ISO/SAE 21434
The engineering standard for automotive cybersecurity — risk-based processes across the vehicle lifecycle, and the usual path to R155 conformance.
ISO/SAE 21434 “Road vehicles — Cybersecurity engineering” is the international standard defining how cybersecurity is engineered into vehicles. Published in 2021, it specifies risk-based processes across the full lifecycle: concept, development, production, operation, maintenance and decommissioning, with threat analysis and risk assessment (TARA) at its core.
The standard deliberately prescribes processes, not technologies. It defines what organizations must do — manage cybersecurity risk, validate mitigations, monitor for new vulnerabilities, handle incidents — while leaving specific technical measures to the engineering teams. It also structures supplier relationships, defining how cybersecurity responsibilities are distributed along the supply chain.
Its practical weight comes from regulation: ISO/SAE 21434 is the accepted route to demonstrating the Cyber Security Management System that UNECE R155 requires for type approval. For suppliers, certification against the standard has become a de facto ticket to play in new vehicle programs.
Related: Type approval / homologation · UNECE R155 · UNECE R156