ISO/SAE DIS 21434

Road vehicles -- Cybersecurity engineering

Véhicules routiers -- Ingénierie de la cybersécurité

Standards Content (sample)

DRAFT INTERNATIONAL STANDARD
ISO/SAE DIS 21434
ISO/TC 22/SC 32 Secretariat: JISC
Voting begins on: Voting terminates on:
2020-02-12 2020-05-06
Road vehicles — Cybersecurity engineering
ICS: 43.040.15
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
THEREFORE SUBJECT TO CHANGE AND MAY
NOT BE REFERRED TO AS AN INTERNATIONAL
STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
This document is circulated as received from the committee secretariat.
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
Reference number
NATIONAL REGULATIONS.
ISO/SAE DIS 21434:2020(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION. ISO/SAE International 2020
---------------------- Page: 1 ----------------------
ISO/SAE DIS 21434:2020(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/SAE International 2020

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication

may be reproduced, or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or

posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO or SAE

International at the respective address below or ISO’s member body in the country of the requester.

ISO copyright office SAE International
CP 401 • Ch. de Blandonnet 8 400 Commonwealth Dr.
CH-1214 Vernier, Geneva Warrendale, PA, USA 15096
Phone: [phone] Phone: [phone] (inside USA and Canada)
Fax: [phone] Phone: [phone] (outside USA)
Email: [e-mail] Fax: [phone]
Website: www.iso.org Email: [e-mail]
Website: www.sae.org
Published in Switzerland by ISO, published in the USA by SAE International
ii © ISO/SAE International 2020 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/SAE DIS 21434:2020(E)
ISO/SAE INTERNATIONAL ISO/SAE 21434 DRAFT Page 2 of 108
CONTENTS

1. SCOPE .................................................................................................................................................. 10

2. NORMATIVE REFERENCES ............................................................................................................... 10

3. TERMS AND ABBREVIATIONS ........................................................................................................... 10

3.1 Terms and Definitions ........................................................................................................................... 10

3.2 Abbreviated Terms ................................................................................................................................ 14

4. GENERAL CONSIDERATIONS ........................................................................................................... 14

5. OVERALL CYBERSECURITY MANAGEMENT ................................................................................... 16

5.1 General.................................................................................................................................................. 16

5.2 Objectives ............................................................................................................................................. 16

5.3 Inputs..................................................................................................................................................... 17

5.3.1 Prerequisites ......................................................................................................................................... 17

5.3.2 Further Supporting Information ............................................................................................................. 17

5.4 Requirements and Recommendations .................................................................................................. 17

5.4.1 Cybersecurity Governance ................................................................................................................... 17

5.4.2 Cybersecurity Culture ............................................................................................................................ 18

5.4.3 Cybersecurity Risk Management .......................................................................................................... 19

5.4.4 Organizational Cybersecurity Audit ....................................................................................................... 19

5.4.5 Information Sharing ............................................................................................................................... 20

5.4.6 Management Systems .......................................................................................................................... 20

5.4.7 Tool Management ................................................................................................................................. 21

5.4.8 Information Security Management ........................................................................................................ 21

5.5 Work Products ....................................................................................................................................... 21

6. PROJECT DEPENDENT CYBERSECURITY MANAGEMENT ........................................................... 22

6.1 General.................................................................................................................................................. 22

6.2 Objectives ............................................................................................................................................. 22

6.3 Inputs..................................................................................................................................................... 23

6.3.1 Prerequisites ......................................................................................................................................... 23

6.3.2 Further Supporting Information ............................................................................................................. 23

6.4 Requirements and Recommendations .................................................................................................. 23

6.4.1 Cybersecurity Responsibilities and Their Assignment .......................................................................... 23

6.4.2 Cybersecurity Planning ......................................................................................................................... 23

6.4.3 Tailoring of the Cybersecurity Activities ................................................................................................ 24

6.4.4 Reuse .................................................................................................................................................... 25

6.4.5 Component Out of Context ................................................................................................................... 26

6.4.6 Off-the-Shelf Component ...................................................................................................................... 26

6.4.7 Cybersecurity Case ............................................................................................................................... 26

6.4.8 Cybersecurity Assessment.................................................................................................................... 26

6.4.9 Release for Post-Development ............................................................................................................. 28

6.5 Work Products ....................................................................................................................................... 29

7. CONTINUOUS CYBERSECURITY ACTIVITIES ................................................................................. 29

7.1 General.................................................................................................................................................. 29

7.2 Objectives ............................................................................................................................................. 29

7.3 Cybersecurity Monitoring ...................................................................................................................... 29

7.3.1 Inputs..................................................................................................................................................... 29

7.3.2 Requirements and Recommendations .................................................................................................. 30

7.3.3 Work Products ....................................................................................................................................... 30

7.4 Cybersecurity Event Assessment ......................................................................................................... 30

7.4.1 Inputs..................................................................................................................................................... 30

