ISO/SAE 21434:

Overview

ISO/SAE 21434:2021, “Road vehicles — Cybersecurity engineering,” defines engineering requirements for cybersecurity risk management across the full vehicle lifecycle, from concept and product development through production, operation, maintenance, and decommissioning. It is the recognized engineering framework supporting UNECE UN R155, which is a legal precondition for vehicle type approval across UNECE contracting markets. 

In practical terms, Clause 15’s Threat Analysis and Risk Assessment (TARA) is the standard’s core methodology: asset identification, threat scenario identification, impact rating, attack path analysis, and risk determination, applied to every cybersecurity-relevant item, including ECUs, in-vehicle buses, and external interfaces such as V2X, Bluetooth, and OBD ports. 

Why It Matters 

Non-compliance with UN R155, which ISO/SAE 21434 provides the engineering evidence to satisfy, can mean a vehicle is refused type approval or barred from sale in UNECE member markets, making this a market-access issue as immediate as the EU Cyber Resilience Act covered earlier in this guide. 

OEMs increasingly cascade ISO/SAE 21434 requirements contractually to Tier 1 and Tier 2 suppliers, so a supplier unable to produce cybersecurity work-product evidence risks losing the supply contract itself, not just failing an audit; and because vehicles typically remain in service for 15 years or more, the cryptographic and key-management choices made at production must remain sound for the vehicle’s entire operational life. 

How This Maps to Cryptography 

ISO/SAE 21434 addresses cryptography across the concept, development, and production phases of the vehicle lifecycle. The key control areas with direct cryptographic implications are: 

Audit Readiness 

ISO/SAE 21434 conformance is assessed through CSMS audits and product-level cybersecurity assessments, focused on documented engineering evidence rather than a policy statement alone. Key areas that OEM and third-party assessors probe: 

• TARA Coverage: Has a Threat Analysis and Risk Assessment been performed and documented for every cybersecurity-relevant item, including ECUs, buses, and external interfaces? 

• ECU Identity Provisioning Evidence: Is a unique cryptographic identity provisioned to each ECU at the point of manufacture, rather than a shared key across a platform or fleet? 

• Signed Update Pipeline: Can the organization demonstrate that firmware and over-the-air updates are cryptographically signed and verified before installation? 

• Key Lifecycle Across the Vehicle’s Service Life: Are procedures documented for key rotation, re-keying, and revocation across a vehicle service life of 15 years or more? 

• Supplier Cybersecurity Interface Agreements: Do supplier agreements specify cryptographic requirements and cybersecurity work-product evidence for supplied components? 

• CSMS Alignment with UN R155: Is the organizational Cybersecurity Management System aligned with UN R155 and supported by documented ISO/SAE 21434 engineering evidence? 

TAKE THIS TO MANAGEMENT

ISO/SAE 21434 underpins UN R155, and UN R155 is the difference between getting type approval to sell a vehicle in the EU, UK, Japan, and other UNECE markets, and not. Every ECU we ship needs a real, unique identity rather than a shared platform key, and every firmware update needs to be signed and verified before it reaches a vehicle.

Our vehicles stay on the road for 15 years or more, so the cryptographic choices we make in production today have to survive re-keying, revocation, and an eventual shift to post-quantum algorithms across that entire service life. If we can’t produce a TARA and a cryptographic inventory for a platform, we can’t tell an OEM customer, a regulator, or ourselves what’s actually exposed when a vulnerability surfaces in a vehicle that’s already on dealer lots.