Implementation walkthrough
How to implement ISO/SAE 21434: video walkthrough
A walkthrough of building cybersecurity engineering into road vehicle development with ISO/SAE 21434, at organisation, project and product level.
Key takeaways
- ISO/SAE 21434 covers cybersecurity risk across the vehicle E/E life cycle.
- It works at organisation, project and product level.
- Threat analysis and risk assessment drive cybersecurity goals.
- Supply chain responsibilities are agreed and documented.
- Vehicle manufacturers need an R155 CSMS assessment by the approval authority.
When someone attacks the electronics
ISO/SAE 21434 is the international standard for cybersecurity engineering in road vehicles, prepared jointly by ISO and SAE International. It sets engineering requirements for managing cybersecurity risk in a vehicle's electrical and electronic systems through their life: concept, development, validation, production, operations and maintenance, and the end of cybersecurity support and decommissioning. Functional safety asks what happens when electronics fail; ISO/SAE 21434 asks what happens when someone attacks them, through a back-end server, a communication channel, an update procedure or physical access.
There is no single accredited company certificate. For vehicle manufacturers the legal route is UN Regulation No 155, under which the approval authority assesses the cybersecurity management system. This short film walks through how the standard is implemented.
The standard itself is voluntary; for suppliers the requirement normally arrives by contract, as cybersecurity work products agreed for their part of the development.
Organisation, project and product
Start with what must be demonstrated, and to whom: a vehicle manufacturer's cybersecurity management system for R155, or a supplier's processes and components for its customers. The organisation then specifies its cybersecurity policies, rules and processes, with defined responsibilities and competence and organisational audits that test them.
Each project plans and manages its cybersecurity activities. Responsibilities are agreed with suppliers in the supply chain, and continual activities monitor cybersecurity information, evaluate events and manage vulnerabilities. Through the product life cycle, the concept phase defines cybersecurity goals from a threat analysis and risk assessment, development derives and verifies cybersecurity requirements, and validation, production, operations and maintenance and the end of support follow. The methods for threat analysis and risk assessment are set out in the standard itself. For vehicle types under R155, critical elements are identified, an exhaustive risk assessment is done and the security measures are tested before approval.
Sterling's expert and experienced consultants build the cybersecurity management system and project evidence with your engineers under Sterling OS™. ISO/SAE 21434:2021 is the first edition.
ISO/SAE 21434 at a glance
- Purpose
- Cybersecurity risk management for the electrical and electronic systems of road vehicles, across the lifecycle from concept to the end of cybersecurity support
- Relevant to
- Vehicle manufacturers, suppliers at every tier and developers of automotive hardware and software; UN Regulation No 155 adds a legal CSMS requirement for manufacturers where it applies
- Edition
- ISO/SAE 21434:2021, first edition, published August 2021; under ISO's systematic review since July 2026, with no revision project named
- Certification
- No accredited management-system certificate: manufacturers need an R155 CSMS certificate through the approval authority; certification bodies certify processes and components under their own programmes
- Sterling's role
- Cybersecurity management system and project evidence built with your engineers, Effivity, training, internal audit and readiness for assessment, then Sustain™
- Cost and timing
- Total investment for an ISO/SAE 21434 cybersecurity management system depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months
ISO/SAE 21434: questions people ask
Can our company be ISO/SAE 21434 certified?
Not in the way a company is certified to ISO 9001 or ISO/IEC 27001: there is no accredited management-system certification to ISO/SAE 21434 of the kind ISO/IEC 17021-1 governs. What exists is narrower and more useful: for vehicle manufacturers, the UN R155 Certificate of Compliance for CSMS; for suppliers and developers, certification of a defined development process or component under a certification body's own programme; and organisational audits guided by ISO/PAS 5112. Ask your customer which it expects.
Is ISO/SAE 21434 mandatory?
The standard itself is voluntary. UN Regulation No 155 is binding where a country applies it, and it mentions ISO/SAE 21434 only as an example, in a footnote alongside ISO 26262 and ISO/PAS 21448. For suppliers the requirement normally arrives by contract, because a vehicle manufacturer has to show how its CSMS manages dependencies with contracted suppliers.
What is the difference between ISO/SAE 21434 and UN R155?
UN R155 is a UNECE vehicle regulation, in force since 22 January 2021. It sets what a manufacturer must demonstrate: a CSMS with a valid certificate and, for each vehicle type, a risk assessment, mitigations and testing before type approval. ISO/SAE 21434 is an engineering standard for the whole supply chain on how to organise and carry out cybersecurity work across the lifecycle. The regulation sets the outcome for manufacturers; the standard organises the engineering that delivers it, for them and their suppliers.
When did UN R155 become mandatory in the EU?
Regulation (EU) 2019/2144 made protection of the vehicle against cyberattacks a type-approval requirement: EU type-approval is refused to new vehicle types that do not meet it from 6 July 2022, and national authorities prohibit the registration of vehicles that do not meet it from 7 July 2024. The same regulation provides for UN regulations on cyber security and software updates to be applied on a mandatory basis. Outside the EU, check the dates in every market you sell into.
Does Sterling issue certificates or carry out the cybersecurity assessment?
No. Sterling provides consulting and hands-on support. A manufacturer's CSMS certificate comes through the approval authority and its technical service, process and component certificates from certification bodies, and an assessment of your work needs people who did not produce it. A provider offering to write your TARA and then certify it is offering paper.
Keep exploring
Related to this video
The complete guide
Everything on ISO/SAE 21434
Start with the ISO/SAE 21434 page, or go straight to the guide you need.
On the ISO/SAE 21434 page
- What are the main ISO/SAE 21434 requirements?
- How do you get ISO/SAE 21434 certified?
- How much does ISO/SAE 21434 certification cost?
- How long does ISO/SAE 21434 certification take?
- Who needs ISO/SAE 21434 certification?
- How ISO/SAE 21434 protects your vehicles, programmes and customer relationships
- Frequently asked questions about ISO/SAE 21434
Often combined with ISO/SAE 21434
More videos: Automotive, aerospace, rail and defence
- How to implement IATF 16949Implementation walkthrough · 3 min 14 s
- IATF 16949 requirements explainedTwo-minute brief · 2 min
- How to implement AS9100Implementation walkthrough · 3 min 15 s
- AS9100, AS9110 and AS9120 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22163 (IRIS)Implementation walkthrough · 3 min 15 s
- ISO 22163 (IRIS) requirements explainedTwo-minute brief · 2 min
- How to implement ISO 26262Implementation walkthrough · 3 min 15 s
- ISO 26262 requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO/SAE 21434 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice