What does ISO/SAE 21434 cover?
ISO/SAE 21434 sets out how vehicle manufacturers and suppliers manage the cybersecurity risks of electrical and electronic vehicle systems, from concept through development, production, operation and maintenance to decommissioning. The edition to apply is ISO/SAE 21434:2021.
The standard's risk assessment is called TARA (threat analysis and risk assessment). The article on the TARA method under ISO/SAE 21434 describes how it works and why it goes stale when the vehicle changes. The standard complements ISO 26262 on functional safety; the comparison safety vs security explains the difference.
Voluntary standard, binding regulation: ISO/SAE 21434 and UN R155
What is legally binding is not the standard but UN R155. Under it, the vehicle manufacturer needs a valid certificate of compliance for its cyber security management system (CSMS) (paragraph 7.3.1), valid for at most three years (paragraph 6.7). For each vehicle type it carries out an exhaustive risk assessment that also considers interactions with external systems (paragraph 7.3.3), and it identifies and manages supplier-related risks (paragraph 7.3.2).
R155 does not prescribe a method. A footnote to paragraph 5.3.1 names ISO/SAE 21434 as one source of expertise on risk assessment. The entry on UN R155 explains what the CSMS covers; software updates are governed by the sister regulation UN R156 with its software update management system (SUMS).
In the EU, row D4 of Annex II to Regulation (EU) 2019/2144, as amended by Delegated Regulation (EU) 2022/1398, refers to UN R155. Since 6 July 2022, type approval has been refused for new vehicle types without protection against cyberattacks, and since 7 July 2024 such new vehicles may no longer be registered. In Germany, the Federal Motor Transport Authority (KBA) issues the CSMS certificate on the basis of the technical service's audit reports and grants type approval.
Who has to show what?
Whether you have to apply ISO/SAE 21434 depends on your role in the supply chain.
| Your role | Basis of the obligation | What you provide |
|---|---|---|
| Vehicle manufacturer with EU type approval | UN R155 via Regulation (EU) 2019/2144 | CSMS certificate, risk assessment per vehicle type, management of supplier risks |
| Supplier of control units or software for type-approved vehicles | contract with the manufacturer, who must manage its supplier risks under paragraph 7.3.2 | the evidence agreed in the contract; ISO/SAE 21434 applies if the contract refers to it |
| Manufacturer of a product with digital elements outside type approval, such as a diagnostic tool | Cyber Resilience Act, unless an exclusion applies | the evidence required by the CRA |
| Operator of a back end for vehicle services on behalf of the manufacturer | contract; the manufacturer considers back-end servers under Annex 5 Part C of R155 | the measures agreed in the contract against the threats listed there |
As a supplier, check the contract first: it sets which work products you deliver and whether an assessment report under ISO/SAE 21434 is required. If it only refers generally to "state-of-the-art cybersecurity", agree in writing before the project starts which evidence the manufacturer expects for its risk assessment under paragraph 7.3.3.
How it differs from ISO 27001, TISAX and the Cyber Resilience Act
ISO/SAE 21434 concerns the vehicle product. The other frameworks start elsewhere:
- ISO/IEC 27001 describes a management system for the organization's information security, not for the vehicle.
- TISAX assesses information security when exchanging data with partners, for example for prototype protection.
- Under Article 2(2)(c), the Cyber Resilience Act, Regulation (EU) 2024/2847, does not apply to products with digital elements to which Regulation (EU) 2019/2144 applies. It can apply to products outside type approval; the CRA guide sets out the obligations.
ISO 21434 in Rizzqo
In Rizzqo, you record a vehicle function as an item and its parts, such as a gateway control unit, as components. The ISO 21434 requirements are attached to each component and go to the right person. For the TARA, you record damage and threat scenarios, assess the risk in euros and plan measures as tasks that sync both ways with Jira.