How does the product cybersecurity lifecycle map onto ISO/SAE 21434's clauses?
Clauses 5 and 6 frame it (organisational and project cybersecurity management), 9 Concept covers planning, requirements and TARA, 10 and 11 cover design to testing, 7 covers sourcing and the supply chain, 8 and 13 cover post-launch operation, 14 covers end of life, and 12 and 15 sit underneath as production and TARA methods.
| ISO/SAE 21434 clause | Lifecycle phases |
|---|---|
| 5 Organisational cybersecurity management | Cyber security management system; development and production security; organisation, culture and training |
| 6 Project-dependent cybersecurity management | Security planning and classification, security documentation, security certifications |
| 7 Distributed cybersecurity activities | Secure sourcing, supply chain security |
| 8 Continual cybersecurity activities | Vulnerability management, security monitoring |
| 9 Concept | Planning and classification, security requirements, threat modelling and risk assessment |
| 10 Product development | Architecture and design, secure implementation, security testing |
| 11 Cybersecurity validation | Security testing |
| 12 Production | Development and production security |
| 13 Operations and maintenance | Secure deployment and operation, patching, incident and crisis handling |
| 14 End of cybersecurity support and decommissioning | Secure end of life |
| 15 TARA methods | Threat modelling, security risk management |
Some phases have no clause of their own: DevSecOps, configuration management, information sharing, threat intelligence and customer collaboration. ISO 21434 doesn't prescribe them, so the manufacturer fills those gaps from other standards or its own process.
The mapping shows that the lifecycle is not invented per standard. ISO 21434, IEC 62443-4-1 and Microsoft SDL cover the same ground with different clause names. One internal process can therefore satisfy several standards at once.