ISO-SAE 21434 — Automotive Cybersecurity

So let's follow that cybersecurity lifecycle all the way to its final chapter. Past design. Past production. Past all those over-the-air updates shipped to cars in the field. We're heading to the moment most teams never plan for: the moment the maker decides to stop. In ISO slash SAE twenty-one four thirty-four, that's Clause fourteen — End of cybersecurity support and decommissioning.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Here's the trap.
• This is Clause fourteen, the last phase of the whole cybersecurity lifecycle.
• End of cybersecurity support is the point where the organization stops looking after that item's cybersecurity.
• And that's exactly why the timing matters.
• So who is actually accountable for the ending? This traces straight back to the front of the standard: organizational cybersecurity management.
• Here's the governance backbone: the cybersecurity plan.

Reference: Clause 14 of ISO/SAE 21434:2021 is titled 'End of cybersecurity support and decommissioning'; it contains two distinct concepts — end of cybersecurity support and decommissioning (

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

Zoom all the way in now. Past the family of standards, past the whole cybersecurity lifecycle, down to one clause: ISO slash SAE twenty-one four thirty-four, Clause 10 — Product development. And inside Clause 10, the one activity we care about today. Design.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Start by finding yourself on the V.
• Here's what actually lands on your desk.
• Now draw the system that requirement lives in.
• A goal sitting at the top of the page protects nothing.
• Let's motivate all this work with a failure.
• Zoom into one control and watch it work.

Reference: In ISO/SAE 21434:2021 the design activity sits within Clause 10 (Product development). The specific design sub-clause is 10.4.1; I referenced 'Clause 10' and described the activit

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So let's zoom all the way in — past the lifecycle diagram, past the management plan — down to the beating heart of ISO slash SAE twenty-one four thirty-four: the threat analysis and risk assessment, the TARA, laid out in Clause fifteen.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Right — you've seen why cars need a cybersecurity standard, and where twenty-one four thirty-four sits in the family.
• First, meet the thing we're chasing: a vulnerability.
• Now watch it travel.
• So here's the fork the whole software-and-systematic world turns on.
• So the standard makes a move that almost sounds like a confession.
• And that dial has a name: the Cybersecurity Assurance Level — CAL one through CAL four.

Reference: Clause 15 in ISO/SAE 21434:2021 is titled 'Threat analysis and risk assessment methods' (TARA). This is believed correct; verify the clause number against the published standard be

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So far we've walked the whole cybersecurity lifecycle from a distance. Now let's zoom all the way in on the one clause where the risk actually gets sized up. In ISO S A E twenty-one four thirty-four, that job belongs to the threat analysis and risk assessment — everyone just calls it TARA — and it lives in clause fifteen. This is the engine room.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Let's put the subject on the table.
• Move one, name what can go wrong.
• Before we size anything, know where you're standing.
• Move two, and it's the heart of the whole thing.
• Take the first dial, impact.
• The second dial, attack feasibility — how realistic the attack is, rated from very low up to high.

Reference: Clause 15 of ISO/SAE 21434:2021 contains the TARA methods. The step sequence used here (asset identification, threat scenario identification, impact rating, attack path analysis, a

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So far we've flown over the whole cybersecurity lifecycle. Now drop down into the part almost nobody films: the management clauses.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Here's the trap.
• The standard splits it in two.
• So who's actually on the hook? At the top, governance is a top-management job — they set the policy, fund it, and answer for it if the culture rewards shipping over securing.
• The spine of the whole thing is the cybersecurity plan.
• Here's the rule that keeps everyone honest: every activity has to leave a trace.
• All those work products roll up into one thing: the cybersecurity case.

Reference: Clause-level mapping is accurate for ISO/SAE 21434:2021: Clause 5 = organizational cybersecurity management, Clause 6 = project-dependent cybersecurity management, Clause 7 = distr

More in this series: The V-Model and Safety Lifecycle

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So far we have zoomed out to the whole cybersecurity lifecycle. Now zoom all the way in, to one clause that keeps working the entire time your vehicle is on the road. In ISO S-A-E twenty-one four thirty-four, Clause 8 covers continual cybersecurity activities, the part of the standard that never stops after the product ships.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• This is ISO S-A-E twenty-one four thirty-four, road vehicles, cybersecurity engineering.
• First, name what can go wrong, because twenty-one four thirty-four is picky about words.
• Locate yourself.
• Why sweat a single weakness.
• Here is the move that unites this whole family of standards.
• Zoom in on feasibility for a second, because it is where engineers argue most.

