ISO/SAE 21434 · Road vehicles — Cybersecurity engineering
ISO/SAE 21434 certification consulting for vehicle cybersecurity you can evidence, from concept to decommissioning.
Give vehicle manufacturers, approval authorities and certification bodies the cybersecurity evidence each asks for: a cybersecurity management system your engineers run, threat analyses that stand up to review and, where a customer wants one, a certificate for your development process or component. Sterling's expert and experienced consultants build the processes with your teams, prepare the evidence and stay with you through the assessment and after it, in 60+ countries. We ensure successful certification for our clients.
- One all-inclusive proposal for consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard
- A team of expert and experienced automotive cybersecurity consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; the certification body, technical service or approval authority assesses and decides
8,100+ client engagements in 60+ countries.
ISO/SAE 21434 client experience
What it is
What is ISO/SAE 21434 and what is it used for?
ISO/SAE 21434 is the international standard for cybersecurity engineering in road vehicles, prepared jointly by ISO/TC 22/SC 32 and SAE International's Vehicle Cybersecurity Systems Engineering Committee. It sets engineering requirements for managing cybersecurity risk in a vehicle's electrical and electronic (E/E) systems through their life: concept, development, validation, production, operations and maintenance, and the end of cybersecurity support and decommissioning. Functional safety asks what happens when electronics fail; ISO/SAE 21434 asks what happens when someone attacks them, through a back-end server, a communication channel, an update procedure or physical access.
The standard works at three levels. The organisation specifies and manages its cybersecurity policies, rules and processes. Each project manages its own cybersecurity activities, and shared developments assign responsibilities between customer and supplier. For each item, risks are determined through threat analysis and risk assessment (TARA), turned into cybersecurity goals and requirements, designed in, verified, validated at vehicle level and then watched: vulnerabilities managed, incidents answered and updates delivered until cybersecurity support ends.
Current edition. ISO/SAE 21434:2021, the first edition, published in August 2021, with no amendments. On 15 July 2026 ISO opened its systematic review of the standard (stage 90.20), the routine check that decides whether a standard is confirmed, revised or withdrawn; no revision project has been named. Implement and be assessed to the 2021 edition, and follow the review rather than plan a transition. ISO/SAE 21434 systematic review: status and what to watch
Who it is for
Who needs ISO/SAE 21434 certification?
ISO/SAE 21434 reaches every organisation that develops E/E systems for road vehicles, or components of them, from vehicle manufacturers and system suppliers to developers of control units, software and semiconductors. What each has to show differs. Where UN Regulation No 155 applies, a vehicle type is approved only if its manufacturer holds a valid Certificate of Compliance for its cybersecurity management system (CSMS). Suppliers hold no R155 certificate, but the manufacturer must demonstrate how its CSMS manages dependencies with contracted suppliers, so the requirement reaches you through sourcing documents: work products, agreed responsibilities, a vulnerability process and sometimes a third-party certificate. Organisations come to Sterling for ISO/SAE 21434 from four starting points:
- A vehicle manufacturer has written ISO/SAE 21434 into your sourcing requirements. It names work products, a TARA, a vulnerability process and perhaps a certificate. Pin down which component and which activities are yours before anyone writes a procedure.
- You are a manufacturer preparing a CSMS for UN R155. The approval authority or its technical service assesses the system before any vehicle type is approved, the certificate lasts at most three years, and monitoring results are reported at least once a year. The processes behind it must hold across every programme and supplier.
- Your products are becoming connected and updatable. Telematics, over-the-air updates, charging interfaces and software-defined functions bring cybersecurity into new teams. The quality system exists; the cybersecurity lifecycle does not.
- A customer audit, an assessment or a vulnerability report has exposed the gaps. The TARA was written after the design froze, vulnerability reports sit in e-mail, or nobody has decided how long a product will be supported. The process has to be rebuilt around the way your projects actually work.
Every outcome depends on the process being lived in your projects, not on the document describing it.
Business benefits
How ISO/SAE 21434 protects your vehicles, programmes and customer relationships
Cybersecurity engineering should make releases more predictable, not slower. We begin where a late threat analysis, an unowned supplier interface or an unanswered vulnerability report would cost you a contract, an approval or a customer's trust.
- Risk decisions you can defendEvery threat scenario traced to its rating and to a recorded treatment decision with an owner, so an assessor can follow the reasoning unaided.
- Security designed in, not bolted onCybersecurity goals and requirements settled while the architecture can still change, so protection is designed in rather than patched after penetration testing.
- Clean lines with customers and suppliersResponsibility for each cybersecurity activity assigned at the start of a shared development, so nothing is done twice and nothing falls between two companies.
- Customer assessments answered from recordsPolicies, TARAs, verification results and vulnerability decisions ready to share, so a manufacturer's supplier questionnaire is answered from the system, not reconstructed.
- Vulnerabilities handled before they become incidentsNew threat and vulnerability information evaluated for every product in service, with a route to an update.
- One system for safety, security and qualityChange control, reviews, competence and audits shared with ISO 26262 and IATF 16949, so a new requirement extends the system instead of starting another.
Choose a few measures that show whether it works, such as vulnerabilities past their decision date or TARAs revised after design changes. A longer policy is not a result.
Requirements
What are the main ISO/SAE 21434 requirements?
ISO/SAE 21434 does not use the clause 4 to 10 harmonised structure of ISO management system standards. Clause 4 sets out general considerations; clauses 5 to 15 carry the requirements, moving from the organisation to the project, the supply chain, the continual activities and the product lifecycle, with the threat analysis and risk assessment methods in clause 15. Annex A summarises the activities and their work products. The table is a plain-language guide; during the programme your implementation is checked against the full wording of each clause.
| Clause | What it requires of you | What it looks like in practice |
|---|---|---|
| 5 Organisational cybersecurity management | Manage cybersecurity and specify the organisation's cybersecurity policies, rules and processes | A policy management owns, defined responsibilities and competence, processes engineers follow, and organisational audits that test them |
| 6 Project dependent cybersecurity management | Manage the cybersecurity activities of each project, from planning to release | A cybersecurity plan per item or component with owners and dates, decisions recorded with their rationale, and evidence assembled for review before release |
| 7 Distributed cybersecurity activities | Assign cybersecurity responsibilities between customer and supplier | Supplier capability weighed before award, and a written agreement per shared development stating who performs each activity and delivers each work product |
| 8 Continual cybersecurity activities | Carry out the activities that run across the lifecycle, including vulnerability management of E/E systems until the end of cybersecurity support | Threat and vulnerability sources watched, each finding evaluated for the products concerned and tracked to a decision and, where needed, a fix |
| 9 Concept | Determine the cybersecurity risks of an item and derive its cybersecurity goals and requirements | A description of the item and its boundary, a TARA, cybersecurity goals the design must meet and requirements allocated to the architecture |
| 10 Product development | Define the cybersecurity specifications, then implement and verify the requirements | Specifications traced to architecture and software, secure design and coding rules applied, and verification by review, analysis and testing |
| 11 Cybersecurity validation | Validate cybersecurity at the level of the vehicle | Vehicle-level evidence, such as penetration test results, that the cybersecurity goals are achieved, with remaining risk justified |
| 12 Production | Address cybersecurity in manufacturing and assembly | Plant controls for cybersecurity-relevant steps such as software flashing and key provisioning, so what leaves the line matches the design |
| 13 Operations and maintenance | Respond to cybersecurity incidents and manage updates | An incident response procedure with roles and triggers, and an update process that keeps products secure in the field |
| 14 End of cybersecurity support and decommissioning | Plan for the end of cybersecurity support and for decommissioning | A decided support period for each product, communicated before it ends, and decommissioning that leaves no keys or personal data exposed |
| 15 Threat analysis and risk assessment methods | Apply modular methods for threat analysis and risk assessment wherever the lifecycle calls for them | A TARA per item naming what needs protecting, the threat scenarios, their impact and the feasibility of attack, with a treatment decision for every risk |
What does useful ISO/SAE 21434 evidence look like?
For the organisation: the cybersecurity policy and processes, competence records, the vulnerability log and audit results. For each project: the cybersecurity plan, the item description and TARA, cybersecurity goals and requirements, verification and validation results, the agreements with customers and suppliers and, at release, the argument that ties them together. We help you decide what each project needs, without documents for their own sake; management records live in Effivity from the first workshop, linked to the engineering artefacts in your tools.