7.4.2 Requirements and Recommendations .................................................................................................. 31

7.4.3 Work Products ....................................................................................................................................... 31

© ISO/SAE International 2020 – All rights reserved
---------------------- Page: 3 ----------------------
ISO/SAE DIS 21434:2020(E)
ISO/SAE INTERNATIONAL ISO/SAE 21434 DRAFT Page 3 of 108

7.5 Vulnerability Analysis ............................................................................................................................ 31

7.5.1 Inputs..................................................................................................................................................... 31

7.5.2 Requirements and Recommendations .................................................................................................. 31

7.5.3 Work Products ....................................................................................................................................... 32

7.6 Vulnerability Management .................................................................................................................... 32

7.6.1 Inputs..................................................................................................................................................... 32

7.6.2 Requirements and Recommendations .................................................................................................. 32

7.6.3 Work Products ....................................................................................................................................... 33

8. RISK ASSESSMENT METHODS ......................................................................................................... 33

8.1 General.................................................................................................................................................. 33

8.2 Objectives ............................................................................................................................................. 34

8.3 Asset Identification ................................................................................................................................ 34

8.3.1 Inputs..................................................................................................................................................... 34

8.3.2 Requirements and Recommendations .................................................................................................. 34

8.3.3 Work Products ....................................................................................................................................... 35

8.4 Threat Scenario Identification ............................................................................................................... 35

8.4.1 Inputs..................................................................................................................................................... 35

8.4.2 Requirements and Recommendations .................................................................................................. 35

8.4.3 Work Products ....................................................................................................................................... 36

8.5 Impact Rating ........................................................................................................................................ 36

8.5.1 Inputs..................................................................................................................................................... 36

8.5.2 Requirements and Recommendations .................................................................................................. 36

8.5.3 Work Products ....................................................................................................................................... 37

8.6 Attack Path Analysis ............................................................................................................................. 37

8.6.1 Inputs..................................................................................................................................................... 37

8.6.2 Requirements and Recommendations .................................................................................................. 37

8.6.3 Work Products ....................................................................................................................................... 38

8.7 Attack Feasibility Rating ........................................................................................................................ 39

8.7.1 Inputs..................................................................................................................................................... 39

8.7.2 Requirements and Recommendations .................................................................................................. 39

8.7.3 Work Products ....................................................................................................................................... 40

8.8 Risk Determination ................................................................................................................................ 40

8.8.1 Inputs..................................................................................................................................................... 40

8.8.2 Requirements and Recommendations .................................................................................................. 40

8.8.3 Work Products ....................................................................................................................................... 40

8.9 Risk Treatment Decision ....................................................................................................................... 40

8.9.1 Inputs..................................................................................................................................................... 40

8.9.2 Requirements and Recommendations .................................................................................................. 41

8.9.3 Work Products ....................................................................................................................................... 41

9. CONCEPT PHASE ............................................................................................................................... 41

9.1 General.................................................................................................................................................. 41

9.2 Objectives ............................................................................................................................................. 42

9.3 Item Definition ....................................................................................................................................... 42

9.3.1 Inputs..................................................................................................................................................... 42

9.3.2 Requirements and Recommendations .................................................................................................. 42

9.3.3 Work Products ....................................................................................................................................... 43

9.4 Cybersecurity Goals .............................................................................................................................. 43

9.4.1 Inputs..................................................................................................................................................... 43

9.4.2 Requirements and Recommendations .................................................................................................. 44

9.4.3 Work Products ....................................................................................................................................... 45

9.5 Cybersecurity Concept .......................................................................................................................... 45

9.5.1 Inputs..................................................................................................................................................... 45

9.5.2 Requirements and Recommendations .................................................................................................. 46

9.5.3 Work Products ....................................................................................................................................... 46

10. PRODUCT DEVELOPMENT ................................................................................................................ 46

10.1 General.................................................................................................................................................. 46

10.2 Objectives ............................................................................................................................................. 49

10.3 Inputs..................................................................................................................................................... 49

10.3.1 Prerequisites ......................................................................................................................................... 49

10.3.2 Further Supporting Information ............................................................................................................. 50

© ISO/SAE International 2020 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/SAE DIS 21434:2020(E)
ISO/SAE INTERNATIONAL ISO/SAE 21434 DRAFT Page 4 of 108

10.4 Requirements and Recommendations .................................................................................................. 50

10.4.1 Refinement of Cybersecurity Requirements and Architectural Design ................................................. 50

10.4.2 Integration and Verification ................................................................................................................... 53

10.4.3 Specific Requirements for Software Development ............................................................................... 56

10.5 Work Products ....................................................................................................................................... 57

11. CYBERSECURITY VALIDATION ......................................................................................................... 57

11.1 General.................................................................................................................................................. 57

11.2 Objectives ............................................................................................................................................. 57

11.3 Inputs..................................................................................................................................................... 57

11.3.1 Prerequisites ......................................................................................................................................... 57

11.3.2 Further Supporting Information ............................................................................................................. 58

11.4 Requirements and Recommendations .................................................................................................. 58

11.5 Work Products ....................................................................................................................................... 58

12. PRODUCTION ...................................................................................................................................... 58

12.1 General.................................................................................................................................................. 58

12.2 Objectives ............................................................................................................................................. 58

12.3 Inputs..................................................................................................................................................... 59

12.3.1 Prerequisites ......................................................................................................................................... 59

12.3.2 Further Supporting Information ............................................................................................................. 59

12.4 Requirements and Recommendations .................................................................................................. 59

12.5 Work Products ....................................................................................................................................... 60

13. OPERATIONS AND MAINTENANCE ................................................................................................... 60

13.1 General.................................................................................................................................................. 60

13.2 Objectives ............................................................................................................................................. 60

13.3 Cybersecurity Incident Response ......................................................................................................... 60

13.3.1 Inputs..................................................................................................................................................... 60

13.3.2 Requirements and Recommendations .................................................................................................. 60

13.3.3 Work Products ....................................................................................................................................... 61

13.4 Updates ................................................................................................................................................. 61

13.4.1 Inputs..................................................................................................................................................... 61

13.4.2 Requirements and Recommendations .................................................................................................. 62

13.4.3 Work Products ....................................................................................................................................... 62

14. DECOMMISSIONING ........................................................................................................................... 62

14.1 General.................................................................................................................................................. 62

14.2 Objectives ............................................................................................................................................. 62

14.3 Inputs..................................................................................................................................................... 62

14.3.1 Prerequisites ......................................................................................................................................... 62

14.3.2 Further Supporting Information ............................................................................................................. 62

14.4 Requirements and Recommendations .................................................................................................. 63

14.5 Work Products ....................................................................................................................................... 63

15. DISTRIBUTED CYBERSECURITY ACTIVITIES .................................................................................. 63

15.1 General.................................................................................................................................................. 63

15.2 Objectives ............................................................................................................................................. 63

15.3 Inputs..................................................................................................................................................... 63

15.3.1 Prerequisites ......................................................................................................................................... 63

15.3.2 Further Supporting Information ............................................................................................................. 63

15.4 Requirements and Recommendations .................................................................................................. 63

15.4.1 Demonstration and Evaluation of Supplier Capability ........................................................................... 63

15.4.2 Request for Quotation ........................................................................................................................... 64

15.4.3 Alignment of Responsibilities ................................................................................................................ 64

15.5 Work Products ....................................................................................................................................... 65

© ISO/SAE International 2020 – All rights reserved
---------------------- Page: 5 ----------------------
ISO/SAE DIS 21434:2020(E)
ISO/SAE INTERNATIONAL ISO/SAE 21434 DRAFT Page 5 of 108

ANNEX A (INFORMATIVE) SUMMARY OF CYBERSECURITY ACTIVITIES AND WORK PRODUCTS ................ 66

ANNEX B (INFORMATIVE) EXAMPLES OF CYBERSECURITY CULTURE ............................................................ 68

ANNEX C (INFORMATIVE) CYBERSECURITY INTERFACE AGREEMENT TEMPLATE EXAMPLE ..................... 69

ANNEX D (INFORMATIVE) CYBERSECURITY RELEVANCE: EXAMPLE METHOD AND CRITERIA ................... 71

ANNEX E (INFORMATIVE) CYBERSECURITY ASSURANCE LEVELS .................................................................. 72

ANNEX F (INFORMATIVE) VERIFICATION AND VALIDATION ............................................................................... 77

ANNEX G (INFORMATIVE) EXAMPLE USE CASE AND WORK PRODUCTS: HEADLAMP SYSTEM ................... 80

ANNEX H (INFORMATIVE) IMPACT RATING FOR SAFETY, FINANCIAL, OPERATIONAL AND

PRIVACY DAMAGE ....................................................................................................... 97

ANNEX I (INFORMATIVE) GUIDELINES FOR DETERMINING ATTACK FEASIBILITY RATING .......................... 99

ANNEX J (INFORMATIVE) MATRICES FOR RISK DETERMINATION .................................................................. 105

© ISO/SAE International 2020 – All rights reserved
---------------------- Page: 6 ----------------------
ISO/SAE DIS 21434:2020(E)
ISO/SAE INTERNATIONAL ISO/SAE 21434 DRAFT Page 6 of 108
FOREWORD

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO

member bodies). The work of preparing International Standards is normally carried out through ISO technical

committees. Each member body interested in a subject for which a technical committee has been established has the

right to be represented on that committee. International organizations, governmental and non-governmental, in liaison

with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC)

on all matters of electrotechnical standardization.

SAE International is a global association of more than 128,000 engineers and related technical experts in the aerospace,

automotive and commercial-vehicle industries. Standar
...