ISO/SAE 21434 and TARA, Explained
ISO/SAE 21434 is the engineering standard for road-vehicle cybersecurity: a lifecycle process from concept through decommissioning, with the Threat Analysis and Risk Assessment (TARA) as its analytic core.
UN R155 makes the standard operational (no certified CSMS, no type approval) so a weak TARA is now a homologation problem, not just an engineering one.
What renders on this page
- ▸TARA methodology comparison across verified firms
- ▸Type-approval track records with European and APAC regulators (KBA, RDW, VCA, MLIT)
- ▸Technical penetration-testing matrices by interface (V2X, telematics, OTA, OBD-II)
- ▸"Request Secure RFP" form pre-wired to the UN R155 RFP template
What a TARA must contain
Asset identification, threat scenarios, attack path analysis, impact and likelihood ratings, and risk values with treatment decisions, traceable to your actual architecture. Clause 15 defines the method; Annex E offers worked guidance. TARAs listing generic threats without tracing attack paths to domain controllers, gateways, and buses fail audit review.
The R155 connection
UN R155 requires a CSMS certificate as a condition of type approval; the audit evidence is largely 21434 artifacts, TARAs by program, incident records, validation evidence. Firms with documented authority experience (KBA, RDW, VCA, MLIT) know which artifacts each authority actually examines.
Penetration testing that feeds the TARA
Interface-specific testing (V2X, telematics, OTA paths, OBD-II diagnostics, key fob and TPMS surfaces) produces findings that close the loop back into risk ratings. Directory penetration-testing matrices record which interfaces each firm has actually tested and at what automation levels.
Find certified 21434 firms
The automotive vertical page filters firms by authority experience, service type (CSMS, TARA, R156 SUMS, pentest), and buyer fit, OEM, Tier 1, or EV startup.
Frequently asked questions
Is ISO/SAE 21434 mandatory?
The standard itself is voluntary; UN R155 makes its artifacts mandatory in practice for markets requiring type approval. Regulators do not certify to 21434, they require a CSMS whose evidence is built on it.
What is the difference between TARA and a threat model?
A threat model identifies threats; a TARA additionally rates impact and likelihood to produce prioritized, treated risk values under Clause 15. It is the auditable artifact, the reason the directory tracks TARA methodology per firm, not just threat modeling capability.
How often does a TARA need updating?
At each lifecycle milestone and on triggering events, new interfaces, vulnerability discoveries, architecture changes. A TARA that has not moved since SOP is a finding waiting to happen.
Do Tier 1 suppliers need their own TARA?
Suppliers inherit OEM CSMS requirements as contract terms. Supplier-side evidence (TARAs for the delivered component, vulnerability management SLAs) is what the directory flags under supply-chain compliance.