ISO/SAE 21434

No changes recorded yet — we are watching, and nothing has been published.

1. 2021-08-31 ISO/SAE 21434:2021, the first edition, is published

1. 2021-08-31
   ISO/SAE 21434:2021 Major versionCurrent

   First edition: engineering requirements for cybersecurity risk management across the concept, development, production, operation, maintenance and decommissioning of road vehicle E/E systems. source

2. 2020-02-12
   ISO/SAE DIS 21434 Draft

   Draft International Standard, listed by SAE as the historical revision ISO/SAE21434.D1. source

Vehicle manufacturers and suppliers developing series production road vehicle E/E systems; it defines processes and a common risk language, not specific technologies.

What it specifies

Engineering requirements for cybersecurity risk management regarding concept, product development, production, operation, maintenance and decommissioning of E/E systems in road vehicles, including their components and interfaces. source

Framework

A framework that includes requirements for cybersecurity processes and a common language for communicating and managing cybersecurity risk. source

Which systems

Series production road vehicle E/E systems whose development or modification began after the publication of the document. source

Technology-neutral

The document does not prescribe specific technology or solutions related to cybersecurity. source

Second edition

A second edition is registered at ISO as an approved work item, ISO/SAE AWI 21434, to replace the 2021 edition. source source

ISO/PAS 5112 gives guidelines for auditing a cybersecurity management system built on ISO/SAE 21434 processes, and UN R155 names 21434 as knowledge expected of type-approval assessors.

CSMS audit guidelines

ISO/PAS 5112:2022 provides guidelines, in addition to ISO 19011, for managing CSMS audit programmes, conducting organizational CSMS audits and CSMS auditor competence; its CSMS elements are based on the processes in ISO/SAE 21434. source

Next audit guideline

A second edition of the audit guideline is in development as ISO/DTS 5112, to replace ISO/PAS 5112:2022. source source

Type approval link

UN Regulation No 155 requires approval authorities and technical services to have personnel with specific automotive risk assessment knowledge, citing ISO 26262-2018, ISO/PAS 21448 and ISO/SAE 21434 as examples. source

ISO standards are voluntary; UN Regulation No 155 cites ISO/SAE 21434 as an example of relevant automotive risk assessment knowledge.

Legal status

ISO standards are voluntary and contain no contractual, legal or statutory requirements; national laws take precedence. source

Regulatory reference

UN Regulation No 155 cites ISO/SAE 21434 among examples of the automotive risk assessment knowledge its approval authorities and technical services must have. source

1. Standard ISO/SAE 21434:2021 (ISO catalogue entry; paid standard)
2. Standard ISO/SAE 21434 (SAE catalogue entry; paid standard)
3. Standard ISO/SAE AWI 21434, second edition in development
4. Guidance ISO/PAS 5112:2022 Guidelines for auditing cybersecurity engineering

1. UN R155

   UN R155 is the type-approval regulation requiring a certified CSMS; ISO/SAE 21434 is the engineering standard for the cybersecurity processes such a system uses.

2. UN R156

   UN R156 governs software update management for type approval; ISO/SAE 21434 covers cybersecurity engineering across the vehicle E/E lifecycle.

3. TISAX

   TISAX assesses information security at automotive companies against the VDA ISA catalogue; ISO/SAE 21434 addresses the cybersecurity of the vehicle's E/E systems themselves.

4. IEC 62443

   IEC 62443 covers industrial automation and control systems; ISO/SAE 21434 covers road vehicle E/E systems.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to ISO/SAE 21434 (RSS)