ISO/IEC 21434

Road Vehicle Cybersecurity Engineering: automotive component inventory, CVE tracking.


Short name	ISO 21434
Region	International
Country or scope	International
Sector	Automotive
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ISO 21434

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for ISO 21434.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for ISO 21434 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ISO21434-CL8.3` Cybersecurity Monitoring Basis	Continual monitoring of cybersecurity information for the item and its components requires an inventory of the software components in scope (ISO/SAE 21434 Clause 8, cybersecurity monitoring)	Scan
`ISO21434-CL8.5` Vulnerability Analysis	Identified weaknesses must be analyzed for vulnerabilities, which requires components to be identifiable against CVE/advisory sources via PURL or CPE (ISO/SAE 21434 Clause 8, vulnerability analysis)	Scan
`ISO21434-CL8.6` Vulnerability Management	Vulnerabilities must be managed and remediated across the vehicle lifecycle, which requires knowing the exact version of each software component (ISO/SAE 21434 Clause 8, vulnerability management)	Scan
`ISO21434-CL7` Distributed Cybersecurity Activities	Cybersecurity responsibilities with suppliers must be defined and supplier capability evaluated, presupposing that the supplier of each component is known (ISO/SAE 21434 Clause 7, distributed cybersecurity activities)	Scan
`ISO21434-CL10` Integration and Verification Integrity	Product development requires verifying the integrity of integrated software, supported by integrity hashes for components (ISO/SAE 21434 Clause 10, product development)	Scan
`ISO21434-CL6` Work Product Documentation	Cybersecurity activities must produce identifiable, managed work products, satisfied by an SBOM with document identity and creation timestamp (ISO/SAE 21434 Clause 6, project-dependent cybersecurity management)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`RQ-08-01`	Cybersecurity Monitoring
`RQ-08-06`	Cybersecurity Incident Response
`RQ-09-02`	Item Definition
`RQ-09-04`	Cybersecurity Goals
`RQ-10-01`	Cybersecurity Specifications
`RQ-10-04`	Cybersecurity Validation
`RQ-11-01`	Cybersecurity Incident Response and Updates
`RQ-11-04`	End of Cybersecurity Support
`RQ-13-01`	Threat Analysis and Risk Assessment (TARA): Asset Identification
`RQ-13-05`	TARA: Attack Path Analysis
`RQ-13-08`	TARA: Risk Treatment Decision
`RQ-15-01`	Continual Cybersecurity Activity Management
`RQ-06-01`	Cybersecurity Supply Chain Risk Management
`RQ-06-04`	Component Vulnerability Management

Policy templates

Written for ISO 21434:

Threat Analysis and Risk Assessment (TARA) Policy
Automotive Cybersecurity Supply Chain Policy
Automotive Cybersecurity Validation and Continual Improvement Policy

And 22 from the standard set, adapted to ISO 21434.