Item-based Approach

Item-based Approach is a methodology originating from ISO 26262 and formalized in ISO/SAE 21434. It partitions a vehicle into discrete functional units called 'items,' each with its own assets, threats, and security goals. This allows for granular risk assessment, enabling engineers to address specific vulnerabilities at the component level rather than treating the entire vehicle as a single unit. This approach is critical for modern software-defined vehicles (SDV) where multiple suppliers contribute to a single-vehicle system, requiring clear-cut security responsibilities. Unlike holistic approaches, it enables modular verification and validation, which is essential for scaling security measures across different vehicle models and generations. The method ensures that cybersecurity risks are managed at the source, preventing systemic failures from cascading through the vehicle's network-on-chip or CAN bus architectures.

Implementation typically follows three stages: First, the 'Item Definition' phase where each component's function, assets, and interfaces are documented according to ISO/SAE 21434 Clause 10. Second, the 'TARA' phase where threats are identified and risks are quantified using severity, probability, and controllability metrics. Third, the 'Cybersecurity Case' phase where technical measures are mapped to security goals to provide evidence of risk mitigation. For example, a Tier 1 supplier providing a gateway module would perform a TARA specifically for that item, identifying threats like unauthorized CAN bus access. This results in measurable outcomes: a well-implemented Item-based Approach can reduce security-related rework by up to 30% and increase regulatory compliance rates by 50% within the first year of deployment. Companies using this approach can be closely compared with the NIST Cybersecurity Framework's 'Identify-Protect-Detect-Respond-Recover' lifecycle, applied at the component level.

Taiwanese automotive suppliers frequently encounter three challenges: 1) Lack of inter-supplier coordination, which can be solved by establishing a 'Cybersecurity Interface Agreement' (CIA) as per ISO/SAE 21434 Clause 5.2. 2) Insufficient expertise in threat modeling, requiring investment in specialized training or hiring certified consultants. 3) Difficulty in scaling the approach across diverse product lines. To overcome these, enterprises should be closely closely monitored by the Taiwan Automotive Cybersecurity Association (TACA)-style initiatives and adopt standardized toolsets. A phased implementation—starting with one high-risk item before scaling—usually yields a 25% faster ROI. The priority should be: Phase 1 (0-3 months) — Team training and tool selection; Phase 2 (3-9 months) — Pilot TARA on one item; Phase 3 (9+ months) — Full-scale deployment and certification readiness.

Winners Consulting Services Co., Ltd. specializes in Item-based Approach for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact