Road vehicles — Cybersecurity engineering
ISO/SAE 21434:2021 establishes the engineering framework for managing cybersecurity risks throughout the entire lifecycle of road vehicle electrical and electronic systems — from concept and development through production, operation, maintenance, and decommissioning. Published jointly by ISO and SAE International in August 2021, it defines the processes, methods, and requirements that OEMs and suppliers must implement to identify cybersecurity threats and vulnerabilities, assess their risks, and design appropriate countermeasures. Although the standard applies to E/E systems broadly, battery management systems (BMS), EV charging interfaces, telematics units, and over-the-air update mechanisms are all within its scope as they represent attack surfaces that could be exploited to compromise vehicle safety, including battery safety. UN Regulation 155 on Cybersecurity Management Systems (CSMS) references ISO/SAE 21434 as the technical basis for type approval compliance in markets that adopt UN regulations.
Published by: International Organization for Standardization (ISO) and SAE International
Current edition: ISO/SAE 21434:2021
Scope
ISO/SAE 21434 covers cybersecurity engineering for road vehicle E/E systems. Key framework elements include:
- Cybersecurity management: Organisational cybersecurity policies, competency management, and supply chain cybersecurity requirements across the development and production lifecycle
- Threat Analysis and Risk Assessment (TARA): Structured methodology for identifying threat scenarios, assessing their feasibility and impact, and determining cybersecurity goals and requirements
- Cybersecurity Assurance Levels (CAL): Four-level risk-based classification (CAL 1–4) that determines the rigour of cybersecurity activities required
- Product development: Cybersecurity specification, design, implementation, integration, verification, and validation requirements
- Post-development: Cybersecurity monitoring, vulnerability management, incident response, and end-of-life requirements during vehicle operation
Relationship to other standards
ISO/SAE 21434 is the technical cybersecurity engineering standard. UN Regulation 155 (UNECE WP.29) mandates a Cybersecurity Management System (CSMS) and references ISO/SAE 21434 as the implementation framework for type approval. UN Regulation 156 covers Software Update Management Systems (SUMS) and is the SOTA (software over-the-air) companion to R155. ISO 26262 covers functional safety (hardware and software safety failures) of E/E systems; ISO/SAE 21434 covers intentional cybersecurity threats — the two disciplines are complementary and their interfaces are defined in ISO/SAE 21434 Clause 5. For BMS cybersecurity specifically, the vehicle BMS communicates over CAN, LIN, or Ethernet and its attack surface falls squarely within the ISO/SAE 21434 scope as a safety-related system.
Disclaimer: This is not a definitive guide, just an indication and it is important that you always go back to the source for legislation.
References
See also
Functional Safety – the safety-critical BMS this standard’s TARA process has to account for as a cyber-attack surface, alongside its functional-safety failure modes.