What characterises ISO/SAE 21434, and why is it effectively mandatory for automotive suppliers?

It is the automotive cybersecurity engineering standard. UN R155 requires a cybersecurity management system for vehicle type approval, carmakers use ISO 21434 to meet it, and they pass the requirements down their supply chain.

* A regulation binds the carmaker; contracts carry ISO/SAE 21434 down the supply chain. *

UN regulation R155 makes a certified cybersecurity management system (CSMS) a condition for type-approving new vehicles in the EU, Japan, Korea and other UNECE markets. ISO/SAE 21434 is how the industry implements it. Car manufacturers then write it into their contracts, so it propagates down the supply chain to every supplier of an ECU or software component.

Its character:

• Management system and development security requirements, not only product controls.
• A strong vulnerability management focus over the whole vehicle life.
• Secure development processes with customer-facing work products, such as the cybersecurity plan and case, that the carmaker reviews.
• Detailed requirements for threat analysis and risk assessment (TARA).