety and enterprise security frameworks below so that one set of cybersecurity engineering records serves regulators, customers and the enterprise security program.

Mapped frameworks include:

IEC 62443

ISO 26262

ISO 27001:2022

ISO 27002:2022

MITRE ATT&CK

NIST CSF 2.0

SAE J3061

UNECE R155