Key Principles of ISO/SAE 21434

ISO/SAE 21434 establishes foundational principles for cybersecurity engineering in road vehicles. These principles guide organizations to manage risks systematically across the vehicle lifecycle and throughout the supply chain.

1) Lifecycle Coverage

Cybersecurity is addressed from concept through development, production, operations & maintenance, and decommissioning. Activities and evidence (work products) must remain consistent and traceable across phases.

2) Risk-Based Engineering (TARA)

A Threat Analysis and Risk Assessment (TARA) drives decisions: identify assets, analyze threats and vulnerabilities, evaluate impact and feasibility, and define risk treatment. Requirements and verification are proportionate to risk.

3) Security by Design

• Design to prevent, detect, and respond to threats (proactive posture).
• Apply least privilege, secure defaults, hardening, and fail-safe behaviors.
• Plan for secure diagnostics, logging, and update mechanisms from the outset.

4) Defense in Depth

Use layered controls across components, networks, and backend services so that a single failure does not lead to system compromise. Combine prevention, detection, and recovery.

5) Verification & Validation

Requirements derived from TARA are verified and validated with appropriate rigor (e.g., analysis, reviews, testing). Evidence is captured as work products to demonstrate conformance.

6) Organizational Governance (CSMS)

A Cybersecurity Management System (CSMS) defines roles, responsibilities, policies, competence, and improvement mechanisms. It ensures consistent application of processes and supports regulatory compliance (e.g., UNECE R155).

7) Supplier & Interface Management

• Allocate responsibilities and requirements across the supply chain.
• Exchange necessary cybersecurity information and evidence with suppliers.
• Manage external interfaces and shared responsibilities explicitly.

8) Configuration & Change Control

Maintain configuration management, change control, and traceability so that risks introduced by changes (design, software, tooling, calibration) are assessed and treated throughout the lifecycle.

9) Incident Preparedness & Continuous Improvement

Prepare for detection, reporting, triage, analysis, and response to incidents and vulnerabilities. Apply lessons learned across projects and releases for ongoing improvement.

10) Alignment with Safety & Updates

• Coordinate cybersecurity with functional safety activities (e.g., ISO 26262).
• Ensure secure update processes and evidence align with regulatory expectations (e.g., UNECE R156).

Practical Dos & Don’ts