Reference: Vulnerability analysis sits in ISO/SAE 21434 Clause 8, 'Continual cybersecurity activities.' I state the subclause order as monitoring, event assessment, vulnerability analysis, vu

More in this series:

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

And that's the full ISO 21434 lifecycle — from organizational setup, through the concept phase, the threat analysis, and into development. Now watch where the marker lands. Slide past the concept work, past the design, and stop right here: the back half of product development, clause 10, and its partner, clause 11.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Here's the clause.
• Keep these two lanes separate in your head.
• This is why the development V matters.
• So how do you actually verify? The standard won't let you pick one favorite tool.
• Validation is where a lot of teams get surprised.
• Not every function earns the same scrutiny.

Reference: Clause-level mapping used and believed correct for ISO/SAE 21434:2021: Clause 6 (project-dependent cybersecurity management — includes cybersecurity case, cybersecurity assessment,

More in this series: The V-Model and Safety Lifecycle

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So let's zoom all the way in. The reusable stuff is behind us: why cybersecurity matters, the family of standards, the shape of the ISO 21434 lifecycle. Now we land on one clause, Product Development. In ISO 21434 this is Clause 10, and it sits right after the Concept phase, Clause 9. Here's the handoff.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• This is the clause on the table today: Product Development, requirements.
• Here's the reframe.
• Let's define the term plainly.
• This is the chain that has to hold.
• Concrete example.
• So what makes a requirement fit to ship into design? Run this check on every one.

Reference: ISO/SAE 21434:2021 places Product Development at Clause 10 and the Concept phase at Clause 9; the Concept phase is where the item definition, TARA (threat analysis and risk assessm

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So let's zoom all the way in. Every standard on this channel asks the same two questions: what could go wrong, and how do we keep it from hurting somebody? What makes ISO 21434 different is who it blames. Not a worn-out sensor. Not a cosmic-ray bit-flip in memory. A person. Someone with a laptop, a motive, and time.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Open your copy to clause 1, the scope, because a standard's first job is to tell you where its authority stops.
• So why does a car even need this? Because a modern vehicle is a computer network on wheels, and every way information gets in is a door.
• Here's the mindset shift, and it's the whole reason this standard is separate from functional safety.
• And an attack is never one thing.
• Now, why do we obsess over exact words? Because in a functional-safety-style standard, the vocabulary is normative.
• Which forces the next question: protect what, exactly? The standard's answer is the asset.

Reference: Clause references are per ISO/SAE 21434:2021: clause 1 is Scope, and the Threat Analysis and Risk Assessment (TARA) methods sit in clause 15. Concept-phase activities (item definit

More in this series: IEC 61508 — Functional Safety Foundations | Functional Safety Assessment and Services

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So we've zoomed all the way in. Past why cybersecurity matters, past the family of standards, down into the ISO 21434 lifecycle. Now stop on one clause. Clause 6. Project dependent cybersecurity management.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Here's our clause.
• First, kill the wrong mental model.
• So let's define it in plain language.
• Start with accountability, because that's where governance always starts.
• Now the spine of the whole clause: the cybersecurity plan.
• Here's the mechanism that makes it real.

Reference: Clause mapping: Project dependent cybersecurity management is Clause 6 of ISO/SAE 21434:2021; organizational cybersecurity management is Clause 5. Stated correctly in the script.

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So let's zoom all the way in. Everything we just said about the cybersecurity lifecycle only counts if two things are true: someone is actually on the hook to run it, and you can prove, on paper, that they did.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Here's the reframe.
• Let's pin down exactly what we're talking about.
• Because of this.
• So who is actually on the hook? Not 'the company' in the abstract.
• That plan is the spine of the whole effort.
• Now the golden rule of this whole standard: activities have to leave a trail.

Reference: ISO/SAE 21434:2021 'Road vehicles — Cybersecurity engineering' was published August 2021 as a joint ISO and SAE standard. It is a voluntary consensus standard and is not itself law

More in this series:

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

The operations and maintenance phase begins when vehicles are deployed and face real cybersecurity threats in the field. ISO 21434 clauses eleven through thirteen outline how organizations must detect, respond to, and recover from security incidents.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• ISO 21434 section eleven covers the operational phase where deployed vehicles face real cybersecurity threats.
• The operations and maintenance phase begins when vehicles are deployed in the field.
• Organizations must implement five core activities during the operational phase.
• When a cybersecurity incident occurs, organizations follow a structured response: detection of anomalous behavior triggers isolation of the affected vehicle, investigation of the root cause, deployment of remediation—and finally, post-incident verification and organizational learning.
• Operations activities focus on detecting and responding to threats in real time.
• Vulnerabilities discovered in operational vehicles must climb this ladder: from discovery and risk assessment through remediation planning to deployment and final confirmation.

