Asset-driven Methodology

Asset-driven Methodology is a risk-centric approach where security controls are derived from the identification and evaluation of critical assets. In the context of ISO/SAE 21434, this means performing Threat Analysis and Risk Assessment (TARA) as the foundational step before designing any security measures. This ensures that every control is justified by a specific threat-asset combination, preventing wasted effort on low-risk areas while ensuring high-risk assets are adequately protected. This methodology is essential for creating a robust Safety Assurance Case (SAC), as it provides the evidentiary link between the asset's importance and the chosen control. Unlike compliance-only approaches, this method-driven approach ensures that security measures are proportionate to the actual risk-adjusted value of the assets, which is critical for safety-critical systems where failure can lead to physical harm.

Implementation typically follows three phases: Asset-Centric Identification, Threat-Risk Quantification, and Control-Based Verification. First, companies must catalog all digital and physical assets, including software components, data flows, and communication interfaces, as required by ISO/SAE 21434 Clause 7. Second, threat scenarios are mapped against these assets using frameworks like STRIDE or ATT&CK, assigning severity levels based on impact and feasibility. Third, controls are selected based on the risk-adjusted priority of each asset, with each control's effectiveness verified through testing. For example, a Taiwanese automotive supplier implementing this approach saw a 30% reduction in security-related rework by identifying critical ECU assets early in the design phase, avoiding costly late-stage redesigns during the SOP (Start of Production) phase.

Taiwan enterprises face three primary challenges: lack of interdisciplinary expertise, fragmented asset documentation, and difficulty in quantifying control effectiveness. Many SMEs lack the specialized talent required to perform structured TARA, often relying on ad-hoc measures rather than a repeatable methodology. To overcome this, companies should invest in training programs focused on ISO/SAE 21434 and NIST frameworks. Secondly, the lack of a centralized asset-risk-control traceability matrix often leads to compliance gaps; implementing a GRC (Governance, Risk, and Compliance) tool can centralize this data. Finally, the absence of quantitative KPIs makes it hard to demonstrate ROI to management. Establishing metrics like 'Risk-Adjusted Control Coverage' and 'Time-to-Remediate Critical Assets' can provide the necessary visibility for leadership to justify ongoing investments in cybersecurity.

Winners Consulting Services Co., Ltd. specializes in Asset-driven Methodology for Taiwan enterprises, delivering compliant management systems within 90 days, with over 100 successful implementations. Free consultation: https://winners.com.tw/contact