ISO/SAE 21434 requirements explained: video brief

From the organisation to the project

ISO/SAE 21434 does not use the clause 4 to 10 harmonised structure of ISO management system standards. Clause 4 sets out general considerations; clauses 5 to 15 carry the requirements, moving from the organisation to the project, the supply chain, the continual activities and the product life cycle, with the threat analysis and risk assessment methods in clause 15. Annex A summarises the activities and their work products. This short film walks through them.

Clause 5, organisational cybersecurity management, asks the organisation to manage cybersecurity and specify its policies, rules and processes; in practice a policy management owns, defined responsibilities and competence, processes engineers follow and organisational audits that test them. Clause 6, project-dependent cybersecurity management, covers planning and managing the cybersecurity activities of each project.

Supply chain, continual activities and life cycle

Clause 7 covers distributed cybersecurity activities with suppliers. Clause 8 covers continual activities: cybersecurity monitoring, event evaluation, vulnerability analysis and vulnerability management. Clauses 9 to 14 follow the life cycle: concept, product development, cybersecurity validation, production, operations and maintenance, and the end of cybersecurity support and decommissioning. Clause 15 sets out the threat analysis and risk assessment methods used throughout.

The standard applies to vehicle manufacturers, suppliers at every tier and developers of automotive hardware and software. ISO/SAE 21434:2021 is the first edition, under ISO's systematic review. There is no accredited management system certificate: manufacturers need a cybersecurity management system certificate under UN R155 through the approval authority, and certification bodies certify processes and components under their own programmes.

UN R155, in force since 22 January 2021, sets what a manufacturer must demonstrate: a cybersecurity management system with a valid certificate and, for each vehicle type, a risk assessment, mitigations and testing before type approval; it mentions ISO/SAE 21434 only as an example. A Tier 2 software supplier is usually asked for the work products for its part of the development: threat analysis inputs or results for its component, requirements and verification evidence, vulnerability handling and how long it will support the product. ISO 26262 covers hazards from malfunctioning electrical and electronic systems, and ISO 21448 insufficiencies in the intended functionality, while ISO/SAE 21434 covers cybersecurity. TISAX labels and ISO/IEC 27001 certification help, but neither covers the standard.