ISO/SAE 21434Supported in OneClickComply

Build ISO/SAE 21434 automotive cybersecurity on solid evidence

ISO/SAE 21434 is the international standard for cybersecurity engineering of road vehicles, published jointly by ISO and SAE International in August 2021. It requires organisations to manage cybersecurity risk for vehicle electrical and electronic systems across the whole lifecycle, using threat analysis and risk assessment (TARA), defined processes and documented work products. It does not prescribe specific technologies or algorithms.

See the ISO/SAE 21434 requirements

ISO/SAE 21434 Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs ISO/SAE 21434

Is ISO/SAE 21434 right for your organisation?

Vehicle manufacturers and their suppliers of electronic control units, software and connected components adopt ISO/SAE 21434 to show they engineer products securely. It matters most where UN Regulation No. 155 applies, because manufacturers need a certified cybersecurity management system for type approval and expect their supply chain to follow the standard. Suppliers usually meet it through customer contracts and cybersecurity interface agreements.

Adopting it is voluntary, though customers and auditors often expect it.

Issued by: ISO and SAE International (ISO/TC 22/SC 32 with SAE)
Latest version: ISO/SAE 21434:2021, first edition, published August 2021
Type: Voluntary international standard, often required by contract
Applies to: Electrical and electronic systems of series production road vehicles, including components and interfaces
Structure: 101 requirements, 13 recommendations and 4 permissions across Clauses 5 to 15
Related regulation: UN Regulation No. 155 on cybersecurity and cybersecurity management systems
Assessment route: No formal ISO certification scheme; organisations are audited by OEM customers or third parties, often using ISO/PAS 5112
Region: Global
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

ISO/SAE 21434 is mapped in OneClickComply's control library and available on request, so organisational cybersecurity management controls such as policy, competence, supplier management, monitoring and incident response can be tracked alongside your other frameworks. Automated evidence collection, AutoComplete policies and the risk register cover the management system side, while product engineering work products such as the TARA and cybersecurity case stay with your engineering teams. Our in-house auditors can guide you through what an assessor will expect.

Requirements covered

15 clauses, with normative requirements in Clauses 5 to 15: 101 requirements (RQ), 13 recommendations (RC) and 4 permissions (PM), from organisational cybersecurity management to TARA methods in Clause 15.

Already working towards another framework?

ISO 270018% of ISO/SAE 21434 overlaps
SOC 275% of ISO/SAE 21434 overlaps
NIST CSF62% of ISO/SAE 21434 overlaps
GDPR6% of ISO/SAE 21434 overlaps

Evidence you collect once counts towards every framework it applies to.

Manual ISO/SAE 21434 vs. OneClickComply

Manual ISO/SAE 21434

Organisational cybersecurity processes are documented in scattered spreadsheets and shared drives
Evidence for policy, competence and tool management controls is gathered by hand before every audit
Supplier cybersecurity capability and interface agreements are tracked in email threads
Monitoring and vulnerability management records go stale between assessments
The same controls are evidenced separately for ISO/SAE 21434, ISO 27001 and customer questionnaires

With OneClickComply

Policies, roles and processes sit in one platform mapped to the standard's organisational clauses
Evidence is collected automatically from connected tools and kept current
Vendor risk management keeps supplier assessments and documents in one place
Continuous monitoring alerts you when controls drift, so records stay audit-ready
Control mapping lets evidence collected once count towards every framework it supports

Capabilities

Everything you need for ISO/SAE 21434

Track ISO/SAE 21434 organisational controls alongside ISO 27001 and TISAX in one control set

Collect evidence automatically from cloud, identity, device and development tools

Generate cybersecurity policy, incident response and supplier policies with AutoComplete

Record vehicle cybersecurity risks and treatment decisions in the risk register

Manage supplier cybersecurity assessments and evidence through vendor risk management

Get expert guidance from our in-house auditors with Ask an Auditor

How it works

Three steps to ISO/SAE 21434 compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against ISO/SAE 21434 and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates ISO/SAE 21434-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

ISO/SAE 21434 requirements

All 118 normative provisions of ISO/SAE 21434:2021 in Clauses 5 to 15: 101 requirements (RQ), 13 recommendations (RC) and 4 permissions (PM), with short descriptive titles rather than the standard's full wording.

