The first ISO international standard for automotive information security is officially released: ISO-SAE 21434

On August 31, 2021, the ISO International Organization for Standardization officially released the ISO/SAE 21434: Road vehicles-Cybersecurity engineering (road vehicle information security engineering) standard, which defines cyber security engineering design practices/practices for all on-board electronic systems, vehicle components, on-board software and external networks.

Standard Release

The standard mainly specifies the information security risk management requirements for road vehicle electronic and electrical systems and their components and interfaces during the concept, development, production, operation, maintenance and destruction phases. The standard mainly focuses on the automotive information security process and does not specify specific technologies or solutions related to information security. As one of the most important international standards in the field of automotive information security, its release will provide strong support for the information security process management and information security management system construction throughout the life cycle of the vehicle.

The standard formulation work started on January 30, 2016 and was released in August 2021. Led by CATARC, industry experts are promoting the transformation of ISO/SAE 21434 international standard into a recommended national standard "Road Vehicle Cybersecurity Engineering". The standard document was jointly prepared by Technical Committee ISO/TC 22, Road Vehicles, Subcommittee SC 32, Electrical and Electronic Components and General Systems, and SAE TEVEES18A Vehicle Cybersecurity Systems Engineering Committee. The first edition of ISO/SAE 21434 cancels and replaces SAE J3061:2016- Cybersecurity Guidebook for Cyber-Physical Vehicle Systems.

ISO/SAE 21434 Overview

ISO/SAE 21434 Overview

ISO/SAE 21434 focuses on cybersecurity risks in the design and development of automotive electronics. The standard covers cybersecurity governance and structure, safety engineering throughout the vehicle lifecycle, and post-production safety processes. The predecessor ISO standard to ISO/SAE 21434 is ISO 26262 "Road vehicles - Functional safety". ISO 26262 provides a lifecycle (management, development, production, operation, service, retirement) concept for automotive safety and provides the necessary support during these lifecycle stages. The standard covers the overall development process (including requirements planning, design, implementation, integration, verification, validation and configuration) in terms of functional safety. 26262 does not cover software development or vehicle subsystems, nor how to handle cybersecurity incidents. ISO/SAE 21434 covers all aspects of cybersecurity - from the initial design of the vehicle to retirement. The supply chain is also included in every step of automotive production. ISO/SAE 21434 covers all phases of the connected vehicle lifecycle, including electrical and electronic systems, including their components and interfaces, including: • Design and engineering • Production • Customer operation • Repair and maintenance • End-of-life This lifecycle approach to cybersecurity management makes ISO/SAE 21434 one of the most comprehensive approaches to connected vehicle cybersecurity.

Impact on automotive OEMs and developers

Any manufacturer, developer or OEM should consider actively integrating ISO/SAE 21434 into its current production process. The main focus of the new standard is cyber security. The focus of the standard is to provide better safety for automotive consumers by regulating the way manufacturers test their products.

ISO/SAE 21434 requires manufacturers and developers to conduct risk assessments. Before identifying risks, manufacturers need to know what causes the risk. The assessment will identify any components, APIs, or software functions that may be vulnerable to attack. After completing the assessment, the vulnerabilities should be identified.

The impact on car developers and manufacturers is that they can produce applications and components that are tested before release, which benefits drivers and their safety.

Standards also work with other frameworks: in the case of ISO/SAE 21434, NIST SP-800-30 and Stampard ISO/IEC 31010 can be used to establish the basis for risk assessment using tried and tested methods.

The ISO/SAE 21434 standard was introduced by automotive stakeholders to address the security issues brought about by connectivity. The standard provides a framework for enhancing security and promotes a more ideal approach to building safer vehicles.  

Introduction to ISO/SAE 21434:2021

(I) General information of standards

Status: Published Publication date: 2021-08 Version: 1st edition Number of pages: 81 pages Technical Committee: ISO/TC 22/SC 32 Electrical and electronic components and general system aspects

2. Purpose of the Standard

This document sets out the information security perspective in the engineering of electrical and electronic (E/E) systems for road vehicles. By ensuring appropriate consideration of information security, this document aims to keep E/E systems engineering up to date with state-of-the-art technology and evolving attack methods. This document provides vocabulary, objectives, requirements and guidelines related to information security engineering as a basis for a common understanding throughout the supply chain. This enables organizations to: • define information security policies and processes; • manage information security risks; • foster an information security culture. This document can be used to implement an information security management system, including information security risk management.

3. Organization of this document

Figure 1 gives an overview of the structure of the standard document. The elements in Figure 1 do not dictate the order in which the various topics should be addressed. Overview of the Standard Document

Section 4 (General Considerations) is for reference only and contains the background and perspectives on the engineering approach to road vehicle cybersecurity in this document.

Article 5 (Organizational information security management) includes information security management and specification of organizational information security policies, rules and processes.

Article 6 (Project-related information security management) includes information security management and information security activities at the project level.

Clause 7 (Distributed information security activities) includes requirements for the distribution of responsibilities for information security activities between customers and suppliers.

Clause 8 (Ongoing information security activities) includes activities to inform ongoing risk assessment and defines vulnerability management of electronic/electronic systems until the end of information security support.

Clause 9 (Concept) includes activities to determine the project's information security risks, information security objectives, and information security requirements.

Clause 10 (Product Development) includes activities to define information security specifications, implement and verify information security requirements.

Article 11 (Information Security Verification) includes information security verification of vehicle-level items.

Article 12 (Production) covers information security related aspects of the manufacture and assembly of articles or components.

Clause 13 (Operation and Maintenance) includes activities related to information security incident response and updating of items or components.

Clause 14 (End of Information Security Support and Decommissioning) covers information security considerations for ending support and decommissioning of a project or component.

Article 15 (Threat analysis and risk assessment methods) includes a modular analysis and assessment method to determine the extent of information security risks and take appropriate measures.

 Clauses 5 to 15 have their own objectives, provisions (i.e. requirements, recommendations, permissions) and work products. Work products are the results of information security activities that satisfy one or more related requirements.

“Prerequisites” are mandatory inputs consisting of the work products of the previous phase, and “Further Supporting Information” refers to information that can be considered and can be provided by sources other than those responsible for information security activities.

Clauses and Work Products are assigned unique identifiers consisting of a two-letter abbreviation ("RQ" for Requirement, "RC" for Recommendation, "PM" for Permission, and "WP" for Work Product) followed by two numbers separated by a hyphen. The first number identifies the clause and the second number identifies the sequential order of the clause or work product, respectively. For example, [RQ-05-14] refers to Clause 14 in Clause 5, which is a requirement.

(IV) Standard Catalog