ISO/SAE 21434 clauses 5 to 15, explainedCertification process
How do you get ISO/SAE 21434 certified?
Start with what must be demonstrated, and to whom, because ISO/SAE 21434 has no single company certificate. For a vehicle manufacturer the legal route is UN R155: the approval authority or its technical service assesses the CSMS, the resulting Certificate of Compliance for CSMS is valid for at most three years, and each vehicle type is approved once its critical elements are identified, an exhaustive risk assessment is done and the security measures are tested. For suppliers and developers, certification bodies certify defined objects under their own programmes: exida, for example, bases a security development process programme for automotive on ISO/SAE 21434 and offers ISO/SAE 21434 device certification. Organisational CSMS audits, internal or external, are guided by ISO/PAS 5112:2022, which supplements ISO 19011. Sterling prepares the processes and the evidence; the approval authority, technical service or certification body assesses and decides.
- 01Agree the outcome and who will judge it.An R155 CSMS certificate, work products under a customer agreement, a certified development process or component, or a combination, and the body or customer that decides.
- 02Gap analysis: test your processes and one live project against clauses 5 to 15.It reviews the organisation-level requirements and a real project's work products, keeps what works and agrees actions, owners and dates.
- 03Build the cybersecurity management system and set up the projects.Policy, processes, roles, competence criteria, a TARA method and supplier agreement templates, applied to each project from the start.
- 04Analyse, develop, verify and collect the evidence.TARAs, requirements, secure design, verification and validation done as the project moves, with the vulnerability process running before start of production.
- 05Audit internally, then complete the independent assessment.An organisational audit and management review first; then the CSMS assessment, certification body evaluation or customer review, with findings closed on evidence.
- 06Keep the system, and the certificate, current.Monitoring, vulnerability management, incident response and updates continue; manufacturers renew the CSMS certificate within three years and report monitoring yearly; a certified process or component follows its body's surveillance and change rules.
Before comparing prices, test the credibility of the route. Ask what the certificate will name, which edition it cites and who issues it; confirm what the body's accreditation covers with the accreditation body; and remember that a manufacturer's R155 certificate comes only through an approval authority or its technical service. A company-wide "ISO/SAE 21434 certificate" issued without anyone reading your TARAs is unlikely to satisfy a manufacturer's audit, and the gaps stay yours. How to choose a credible ISO/SAE 21434 provider · The certification buyer's checklist
Cost
How much does ISO/SAE 21434 certification cost?
No single price fits ISO/SAE 21434. A software house certifying its development process, a Tier 1 answering a manufacturer's requirements for a gateway, and a manufacturer readying its CSMS for R155 are three different projects. Sterling offers an all-inclusive proposal in which every component can be seen.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Your role, the products and clauses in scope, the number of projects and sites, existing maturity, and how much of the work your team takes on (Design™ or Drive™) |
| Independent assessment and certification | The fees of the technical service, certification body or assessor: the object assessed (CSMS, development process or component), the evidence reviewed, any testing, and renewal or surveillance |
| Engineering effort and internal resources | TARA workshops, security testing and the fixes they force, usually the largest variable, plus engineering, security, quality and management time |
| Software and learning | Included in a Sterling engagement: Effivity for the cybersecurity management system and Sterling Academy access for your people, with users, courses and access period set out in the proposal |
| Continued support | Internal audits, vulnerability-management reviews, support on new projects, refresher learning and any revision of the standard under Sustain™ |
What moves the price
- Whether you need an R155 CSMS, customer evidence, a certificate, or several
- The items and product lines in scope, and how connected they are
- How much of the lifecycle is yours
- What exists: IATF 16949, ISO 26262, ISO/IEC 27001 or TISAX, earlier TARAs, a vulnerability process
- Your milestone, and how much your engineers can carry
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, set out in writing
- Assessing-body fees shown separately, so the whole programme can be compared
- Effivity, training and Academy access itemised, at no additional cost
- Payment milestones linked to deliverables rather than dates
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO/SAE 21434 certification take?