Reference	Requirement
RQ-05-01	Cybersecurity policy and executive commitment
RQ-05-02	Organisational cybersecurity rules and processes
RQ-05-03	Cybersecurity responsibilities and authority
RQ-05-04	Resources for cybersecurity
RQ-05-05	Related disciplines and communication channels
RQ-05-06	Cybersecurity culture
RQ-05-07	Competence and awareness for cybersecurity roles
RQ-05-08	Continuous improvement process
RQ-05-09	Rules for cybersecurity information sharing
RC-05-10	Information security alignment for shared data
RQ-05-11	Quality management system supporting cybersecurity engineering
RQ-05-12	Configuration information kept until end of support
RC-05-13	Cybersecurity management system for production
RQ-05-14	Tool management
RC-05-15	Reproducible environment for remedial actions
RC-05-16	Work products managed under an ISMS
RQ-05-17	Independent organisational cybersecurity audit
RQ-06-01	Project cybersecurity responsibilities
RQ-06-02	Cybersecurity relevance and activity analysis
RQ-06-03	Content of the cybersecurity plan
RQ-06-04	Responsibility for the cybersecurity plan and progress tracking
RQ-06-05	Cybersecurity plan linked to the project plan
RQ-06-06	Concept and development activities in the plan
RQ-06-07	Updating the cybersecurity plan
PM-06-08	Omission of activities for risk value 1 threat scenarios
RQ-06-09	Maintaining work products until release for post-development
RQ-06-10	Cybersecurity plans for distributed activities
RQ-06-11	Configuration and documentation management of the plan
RQ-06-12	Management of work products
PM-06-13	Tailoring of cybersecurity activities
RQ-06-14	Rationale for tailoring
RQ-06-15	When a reuse analysis is required
RQ-06-16	Scope of a reuse analysis
RQ-06-17	Reuse analysis of a component
RQ-06-18	Assumptions for components developed out of context
RQ-06-19	Requirements for out-of-context development
RQ-06-20	Validating out-of-context claims and assumptions at integration
RQ-06-21	Analysis of off-the-shelf components
RQ-06-22	Additional activities for insufficiently documented off-the-shelf components
RQ-06-23	Cybersecurity case
RQ-06-24	Risk-based decision on cybersecurity assessment
RQ-06-25	Independent review of the assessment decision
RQ-06-26	Purpose of the cybersecurity assessment
RQ-06-27	Appointment of an independent assessor
RQ-06-28	Assessor access and cooperation
PM-06-29	Assessment based on achievement of objectives
RQ-06-30	Scope of the cybersecurity assessment
RQ-06-31	Assessment report recommendation
RQ-06-32	Conditions for conditional acceptance
RQ-06-33	Work products required before release for post-development
RQ-06-34	Conditions for release for post-development
RQ-07-01	Evaluation of supplier capability
RC-07-02	Supplier record of cybersecurity capability
RQ-07-03	Cybersecurity content of requests for quotation
RQ-07-04	Cybersecurity interface agreement
RC-07-05	Agreeing the interface agreement before work starts
RQ-07-06	Shared handling of identified vulnerabilities
RQ-07-07	Notification of unclear or conflicting requirements
RC-07-08	Responsibility assignment matrix
RQ-08-01	Sources of cybersecurity information
RQ-08-02	Triage triggers
RQ-08-03	Collection and triage of cybersecurity information
RQ-08-04	Evaluation of cybersecurity events
RQ-08-05	Weakness analysis to identify vulnerabilities
RQ-08-06	Rationale for weaknesses not treated as vulnerabilities
RQ-08-07	Vulnerability management
RQ-08-08	Escalation to incident response
RQ-09-01	Item definition
RQ-09-02	Operational environment description
RQ-09-03	Threat analysis and risk assessment of the item
RQ-09-04	Risk treatment options for each threat scenario
RQ-09-05	Cybersecurity goals
RQ-09-06	Cybersecurity claims
RQ-09-07	Verification of the TARA and cybersecurity goals
RQ-09-08	Cybersecurity concept and controls
RQ-09-09	Item cybersecurity requirements and operational environment requirements
RQ-09-10	Allocation of cybersecurity requirements
RQ-09-11	Verification of the cybersecurity concept
RQ-10-01	Cybersecurity specifications
RQ-10-02	Allocation of requirements to architectural components
RQ-10-03	Post-development cybersecurity procedures
RQ-10-04	Selection of design, modelling and programming languages
RQ-10-05	Design, modelling and coding guidelines
RC-10-06	Established and trusted design principles
RQ-10-07	Weakness analysis of the architectural design
RQ-10-08	Verification of cybersecurity specifications
RQ-10-09	Integration and verification
RQ-10-10	Specification of integration and verification activities
RQ-10-11	Test coverage evaluation
RC-10-12	Testing for unidentified weaknesses and vulnerabilities
RQ-10-13	Rationale where such testing is not performed
RQ-11-01	Vehicle-level cybersecurity validation
RQ-11-02	Rationale for validation activities
RQ-12-01	Production control plan
RQ-12-02	Content of the production control plan
RQ-12-03	Implementation of the production control plan
RQ-13-01	Cybersecurity incident response plan
RQ-13-02	Implementation of the incident response plan
RQ-13-03	Vehicle updates and update capabilities
RQ-14-01	Communicating end of cybersecurity support
RQ-14-02	Decommissioning requirements
RQ-15-01	Damage scenario identification
RQ-15-02	Asset identification
RQ-15-03	Threat scenario identification
RQ-15-04	Impact assessment across safety, financial, operational and privacy
RQ-15-05	Impact rating levels
RQ-15-06	Safety impact ratings derived from ISO 26262-3
PM-15-07	Omitting less critical impact categories
RQ-15-08	Attack path analysis
RQ-15-09	Associating attack paths with threat scenarios
RQ-15-10	Attack feasibility rating
RC-15-11	Choice of attack feasibility rating approach
RC-15-12	Attack potential-based approach
RC-15-13	CVSS-based approach
RC-15-14	Attack vector-based approach
RQ-15-15	Risk value determination
RQ-15-16	Risk value scale of 1 to 5
RQ-15-17	Risk treatment decision

