ISO/SAE 21434

ISO/SAE 21434
Name	ISO/SAE 21434
Status	Published
Year	2021
Scope	Road vehicle cybersecurity engineering
Organizations	ISO; SAE International

ISO/SAE 21434 ISO/SAE 21434 is an international technical specification addressing cybersecurity for road vehicles and their components. The specification integrates engineering practices across the automotive lifecycle and aligns with activities of International Organization for Standardization, Society of Automotive Engineers, UNECE, European Commission. It informs manufacturers, suppliers, and regulators such as National Highway Traffic Safety Administration, Ministry of Transport (Japan), German Federal Motor Transport Authority on risk-based cybersecurity processes.

Overview

The specification codifies cybersecurity engineering for vehicle systems drawing on precedents from ISO/IEC 27001, ISO 26262, IEC 62443, NIST Cybersecurity Framework, SAE J3061. It defines lifecycle processes from concept through decommissioning and references actors including OEMs, tier suppliers, and independent testing labs like TÜV Rheinland, SGS, Intertek. The document was developed through technical committees involving representatives from corporations such as Bosch, Toyota, Daimler, Ford Motor Company and national bodies like British Standards Institution, Deutsches Institut für Normung. Its publication followed consultations with regulatory forums including UNECE WP.29, European Union Agency for Cybersecurity.

Scope and Objectives

The standard’s scope encompasses cybersecurity for passenger cars, commercial vehicles, and aftermarket devices, and applies to hardware, software, networks, and services implicated in vehicle operation. Objectives include establishing requirements for cybersecurity management systems, threat analysis and risk assessment, secure development, verification and validation, and incident response; stakeholders include automotive companies like General Motors, Hyundai Motor Company, Renault–Nissan–Mitsubishi Alliance and certification bodies such as Bureau Veritas. The specification aims to harmonize practices across jurisdictions exemplified by interactions with United States Department of Transportation, European Commission Directorate-General for Mobility and Transport, Ministry of Road Transport and Highways (India).

Structure and Key Requirements

The standard is organized into clauses covering organizational cybersecurity management, project-dependent activities, and assurance measures, paralleling structures used by ISO 9001, ISO 14001. Key requirements include establishment of cybersecurity policies, roles and responsibilities for executives and engineering teams, secure by design principles adopted by companies like ZF Friedrichshafen AG and Continental AG, and integration with safety processes practiced in programs such as Euro NCAP. It mandates documentation of cybersecurity plans, supply chain security expectations for suppliers including Magneti Marelli and Aptiv, and traceability of requirements through design, implementation, and testing phases.

Risk Assessment and Threat Management

Risk assessment processes in the specification prescribe threat analysis, attack path analysis, and risk treatment options similar to methods from MITRE ATT&CK, Common Vulnerabilities and Exposures, Common Weakness Enumeration. Threat scenarios incorporate actors and motivations studied by institutions like RAND Corporation and incidents such as the Jeep Cherokee hack inform modeling. The standard emphasizes threat intelligence sharing among ecosystems including consortia like GENIVI Alliance, Automotive Information Sharing and Analysis Center, and practices used by cybersecurity firms such as Kaspersky Lab and Mandiant.

Implementation and Compliance

Implementation requires organizational governance, training programs, and integration with product development lifecycles used by manufacturers including Volvo Cars, BMW Group, Stellantis. Compliance involves internal audits, supplier assessments, and independent conformity assessment performed by assessment bodies like DEKRA, SGS Group. Demonstrable capability includes secure coding measures, penetration testing, and continuous monitoring akin to operations at Cisco Systems and Microsoft. Regulators including UNECE WP.29 and national bodies may reference the specification when setting mandates or type approval requirements.

Relationship to Other Standards and Regulations

The specification is positioned to complement functional safety standards such as ISO 26262 and industrial cybersecurity standards like IEC 62443 while aligning with governance frameworks like ISO/IEC 27001 and NIST SP 800-53. It interacts with legal instruments and directives including EU General Data Protection Regulation insofar as data privacy intersects with vehicle cybersecurity, and with regional regulations from agencies like National Institute of Standards and Technology and Japan External Trade Organization. International harmonization efforts involve forums such as International Electrotechnical Commission and International Chamber of Commerce.

Industry Adoption and Impact

Adoption has accelerated across OEMs, suppliers, and aftermarket vendors including Harman International, Valeo, Denso Corporation with industry alliances such as COVESA promoting interoperability. The specification has influenced procurement, contract clauses, and insurance underwriting practices informed by insurers like Allianz and Munich Re. Academic research institutions like Massachusetts Institute of Technology, Technische Universität München, University of Michigan contribute empirical studies on automotive cybersecurity that reference the standard in curricula and research projects. Overall, the specification reshapes engineering practices, compliance regimes, and market expectations across the global automotive ecosystem.

Category:Automotive standards