Reference: Operations and maintenance is Clause 13 in ISO/SAE 21434:2021; per the ear-first rule no clause numbers are spoken in narration, and I referenced the clause by name only. Its two s

More in this series:

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So let's zoom all the way in. Past the whole lifecycle, past the management plan, down to the clause where the standard stops describing process and starts actually thinking.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Here's the map for the next few minutes.
• First, what does this standard even call the thing that can go wrong? It does not say hazard, that is the safety world.
• These two live inside a pipeline called the TARA, threat analysis and risk assessment.
• Here is the core move of this whole pack.
• Each factor gets its own scale.
• Now you combine them with a lookup.

Reference: Clause mapping: The threat analysis and risk assessment (TARA) methods are in Clause 15 of ISO/SAE 21434:2021; the concept phase (cybersecurity goals and cybersecurity concept) is

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

Cybersecurity threats against connected vehicles demand structured response. ISO 21434, the international standard for automotive cybersecurity engineering, mandates Threat Analysis and Risk Assessment—T-A-R-A—as the foundation for protecting vehicle systems.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• This episode focuses on Threat Analysis and Risk Assessment, abbreviated T-A-R-A, a cornerstone of ISO 21434 cybersecurity engineering.
• T-A-R-A is an iterative process combining threat identification with systematic risk evaluation.
• The T-A-R-A workflow follows a defined sequence across the vehicle system.
• Assets are the valuable items in vehicle systems that require protection: software components, hardware modules, and critical data.
• Risk is determined by two dimensions working together.
• Once risks are identified and quantified, you select a treatment strategy for each risk.

Reference: TARA sub-methods are per ISO/SAE 21434 Clause 15: asset identification, threat scenario identification, impact rating, attack path analysis, attack feasibility rating, risk value d

More in this series: ISO 12100 — Machinery Risk Assessment | ISO 13849 — Machinery Safety and Performance Levels

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

We just watched the whole cybersecurity lifecycle spin up — the item definition, the threat analysis and risk assessment, the cybersecurity goals, the cybersecurity concept. Now zoom in. Fly past the concept phase, down into Clause 10: product development. This is where the concept stops being a set of good intentions on paper and becomes real hardware and real software.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• So here we are, parked on the right-hand side of the V, inside Clause 10.
• First, kill the confusion that trips up almost everyone.
• Here's the shape that makes all of this click.
• So let's pin down the term itself.
• You do this bottom-up, level by level.
• Now, how do you actually verify? The standard doesn't hand you one magic test — it points you at a toolbox, and you pick the method that fits the property you're trying to prove.

Reference: Clause 10 is 'Product development' in ISO/SAE 21434:2021, and integration and verification is its second major activity area (commonly numbered 10.4.2). The narration deliberately

More in this series: The V-Model and Safety Lifecycle

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So let's zoom all the way down, past the whole cybersecurity lifecycle, past the concept phase, and land on the part of ISO/SAE 21434 where the rubber actually meets the road: Product development. This is Clause 10.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Clause 10, Product development.
• First pin down two words people smash together and then get burned for it.
• Here's the shape that organizes all of it: the V-model.
• And the right side isn't one flat activity — the methods get sharper as you climb.
• Let me single out the two at the top, because they're what makes cybersecurity testing different from safety testing.
• Now, none of this counts as proof unless the test itself is trustworthy.

Reference: ISO/SAE 21434:2021 places product development in Clause 10; verification and validation of cybersecurity requirements and the item are activities within product development and int

More in this series: The V-Model and Safety Lifecycle

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So let's zoom all the way in, past the whole cybersecurity lifecycle, and land on one clause that most people skip right over: Clause 7, Distributed cybersecurity activities. Here's why it matters. Almost no carmaker builds the whole vehicle. The braking controller comes from one supplier, the telematics unit from another, the software stack from a third.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Let's start by killing a myth.
• So here's the term, in plain language.
• Picture the two sides of the table.
• And notice what has to happen first.
• So the shape of the whole clause is a sequence.
• That agreement in the middle has a name: the cybersecurity interface agreement.

Reference: Clause 7 of ISO/SAE 21434:2021 is titled 'Distributed cybersecurity activities' and covers responsibility sharing between customer and supplier. Confirmed via web sources; exact su

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

We've now walked the whole ISO 21434 lifecycle, from concept all the way to decommissioning. So let's zoom all the way back in, to where that lifecycle actually begins: the concept phase, Clause 9. And here's the surprise. The very first thing you do there, before you hunt for a single threat, before you rate a single risk, isn't security at all. It's a definition.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• ISO 21434 .
• Here's why this tiny, unglamorous step carries so much weight.
• So what exactly is an item? In this standard the word is normative.
• Now keep item and component straight, because people blur them together constantly.
• An item definition is not a one-line sentence.
• The heart of the whole thing is that boundary.

Reference: Item definition sits in the Concept phase, Clause 9 of ISO/SAE 21434:2021, and is its first activity. It is believed to be subclause 9.3 with work product WP-09-01; narration delib

More in this series:

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So let's zoom all the way in. Past the whole cybersecurity lifecycle, past the risk-assessment methods, down to Clause 8: continual cybersecurity activities. This is the part of ISO 21434 that never stops running, even years after your vehicle is on the road.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• So here's the clause on the table.
• First, name the thing that can go wrong.
• Now, where are you standing in the process? Clause 8 is a conveyor belt that never switches off.
• Let's watch a weakness turn into harm, because the hinge in the middle is everything.
• Here's the move every standard in this family makes: risk is never one number.
• Take those two factors and run them through a lookup.

Reference: ISO/SAE 21434:2021 places continual cybersecurity activities in Clause 8, with cybersecurity monitoring, cybersecurity event assessment, vulnerability analysis, and vulnerability m

More in this series: ISO 26262 — Automotive Functional Safety | Semiconductor Functional Safety (ISO 26262-11)

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

Alright. We have walked the whole family of functional safety and cybersecurity standards, and we have seen the ISO SAE twenty-one four thirty-four lifecycle run from concept all the way to decommissioning. Now zoom all the way in, to the very first working clause of the standard, Clause 5.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Here is the reframe.
• So what does the term actually mean.
• Clause 5.four point one is called cybersecurity governance, and it puts the accountability exactly where it belongs, at the top.
• Clause 5.four point two turns to something softer, but just as required, cybersecurity culture.
• If the plan is the spine of a project, then at the organization level the spine is your policy, your rules, and your processes.
• Every requirement in Clause 5 throws off a work product, and a work product is just evidence.

Reference: Session maps to ISO/SAE 21434:2021, Clause 5 'Organizational cybersecurity management.' Subclause numbers stated in narration: 5.4.1 Cybersecurity governance, 5.4.2 Cybersecurity c

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So far we've flown over the whole cybersecurity lifecycle from up high. Now let's drop down into one clause — the one where the design finally becomes a real, running product. In ISO 21434, that clause is Product Development. The concept phase already decided what needs protecting and set your cybersecurity goals.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• This is Clause 10, Product Development, and today we're inside the implementation part of it.
• So let's define it plainly.
• Picture the classic V.
• That tracing is the whole game.
• Now, who is accountable for all this, in writing? Two levels.
• That named owner works from a document called the cybersecurity plan, and the plan is the spine of everything.

Reference: Clause-level references are accurate for ISO/SAE 21434:2021: Clause 5 = organizational cybersecurity management, Clause 6 = project-dependent cybersecurity management, Clause 7 = d

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

So far we've flown across the whole cybersecurity lifecycle. Now we drop into one room: the concept phase. This is where, before anyone designs an architecture or writes a line of code, ISO 21434 asks a deceptively simple question - how much cybersecurity does this item actually need? The answer doesn't come from a gut feeling.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• We're inside clause 9, the concept phase of ISO 21434 .
• First, name the thing that can go wrong.
• All of this lives in one method, the threat analysis and risk assessment, or TARA, in clause fifteen.
• Here's the move that trips people up.
• Impact isn't just safety.
• Attack feasibility runs the other way.

Reference: Clause references reflect ISO/SAE 21434:2021: concept phase is clause 9 (cybersecurity goals in 9.4); the TARA methods are clause 15, with impact rating (15.5), attack feasibility

More in this series:

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.

We have been circling the whole ISO 21434 lifecycle — concept, threat analysis, product development, production, operations. Now push in. Past the risk assessment. Past the development work on the bench. All the way to the clause that sits right before you are allowed to ship: Clause 11, cybersecurity validation.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Clause 11, cybersecurity validation.
• Here is the split the whole pack turns on.
• So validation carries two burdens, not one.
• Picture the V.
• Not every function earns the same scrutiny, and the standard gives you a dial for that: the Cybersecurity Assurance Level, CAL one through four.
• And here is the part that makes the proof credible: you do not get to grade your own homework.

Reference: Clause 11 = Cybersecurity validation, Clause 10 = Product development (holds verification of work products), Clause 9 = Concept phase (item definition, TARA, cybersecurity goals, c

More in this series: The V-Model and Safety Lifecycle

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.