Always check the official ISO/SAE 21434 text for the exact wording.

ISO/SAE 21434 FAQs

What is ISO/SAE 21434?

ISO/SAE 21434 is the international standard for cybersecurity engineering of road vehicles, published by ISO and SAE International in August 2021. It sets requirements for managing cybersecurity risk in vehicle electrical and electronic systems from concept and development through production, operation, maintenance and decommissioning. It focuses on processes, threat analysis and risk assessment and documented work products rather than on specific technologies.

Is ISO/SAE 21434 mandatory?

No, ISO/SAE 21434 is a voluntary standard, but in practice it is often required. UN Regulation No. 155 makes a certified cybersecurity management system a condition of vehicle type approval in countries that apply it, including the EU, and ISO/SAE 21434 is widely used to meet it. Vehicle manufacturers also commonly require suppliers to conform to the standard through contracts and cybersecurity interface agreements.

How does ISO/SAE 21434 relate to UN R155?

UN R155 is a regulation and ISO/SAE 21434 is a standard that helps meet it. R155 requires vehicle manufacturers to operate a certified cybersecurity management system and to show that vehicle types are protected against cyber threats. ISO/SAE 21434 describes the engineering processes and risk assessment methods that can deliver this. In the EU, R155 applied to new vehicle types from July 2022 and to all newly registered vehicles from July 2024.

Who needs to comply with ISO/SAE 21434?

ISO/SAE 21434 is mainly adopted by vehicle manufacturers and their suppliers of electronic control units, software, sensors and connected components. It covers the electrical and electronic systems of series production road vehicles, including their interfaces and components. Tier 1 and Tier 2 suppliers usually adopt it because their customers request conformity in quotations and cybersecurity interface agreements.

What is a TARA in ISO/SAE 21434?

A TARA is a threat analysis and risk assessment, the method defined in Clause 15 of ISO/SAE 21434. It identifies assets, damage scenarios and threat scenarios, rates impact across safety, financial, operational and privacy categories, analyses attack paths and their feasibility, and determines a risk value from 1 to 5. Each threat scenario then receives a treatment decision: avoid, reduce, share or retain the risk.

Can you get certified to ISO/SAE 21434?

There is no formal ISO certification scheme for ISO/SAE 21434 comparable to ISO 27001. Organisations are instead assessed by their OEM customers or by independent third parties, often using the ISO/PAS 5112 guidelines for auditing cybersecurity engineering. Vehicle manufacturers separately obtain a cybersecurity management system certificate of compliance from their type approval authority under UN R155.

How does ISO/SAE 21434 relate to ISO 27001?

ISO/SAE 21434 covers cybersecurity of vehicle products, while ISO 27001 covers an organisation's information security management system. They overlap on organisational controls such as policy, competence, supplier management and incident response, and ISO/SAE 21434 recommends managing work products under an information security management system. Many automotive organisations run both, often alongside TISAX.

Does OneClickComply support ISO/SAE 21434?

ISO/SAE 21434 is mapped in OneClickComply's control library and available on request. It can be enabled so that organisational cybersecurity controls, evidence, policies, supplier assessments and risks are tracked alongside frameworks such as ISO 27001. Product engineering activities, such as the TARA and cybersecurity case for each item, remain with your engineering teams, and OneClickComply does not issue certifications.

Related standards

All standards

Get ISO/SAE 21434 ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.