Security Relevance Evaluation

A key initial step defined in the ISO 21434 "Road vehicles — Cybersecurity engineering" standard. Its core purpose is to systematically determine if an "item" (a system, component, or function in a vehicle) is relevant to cybersecurity. According to Clause 8.5 of ISO 21434, this evaluation analyzes the item's connectivity, data processing capabilities, and potential for modification. If the outcome is "not relevant," no further cybersecurity activities like Threat Analysis and Risk Assessment (TARA) are required for that item. In the risk management framework, SRE acts as a crucial filter preceding TARA. It answers the question "IF" security resources are needed, whereas TARA focuses on "HOW" to manage the identified risks.

In practice, implementation follows these steps: 1. Item Definition: Clearly define the system (e.g., an infotainment unit), its functions, architecture, and all interfaces. 2. Relevance Criteria Analysis: Systematically check the item against criteria guided by ISO 21434 Annex B. Does it have external interfaces like Bluetooth? Can it process personal data? Can its firmware be updated? A "yes" to any of these typically deems it relevant. 3. Decision & Documentation: Document the analysis, rationale, and final decision in the Cybersecurity Case for auditing. For instance, an OEM used this to classify a non-connected mechanical seat adjuster as "not relevant," saving significant engineering hours by skipping a full TARA and focusing resources on high-risk connected ECUs, improving their UN R155 audit success rate.

Taiwan enterprises face three main challenges. First, Lack of Integrated Development Processes: Many suppliers separate security from functional development, preventing SRE from being effectively applied in early project stages. Second, Supply Chain Complexity: Incomplete information from upstream suppliers makes it difficult for OEMs or Tier-1s to conduct accurate SREs on integrated items. Third, Talent and Experience Gap: A shortage of professionals skilled in ISO 21434 and SRE leads to inconsistent assessments. To overcome this, enterprises should integrate SRE into the requirements phase, use Cybersecurity Agreements to ensure information flow, and engage external experts for initial training and process setup to build internal capabilities quickly.

Winners Consulting specializes in security relevance evaluation for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact