ISO/SAE 21434 CSMS

Introduction to the Series

• Purpose: This series is designed to provide a foundational understanding of ISO/SAE 21434, a critical standard for road vehicle cybersecurity engineering.
• Audience: Aimed at newcomers to the standard, especially non-security teams, to foster an understanding of security requirements and enhance collaboration across various teams and departments.

Overview Video

Video Series Structure

• Overview Videos: A series of 11 videos, each dedicated to a specific clause (Clauses 5-15) of the ISO/SAE 21434, detailing the cybersecurity requirements.
• Deep Dive Sessions: Available on the Vehicle Security Engineering Cloud (VSEC), these sessions offer a thorough breakdown of each work product by provision, supplemented with examples, tips, and considerations.

Importance of the Standard

• ISO/SAE 21434 is presented as a minimal framework essential for establishing a robust cybersecurity posture in the automotive industry. It is integral for aligning various engineering processes and existing standards such as ISO 26262 for functional safety.

Provisions and Work Products

• Provisions: The standard specifies 118 provisions divided into requirements (101), recommendations (13), and permissions (4). These outline the mandatory and suggested cybersecurity activities.
• Work Products: Resulting from the provisions, there are 42 distinct work products such as documents, process diagrams, and reports which serve as evidence of the cybersecurity activities performed.

Clause Organization

• Clauses 1-4 provide foundational information such as the scope, normative references, terms, and general considerations of the standard.
• Clauses 5-15 detail the core cybersecurity activities, where each clause addresses different aspects of cybersecurity management and integration within automotive engineering.

Integration with Other Standards

• ISO/SAE 21434 is built upon foundational quality management systems like ISO 9001/IATF 16949 and system/software lifecycle standards ISO 15288 and ISO 12207.
• The standard works in parallel with ISO 26262, facilitating the integration of cybersecurity into automotive processes to complement and enhance safety measures.

Navigating the Standard

• The structured presentation of clauses, from organizational cybersecurity management to detailed risk assessment methods, guides the application of the standard across the vehicle lifecycle.
• Annexes provide additional resources such as summaries, examples, and guidelines that are vital for interpreting and applying the standard effectively.

Conclusion

• This course and the accompanying video series aim to equip automotive professionals with the necessary tools and knowledge to implement ISO/SAE 21434 effectively, ensuring a comprehensive approach to cybersecurity in road vehicle engineering.