It depends on what is being assessed and where you start. For a supplier building its cybersecurity management system and taking a first project through it, six to twelve months is realistic: processes must run long enough to produce TARAs, verification results, a working vulnerability process and an internal audit. A manufacturer's CSMS must cover every programme and supplier in scope, so the type-approval plan sets its date; a component certificate follows the project whose work products it relies on. We plan around the evidence, with milestones in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to engineers, process owners, existing work products and requirements |
| Process build and project set-up | How far processes must change, approvals, training, and when the first project starts |
| TARA, development and verification | Engineering capacity, the number and connectivity of items, and the time analyses and testing take |
| Continual activities in operation | Monitoring connected, vulnerabilities triaged and incident response rehearsed before assessment |
| Independent assessment | The assessor's schedule, the volume of evidence and the time to close findings |
If a sourcing deadline, start of production or type-approval date is fixed, tell us at the start. We will say what is achievable and which decisions, such as the scope of the first TARA, cannot wait. A certificate date promised before anyone has seen your architecture is not a plan; it is a pitch.
Challenges
Common ISO/SAE 21434 implementation challenges
ISO/SAE 21434 programmes tend to get stuck at five points. Each has a practical way through.
The TARA arrives after the architecture is frozen.
We tie cybersecurity activities to your project gates, so the threat analysis shapes the design decisions it is meant to inform and is revised whenever the design changes.
Customers and suppliers disagree about who owns which activity.
Assign responsibilities at the start of every shared development, work product by work product, including who watches for vulnerabilities after release, and revisit the split when scope changes.
Nobody owns vulnerabilities after start of production.
Continual activities need an owner, sources to watch, criteria for evaluating findings and a route to an update. We set them up before release and connect them to incident response, so a researcher's or customer's report reaches a decision, not an inbox.
Reused, open-source and bought-in software comes without cybersecurity evidence.
Record what each component is, where it came from and which known vulnerabilities affect it, then decide what evidence you need and from whom. A current software bill of materials makes monitoring possible.
Safety, cybersecurity, TISAX and R155 run as separate programmes.
ISO 26262-2 already carries informative guidance on how functional safety interacts with cybersecurity. One development process with shared change control, reviews and evidence lets each assessment draw on the same records instead of four parallel files.
Your engagement
What your ISO/SAE 21434 engagement includes
Many providers sell a TARA workshop or a policy pack and leave the rest to you. A Sterling engagement covers the whole route to a working cybersecurity management system and a prepared engineering team, for one all-inclusive proposal.
Scope, gap analysis and implementation plan
Your role, the products and clauses in scope and what customers or the approval authority expect, with owners, dates and decisions agreed first.
Cybersecurity management system and project work products
Policy, processes, roles, competence criteria, the TARA method and supplier agreement templates, written with your engineers.
Effivity ISO & GRC software
Your cybersecurity management runs in Effivity from the first week, included with the engagement at no additional cost.
Training for everyone
Preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement, and internal auditor training for your audit team, as applicable to your standard.
Internal audit and preparation for assessment
Organisational audits of your cybersecurity management as agreed, guided by ISO/PAS 5112, with findings closed before the assessor arrives.
Certification and assessment readiness
Preparation for the CSMS assessment, certification body evaluation or customer review, help with findings, and support until the certificate or report is issued.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your ISO/SAE 21434 implementation
Every ISO/SAE 21434 engagement runs on Sterling OS™, our delivery operating system: five phases, each with defined deliverables, decision owners and evidence. You choose the depth of support your engineering capacity calls for; method, software and accountability stay the same.
- 01Design™Guided implementation: your engineers write the processes and run the first TARAs with Sterling's structure, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the agreed work alongside your project leads, security engineers and process owners.
- 03Sustain™After certification: vulnerability-management reviews, support on new projects, internal audits, assessment preparation and training for new engineers.
- 04Automate™The cybersecurity management system running in Effivity: policy, competence, project activities, supplier agreements, vulnerabilities, incidents, audits and management review in one workspace.
- 05Revise™Any revision of ISO/SAE 21434 that follows the systematic review, new customer or regulatory requirements, and changes in products, sites or scope.
In the first week we name the engagement team, fix a weekly working session and agree deliverables and decision owners, so a gap shows up in a project review, not in front of the assessor.
How Sterling OS™ worksOften combined with
Standards organisations pair with ISO/SAE 21434
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- AIAG core toolsAutomotive core tools implementation and training: APQP, Control Plan, PPAP, FMEA, MSA and SPC applied on your live parts.
