Information Security / Cybersecurity (ISO 21434)

ISO/SAE 21434 "Road Vehicles – Cybersecurity Engineering" is the world's first international standard specifically dedicated to automotive cybersecurity, officially released in August 2021. Jointly developed by the International Organization for Standardization (ISO) and SAE International, the standard establishes a systematic engineering framework for cybersecurity risk management in road vehicles and their components, spanning the entire lifecycle from concept development through to production, operation, maintenance, and decommissioning.

Standard Positioning and Objectives

ISO/SAE 21434 is designed to tackle the cybersecurity challenges arising from automotive intelligence and connectivity. With intelligent connected vehicles generating massive volumes of data daily and high-end models surpassing 100 million lines of code, cyberattacks can now be carried out remotely without physical contact. The standard outlines three core objectives: establishing structured cybersecurity engineering processes to ensure security-by-design; reducing the likelihood of successful attacks and minimising damage; and providing carmakers with a unified framework to counter shared global cybersecurity threats.

This standard complements the functional safety standard ISO 26262: while ISO 26262 addresses risks stemming from system malfunctions, ISO/SAE 21434 targets risks arising from cyber threats. Both standards are typically implemented in tandem, forming the cornerstone of automotive defence.

Framework and Core Content

ISO/SAE 21434 comprises 15 main clauses, covering organisational cybersecurity management, project-level management, distributed development (supply chain collaboration), continuous monitoring, and incident response. Its fundamental framework mirrors ISO 26262, similarly structured around the "V-model" development process.

Threat Analysis and Risk Assessment (TARA) serves as the core methodology recommended by the standard to identify, assess, and mitigate automotive cybersecurity risks. The TARA workflow primarily encompasses: asset identification (defining assets requiring protection), damage scenario analysis (assessing impacts across safety, financial, operational, and privacy dimensions), threat scenario identification, attack feasibility rating (graded across four tiers from "Very Low" to "High"), and risk evaluation and treatment.

Relationship with UN R155 and Chinese Mandatory Standards

ISO/SAE 21434 works hand-in-hand with United Nations regulation UN R155 (Cybersecurity Management System), providing automotive manufacturers with the technical framework necessary to achieve regulatory compliance. As the world's first mandatory automotive cybersecurity regulation, UN R155 has been adopted by 54 contracting nations, including the European Union, Japan, and South Korea.

In China, the corresponding mandatory national standard is GB 44495-2024 "Technical Requirements for Vehicle Information Security", released in August 2024 and scheduled to take effect on 1 January 2026. Benchmarked against UN R155, this standard enforces more granular and stringent technical requirements, governing vehicle cybersecurity across four key domains: external connectivity security (thwarting attacks via telematics, Bluetooth, USB, and other interfaces), communication security (verifying encryption and protection across network protocols and V2X communications), software update security (ensuring the integrity and authentication mechanisms of OTA update packages), and data and code security (safeguarding user and vehicle data throughout its lifecycle).

Significance of Implementation

ISO/SAE 21434 has emerged as an internationally recognised benchmark across global carmakers and Tier-1 suppliers. Certified enterprises are able to build structured cybersecurity capabilities across product design, software engineering, and supply chain management—mitigating vehicle recall risks and legal liabilities stemming from security vulnerabilities while securing the compliance credentials required for global market access.