What are Cybersecurity Assurance Levels (CALs) in ISO/SAE 21434, and what do they influence?

Question

Accepted Answer

CALs classify how much assurance effort a vehicle component needs. A higher CAL means stricter testing, lower risk tolerance and more independent assessment.
ISO/SAE 21434 is the cybersecurity engineering standard for road vehicles. A CAL (CAL 1 to CAL 4)
is assigned to a component and sets how rigorous the work around it must be:

Risk tolerance: how much residual risk is acceptable.
Security testing: depth and method, for example whether penetration testing is needed.
Independence of assessments: whether a separate team or an outside party must review the
work.

The idea is borrowed from functional safety, where safety integrity levels (SIL, and ASIL in
automotive) scale development rigour with the hazard. CALs do the same for security. In the
standard they are informative, so currently optional, and they may become mandatory in the
future. Compare IEC 62443's SL, which describes the attacker to withstand. A CAL describes how
much effort and proof goes into the component.