- AQAP 2110AQAP 2110 compliance for defence suppliers: what the NATO contract requirement covers, AQAP 2105 quality plans, government quality assurance and an all-inclusive proposal.
- AS9100AS9100 certification consulting for aerospace and defence suppliers: ISO 9001 plus product safety, configuration and FAI, ready for an IAQG scheme audit.
- AS9110AS9110 certification for aviation maintenance organisations: the 9110 requirements, the IAQG audit route, cost and timeline factors, and Sterling's support.
- AS9120AS9120 certification for aerospace distributors and stockists: requirements, the IAQG audit route, OASIS listing, cost and timeline factors, with Sterling.
Effivity · ISO/SAE 21434 cybersecurity management workspace, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO/SAE 21434:2021.
Every Sterling ISO/SAE 21434 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. On its no-code platform your consultant configures, within the agreed scope, a workspace for the management side of cybersecurity engineering: policy, competence, project plans, supplier responsibilities, the TARA register, vulnerabilities, incidents, audits and management review. Threat models, code and test results stay in your engineering tools; Effivity holds the management records and links to them. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.
Policy, roles, competence and culture
The policy, process set, responsibilities and the competence each role needs, with training records per engineer and a review schedule.
Cybersecurity plans per project
Planned activities per item or component with owners and dates, decisions and their rationale, and an index of the work products behind release.
Customers, suppliers and responsibilities
Supplier evaluations, the responsibility agreement for each shared development and the evidence exchanged, dated and owned.
TARA register and risk decisions
Assets, threat scenarios, impact and feasibility ratings and each treatment decision, with review dates and links to the resulting goals.
Cybersecurity goals and requirements
Goals and requirements per item, traced back to the TARA and forward to the architecture, so a change shows its consequences.
Monitoring and vulnerability management
Sources watched, findings evaluated per product and vulnerabilities tracked to a decision and a fix, kept until support ends.
Incidents and updates
Incident records with actions and lessons learned, and update decisions linked to the vulnerabilities they address.
Support periods and end of life
The support period decided for each product and release, notices given before it ends, and decommissioning records.
What this means at the audit
An assessor asks for the policy and processes, the competence of the people involved, a project's TARA, the supplier agreements, the open vulnerabilities with their decisions, and the last internal audit. In Effivity each is a screen with dates, owners and links to the evidence, not a folder assembled the week before. After certification, Sustain™ runs in the same workspace, so the next assessment starts from a system that kept working.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing registers, TARAs and vulnerability lists migrated, not retyped
- Admin and user training for engineering, security, quality and management
- QMS modules for IATF 16949 and ISMS modules for ISO/IEC 27001 when you integrate other standards
ISO/SAE 21434 client experience
Client letters on file, available on request.
Signed client letters for ISO/SAE 21434 are available on request. The client feedback wall lists every letter by standard.
How ISO/SAE 21434 fits an automotive supplier's system
One development process, safe and secure.
- 01How integrated programmes run
Automotive electronics supplier: cybersecurity, functional safety and quality in one development process
ISO/SAE 21434 is commonly implemented alongside ISO 26262 on an IATF 16949 quality management system. In such a programme the quality system supplies document control, competence, supplier management and internal audit; functional safety and cybersecurity share the project gates, change control and reviews, each adding its own analyses; TISAX covers the information security of the sites; and one Effivity workspace and one management review cover all of it.
Sterling Academy · ISO/SAE 21434 e-learning
Train every engineer and manager on ISO/SAE 21434, not just the security team.
Sterling Academy provides e-learning for everyone whose work touches the cybersecurity lifecycle: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner that can be checked online. Through their Sterling consultant, consulting clients receive preferential Sterling Academy course access and special pricing, including complimentary awareness training for their people as part of the engagement.
- ISO/SAE 21434 awareness for engineers, testers, project leads and managers, as evidence of competence
- Practitioner courses for project leads, process owners and cybersecurity managers
- Internal auditor training for the people who will audit your cybersecurity processes, as applicable to your standard, as part of the engagement
- Learner progress by team and site, and a training status report for the assessor
- New engineers and contractors trained as they join, so competence records stay current
- A Sterling consultant available when a learner has a question
Keep exploring
Explore more about ISO/SAE 21434
Watch a video on how to implement ISO/SAE 21434 here.
