ISO/SAE 21434: The Essential International Standard for Automotive Cybersecurity
With the increasing digitalization and connectivity of vehicles, the importance of automotive cybersecurity is becoming more prominent. Amid these changes, ISO/SAE 21434 is the key standard that automotive manufacturers must be familiar with to meet cybersecurity requirements.
What is the ISO/SAE 21434 Standard?
ISO/SAE 21434 is an international standard that provides guidelines and requirements for automotive manufacturers to systematically and consistently approach automotive cybersecurity engineering. This standard defines cybersecurity requirements throughout the vehicle’s entire lifecycle, from concept to decommissioning. It enables stakeholders such as Original Equipment Manufacturers (OEMs) and Tier suppliers to clearly define their roles and responsibilities.
Rather than simply listing technical requirements, the standard presents how to systematically manage and apply security throughout the vehicle development and operational process. This enables manufacturers and related companies to effectively protect vehicles from cybersecurity threats.
Key Components of ISO/SAE 21434
ISO/SAE 21434 consists of 15 clauses:
General Considerations [Clause 4]:
This clause provides an overview and purpose of the ISO/SAE 21434 standard. It explains the fundamental approach to cybersecurity engineering and highlights the importance of cybersecurity for vehicle electrical and electronic systems. This clause also presents the scope of the standard and key information that stakeholders need to understand the overall structure and flow of the standard.
Organizational Cybersecurity Management [Clause 5]:
This clause discusses the importance of cybersecurity management at the organizational level, providing guidelines for establishing cybersecurity governance, policies, and processes. It explains how organizations can build systems to effectively manage and respond to cybersecurity risks. It also includes actions necessary to foster and maintain a cybersecurity culture and emphasizes collaboration across various departments.
Project Dependent Cybersecurity Management [Clause 6]:
This clause describes how to manage cybersecurity requirements and activities on a project-by-project basis. It covers the process of establishing and executing a cybersecurity plan tailored to the specific characteristics of a project. It also provides specific guidance for project managers and teams on strategies such as customization and reuse to increase the flexibility of cybersecurity activities.
Distributed Cybersecurity Activities [Clause 7]:
This clause explains how to distribute cybersecurity responsibilities and activities between customers and suppliers. It provides procedures and methodologies necessary for collaboration and coordination in a distributed environment, including cybersecurity interface agreements. It also emphasizes the importance of managing cybersecurity risks across the supply chain and offers strategies for effectively managing them.
Continual Cybersecurity Activities [Clause 8]:
This clause describes cybersecurity activities that must be continuously performed throughout the product’s lifecycle. It covers methods to maintain cybersecurity after the product is released to the market, including risk assessment, vulnerability management, and cybersecurity monitoring. It also highlights the importance of continuous improvement and learning to respond to the evolving threat landscape.
Concept [Clause 9]:
This clause provides methods for identifying and assessing cybersecurity risks in the early stages of product development. It covers the process of setting cybersecurity goals for vehicle systems and explains how to derive necessary cybersecurity goals and requirements through threat analysis and risk assessment. The concept phase is critical in laying the foundation for cybersecurity design and integrating cybersecurity into the overall product development process.
Product Development [Clause 10]:
This clause addresses the steps for designing and developing products based on cybersecurity goals. It focuses on implementing cybersecurity requirements during the design and development process and provides technical measures and methodologies to ensure the cybersecurity characteristics of the product. It also includes procedures for ensuring the completeness of the design, including cybersecurity verification and testing methods.
Cybersecurity Validation [Clause 11]:
This clause involves verifying that the completed product meets the established cybersecurity goals and requirements. It details methods and procedures for validation and explains how to assess whether the product performs the expected security functions in real-world environments. Validation is an essential step before product release, ensuring the reliability of cybersecurity performance.
Production [Clause 12]:
This clause addresses the cybersecurity aspects of the production process. It provides strategies for maintaining cybersecurity requirements during production and managing cybersecurity risks that may arise in the production process. Integrating cybersecurity during production is important for maintaining the overall security robustness of the product.
10. Operations and Maintenance [Clause 13]:
This clause deals with maintaining cybersecurity after the product is released to the market. It provides strategies for responding to cybersecurity issues that may arise during operation and methods for continuously monitoring and improving the product’s cybersecurity status. Maintenance and update processes help to respond to new threats and strengthen the product’s cybersecurity.
11. End of Cybersecurity Support and Decommissioning [Clause 14]:
This clause covers the stages of cybersecurity support termination and decommissioning of the product. It explains how to manage cybersecurity risks when the product is no longer in use and addresses how to protect data and assets that may remain even after cybersecurity support ends.
12. Threat Analysis and Risk Assessment Methods [Clause 15]:
This clause provides methods for assessing risks and analyzing threats. It explains how to identify and assess key risk factors in product design and operation through the risk assessment process. The results of the threat analysis form the basis for setting cybersecurity goals and prioritizing cybersecurity measures.
ISO/SAE 21434 is an essential international standard for automotive cybersecurity. It provides guidelines that automotive manufacturers and suppliers must follow to protect vehicles from cybersecurity threats and ensure a safe driving environment. As cybersecurity has become an indispensable element rather than an option, the automotive industry must actively apply this standard to build a safer future through continuous efforts.
