ISO/SAE 21434

ISO/SAE 21434 Road vehicles — Cybersecurity engineering

ISO/SAE 21434

ISO/SAE 21434 specifies engineering requirements for cybersecurity risk management with regard to the design, product development, production, operation, maintenance and decommissioning of electrical and electronic (E/E) systems in road vehicles, including their components and interfaces.

A framework has been set out that includes requirements for cybersecurity processes and a common language for communicating and managing cybersecurity risk. ISO/SAE 21434 sets out the cybersecurity requirements, terminology, objectives and guidelines that organizations need to

• define cybersecurity policies and processes;
• analyze, identify and manage cybersecurity risks;
• protect security by design and a culture of cybersecurity in the organization.

The standard is applicable to mass-produced E/E systems of road vehicles, including their components and interfaces, the development or modification of which has started after the publication of the document (August 2021). The standard does not prescribe specific technologies or solutions related to cybersecurity.

ISO/SAE 21434 is a standard for the automotive industry developed by the International Organization for Standardization (ISO) together with the Society of Automotive Engineers (SAE). It ensures that OEMs and suppliers consider cybersecurity at every stage of the product lifecycle, from the concept phase to its decommissioning. ISO/SAE 21434 builds on the ISO 26262-3 standard, which does not cover software or subsystem development. ISO/SAE 21434 focuses on the cybersecurity risks inherent in the design and development of automotive electronics. It provides updated security management guidelines, ongoing security-related activities, as well as methods for risk assessment and mitigation.

ISO/SAE 21434 applies to all software included in vehicles, electronic systems and components, and hardware. The overall goal of the standard is to provide a comprehensive guide for automotive developers to help them cover cybersecurity topics throughout the development lifecycle and ensure that the entire supply chain is also covered.