Watch a video on ISO/SAE 21434 requirements here.
Why Sterling
Want successful ISO/SAE 21434 certification? Come to Sterling.
Whether you run one development centre or engineering teams in several countries, Sterling helps you establish one cybersecurity process with clear local ownership, respecting what each customer, platform and supplier requires.
Management systems in 60+ countries since 2003
Management systems implemented for manufacturers, engineering firms and technology businesses, with one engagement team accountable for every site in scope.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with assessing-body fees shown separately.
A cybersecurity process engineers will use
Less paperwork and more effect: TARAs, reviews and vulnerability decisions built into the way your projects already plan, design and release.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003, and who build your cybersecurity management properly the first time.
The Sterling Promise
What our ISO/SAE 21434 certification success guarantee means
We stay with you until the agreed ISO/SAE 21434 outcome is reached, whether a CSMS ready for its R155 assessment, a certified process or component, or a completed customer assessment, supporting implementation, preparation and the closure of findings. Clear explanations, included software and training leave capability behind, not only a certificate.
The engagement defines the objects, clauses, outcome and responsibilities. Your organisation gives us accurate information and runs the agreed processes. The approval authority, technical service or certification body assesses conformity and keeps its decision. Our commitment covers the agreed support, not future sourcing decisions or the absence of future vulnerabilities.
After certification
What happens after ISO/SAE 21434 certification?
Cybersecurity does not stop at release. New attacks and vulnerabilities appear while products are in service, so monitoring, vulnerability management, incident response and updates carry on until cybersecurity support ends. A manufacturer's Certificate of Compliance for CSMS lasts at most three years and must be renewed, with monitoring results reported to the approval authority or technical service at least once a year. A certified process or component stays valid only while the body's conditions are met.
Under Sterling OS™ Sustain™ we review vulnerabilities, incidents, project findings and competence with you alongside the planned internal audits and management reviews, so cybersecurity stays part of engineering between assessments.
FAQs
Frequently asked questions about ISO/SAE 21434
Can our company be ISO/SAE 21434 certified?
Not in the way a company is certified to ISO 9001 or ISO/IEC 27001: there is no accredited management-system certification to ISO/SAE 21434 of the kind ISO/IEC 17021-1 governs. What exists is narrower and more useful: for vehicle manufacturers, the UN R155 Certificate of Compliance for CSMS; for suppliers and developers, certification of a defined development process or component under a certification body's own programme; and organisational audits guided by ISO/PAS 5112. Ask your customer which it expects.
Is ISO/SAE 21434 mandatory?
The standard itself is voluntary. UN Regulation No 155 is binding where a country applies it, and it mentions ISO/SAE 21434 only as an example, in a footnote alongside ISO 26262 and ISO/PAS 21448. For suppliers the requirement normally arrives by contract, because a vehicle manufacturer has to show how its CSMS manages dependencies with contracted suppliers.
What is the difference between ISO/SAE 21434 and UN R155?
UN R155 is a UNECE vehicle regulation, in force since 22 January 2021. It sets what a manufacturer must demonstrate: a CSMS with a valid certificate and, for each vehicle type, a risk assessment, mitigations and testing before type approval. ISO/SAE 21434 is an engineering standard for the whole supply chain on how to organise and carry out cybersecurity work across the lifecycle. The regulation sets the outcome for manufacturers; the standard organises the engineering that delivers it, for them and their suppliers.
When did UN R155 become mandatory in the EU?
Regulation (EU) 2019/2144 made protection of the vehicle against cyberattacks a type-approval requirement: EU type-approval is refused to new vehicle types that do not meet it from 6 July 2022, and national authorities prohibit the registration of vehicles that do not meet it from 7 July 2024. The same regulation provides for UN regulations on cyber security and software updates to be applied on a mandatory basis. Outside the EU, check the dates in every market you sell into.
Does Sterling issue certificates or carry out the cybersecurity assessment?
No. Sterling provides consulting and hands-on support. A manufacturer's CSMS certificate comes through the approval authority and its technical service, process and component certificates from certification bodies, and an assessment of your work needs people who did not produce it. A provider offering to write your TARA and then certify it is offering paper.
We are a Tier 2 software supplier. What will our customer ask for?
