Key Facts
- Regulator
- ISO/TC 22/SC 32; jointly developed by ISO and SAE International and published by ISO
- Latest version
- ISO/SAE 21434:2021, Road vehicles — Cybersecurity engineering, Edition 1; revision under way (stage 90.92, to be revised; a successor, ISO/SAE AWI 21434, is listed as under development)
- Effective
- 31 August 2021
- Official text
- www.iso.org ↗
What is ISO 21434?
ISO 21434, formally ISO/SAE 21434, is the international standard for cybersecurity engineering in road vehicles. ISO and SAE International developed it jointly and ISO publishes it. It sets requirements for managing cybersecurity risk across the vehicle lifecycle and applies to car makers, Tier 1 and Tier 2 suppliers and anyone working on vehicle electrical and electronic systems.
The current version is ISO/SAE 21434:2021, Road vehicles — Cybersecurity engineering, Edition 1, published on 31 August 2021 by ISO technical committee ISO/TC 22/SC 32. ISO describes its scope as engineering requirements for cybersecurity risk management, from concept and development through production, operation, maintenance and decommissioning.
A revision is under way. ISO's systematic review closed on 2 October 2026 and marked the 2021 edition "International Standard to be revised" (stage 90.92). A successor project, ISO/SAE AWI 21434, is listed as under development. Until a new edition is published, the 2021 text is the one to cite.
Why it matters
A Tier 2 supplier cannot get approval under UN Regulation No. 155. Only vehicle manufacturers can. But manufacturers must show they manage supply-chain risk, so they pass security requirements down to their suppliers through the contract.
For a supplier, then, ISO/SAE 21434 is likely to arrive as a contract term or a questionnaire line, not a regulator's letter.
A standard that is voluntary on paper can still be a condition of the contract.
ISO also says the standard supports compliance with the UNECE WP.29 regulation on cybersecurity and software updates.
Who it applies to
ISO names its audience as automotive OEMs, Tier 1 and Tier 2 suppliers, and any organisation involved in the design, development or maintenance of vehicle E/E systems. A firm with no part in those systems has no reason to adopt it.
The obligation is voluntary. ISO states the standard is not legally mandatory. It is, though, increasingly a de facto requirement because of regulatory pressure, such as UN R155, and industry expectation. For most suppliers that pressure is contractual.
ISO 27001 and ISO/SAE 21434 sit at different levels. ISO 27001 governs an organisation's information security management system. ISO/SAE 21434 sets engineering requirements for the vehicle's own E/E systems. An ISO 27001 certificate shows management discipline but does not replace the vehicle-level risk work ISO/SAE 21434 asks for. The nearest Annex A control is A.5.20 Addressing information security within supplier agreements, which overlaps with the standard's rules on manufacturer–supplier agreements. See the ISO 27001 vault for the management-system side.
The UK position
No UK law names ISO/SAE 21434. A UK firm meets it in one of two ways: as a vehicle manufacturer seeking type approval, where the Vehicle Certification Agency (VCA) assesses its management systems, or as a supplier bound by a manufacturer's contract.
| Regime | Who it affects | Link to ISO/SAE 21434 |
|---|---|---|
| UN Regulation No. 155 (cyber security and cyber security management system) | Manufacturers of M and N category vehicles, and trailers (O category) fitted with at least one electronic control unit, which need an audited management system | The VCA says R155's requirements can be closely mapped to ISO 21434. Suppliers meet them through manufacturer contracts |
| UN Regulation No. 156 (software update and software update management systems) | Manufacturers, as the companion to R155 | The VCA names ISO 24089 as the closest applicable standard |
Both regulations are audit-based: the VCA reviews each manufacturer's management systems and interviews stakeholders. A UK firm that does not touch road vehicles will not meet ISO/SAE 21434.
Key requirements
ISO's public description and abstract support this summary of what ISO/SAE 21434 asks for:
- Cybersecurity risk management as engineering. The standard sets engineering requirements for managing cybersecurity risk in the electrical and electronic (E/E) systems of road vehicles.
- Whole-lifecycle coverage. The requirements run from concept and development through production, operation, maintenance and decommissioning.
- Distributed cybersecurity activities. Clause 7 sets requirements and recommendations for manufacturer–supplier agreements and the alignment of responsibilities between the two.
- Process, not product. The standard is technology-agnostic. It focuses on processes and risk management rather than specific tools or solutions.
- New development only. It covers series-production road vehicle E/E systems, with their parts and interfaces, whose development or change began after publication.
A vehicle's cybersecurity risk doesn't end when it leaves the factory.
Cybersecurity responsibilities that aren't written into the supply agreement are assumptions.
The public pages do not list the other clauses. The full set is in the paywalled standard, which this entry does not reproduce.
Frequently asked questions
ISO/SAE 21434 is the engineering standard for vehicle cybersecurity risk management. UN Regulation No. 155 sets cybersecurity and management system requirements for type approval, and the UK Vehicle Certification Agency says it maps closely to ISO/SAE 21434. UN Regulation No. 156 covers software updates, with ISO 24089 as the closest standard, and ISO 26262 covers functional safety.
No law requires ISO/SAE 21434. What vehicle manufacturers do need for type approval is a cyber security management system under UN R155, and the VCA says R155's requirements map closely to ISO/SAE 21434. Manufacturers can use ISO/SAE 21434 to support R155 and pass its supplier duties down through contracts. That is how a voluntary standard becomes a de facto requirement.
ISO does not certify organisations against ISO/SAE 21434, and the sources checked for this entry name no accredited certification scheme for ISO/SAE 21434 itself. The formal audit in this space is UN R155 type approval, which covers vehicle manufacturers, not suppliers. A supplier asked for "ISO 21434 certification" should ask the customer which evidence it will accept.
ISO/SAE 21434 is complementary to ISO 26262, the functional safety standard, and ISO says the two are often implemented together. ISO/SAE 21434 covers cybersecurity risk management in road vehicles; ISO 26262 covers functional safety. A team working on vehicle E/E systems will often meet both.
ISO/SAE 21434:2021, Edition 1, is the first and only published edition of ISO/SAE 21434. ISO says it replaces the earlier SAE J3061 guideline. A second edition is at the earliest stage, an approved work item (ISO/SAE AWI 21434), so a customer that names ISO/SAE 21434 today means the 2021 text.