Usually the cybersecurity work products for your part of the development, as agreed when responsibilities were assigned: TARA inputs or results for your component, requirements and verification evidence, how you handle vulnerabilities, and how long you will support the software. Some also ask for a third-party certificate of your development process. Settle the split at quotation stage, before the price is fixed.
How does ISO/SAE 21434 relate to ISO 26262 and ISO 21448?
They deal with different causes of harm. ISO 26262 covers hazards from malfunctioning E/E systems; ISO 21448:2022 covers insufficiencies in the intended functionality, for emergency intervention systems and driving automation at levels 1 to 5; ISO/SAE 21434 covers cybersecurity risk from threats. ISO 26262-2 contains informative guidance on the interaction between functional safety and cybersecurity, and one development process can serve all three.
Do TISAX labels or ISO/IEC 27001 certification cover ISO/SAE 21434?
No, although both help. TISAX assesses an organisation's information security against the VDA ISA catalogue, whose criteria cover information security, prototype protection and data protection, and its labels are valid for up to three years; ISO/IEC 27001 certifies an information security management system. ISO/SAE 21434 concerns the product: the cybersecurity of the vehicle systems you develop, from concept to the end of support. A supplier can be asked for all three, and they share policies, access control and incident handling.
What about software updates and UN R156?
UN R156 is the companion regulation for software updates. It requires a software update management system (SUMS) with its own Certificate of Compliance, valid for a maximum of three years, and approval of the vehicle type for software updates, with an RX Software Identification Number (RXSWIN) for type-approval-relevant software and conditions for over-the-air updates, such as informing the user first and updating safely. ISO 24089:2023, amended in 2024, is the ISO standard for software update engineering in road vehicles.
Before the first call
Prepare a useful ISO/SAE 21434 readiness brief
No cybersecurity manual is needed before the first discussion; a short account of what you develop, for whom and what they have asked for is enough. Seven questions cover it:
- Which customer or regulation is asking, for which products, and in what form: a CSMS certificate under UN R155, work products under an agreement, or a process or component certificate?
- What do you develop: vehicles, systems, electronic control units, software, semiconductors or other components, and how connected are they?
- Which cybersecurity activities are yours, and which does a customer or supplier carry?
- What exists today: IATF 16949 or ISO 9001, ISO 26262, ISO/IEC 27001 or TISAX labels, earlier TARAs, a vulnerability or incident process?
- What have customer audits, penetration tests or vulnerability reports told you about the starting point?
- Who can decide and give time from engineering, security, quality and management, and who will own cybersecurity?
- Is there a sourcing deadline, a start of production, a type-approval date or an assessment to plan around?
Your answers let us size the work and write a realistic proposal. They open a conversation; they are not a score, an assessment or a certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not ISO/SAE 21434 certification.
An ISO/SAE 21434 certificate means something when it states what was assessed, which process, component or version, against which edition and by whom, and when the TARAs behind it would survive a manufacturer's cybersecurity audit. The market still sells paper: company-wide "ISO/SAE 21434 certificates", "UN R155 compliant" badges on components, and assessments by the people who wrote the documents. They cost less, until a customer asks to see the threat analysis.
How to choose a credible ISO/SAE 21434 provider
- Ask what exactly will be certified, an organisation's cybersecurity management, a development process or a component and its version, and which edition of ISO/SAE 21434 the certificate will state.
- Check the body, not the logo. If it claims accreditation, confirm with the accreditation body what that accreditation covers, and find the certificate in the body's own register.
- Ask which work products the assessment will examine. TARAs, requirements, test results, supplier agreements and vulnerability records should be read; an online questionnaire examines nothing.
- Check the independence. Whoever wrote your TARA cannot assess it, and one invoice for consulting and certificate is a conflict of interest, not a convenience.
- Know what UN R155 covers. It approves vehicle types and assesses a manufacturer's CSMS through the approval authority or its technical service; no consultant's letter or badge on a component takes its place.
- Walk away from "ISO/SAE 21434 certified in ten days", company-wide certificates sold like ISO 9001, and "we manage everything". A cybersecurity lifecycle has to run on real projects before anyone can assess it.
Keep exploring
More on ISO/SAE 21434 and related standards
More in Automotive, aerospace, rail & defence
Talk to a consultant
Plan your ISO/SAE 21434 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice