A carmaker mentions UN R155, TISAX and ISO/SAE 21434 together. How does the CISO divide the work?
They are often confused, but in practice they are three parallel supplier requirements:
| Requirement | Nature | What it covers |
|---|---|---|
| UN R155 | Regulation; whole-vehicle type-approval requirement | The carmaker's cyber security management system (CSMS) and supply chain accountability |
| TISAX | Information security assessment | Information protection at company sites (including prototype and data protection) |
| ISO/SAE 21434 | Engineering process standard | How products are developed securely |
Passing TISAX does not show 21434 capability, and vice versa. R155 is borne by carmakers, who usually pass requirements to component makers by contract.
Is ISO/SAE 21434 mandatory? How does the CISO justify the investment?
The standard itself is not legally mandatory. But in the EU, UN R155, a whole-vehicle type-approval requirement, has applied to new vehicle types since July 2022 and to all newly produced vehicles since July 2024; without compliance a carmaker cannot obtain type approval. Carmakers pass their CSMS obligations down the supply chain by contract.
For companies entering the automotive supply chain, 21434 is a de facto entry requirement: carmakers use it to review suppliers' secure development capability (TARA, cybersecurity concept, development and verification, incident response), and Tier 1 and Tier 2 suppliers without a matching system do not get into development projects. The actual requirement follows the carmaker's request for quotation and contract.
21434 has no official certificate. How does the CISO prove capability to carmakers?
ISO itself does not certify or issue certificates; in the market, certification bodies offer management system or process conformity certification under their own schemes, and personnel certification also exists. What matters more is passing the carmaker's development project audit.
The CISO prepares work products that can be sampled:
- TARA records
- Cybersecurity goals and requirements derived from TARA
- Development and verification evidence
- Incident response procedures
The aim is a system that survives carmaker audits, not just a certificate.
Who performs TARA, and how do the CISO and R&D divide the work?
TARA is the technical core of 21434: asset identification, threat scenarios, attack feasibility and impact rating, and risk treatment decisions, from which cybersecurity goals and requirements are derived and carried through V-model development and verification.
- First clarify which items the company is responsible for in the carmaker's project and how cybersecurity responsibilities are split (the cybersecurity interface agreement).
- Organisations with ASPICE or ISO 26262 processes can add 21434 incrementally to the existing development framework instead of building a separate one.
- 26262 deals with hazards caused by faults, 21434 with hazards caused by attacks; when integrated, cybersecurity analysis results feed back into the safety hazard analysis.
What does the CISO still manage after start of production, and does the EU CRA apply to automotive products?
21434 covers the whole lifecycle from concept, development and production to operation, maintenance and decommissioning, so post-production vulnerability monitoring, incident response and updates also need an owner.
On the CRA: ECUs in type-approved vehicles are outside the CRA (Article 2(2)(c)); their cybersecurity is governed by UN R155/R156, which are whole-vehicle type-approval requirements. Aftermarket and separately sold connected automotive products must still comply with the CRA. Treating ISO 26262 as proof of cybersecurity, or assuming in-vehicle ECUs need the CRA, exposes gaps in carmakers' supply chain security reviews.
We already have TISAX. Which documents can 21434 share?
TISAX and 21434 can be supported together. The keys are:
- A shared security policy framework
- Unified supplier management requirements
- No duplicated risk assessment processes
The optional 21434 integration step in the TISAX engagement shares the security policy framework and risk assessment groundwork to avoid building twice. But one cannot replace the other: what is shared is organisation-level documentation, while product TARA, cybersecurity requirements and development and verification evidence must still be built under 21434.
How does Winners Consulting help a CISO with ISO/SAE 21434?
Winners Consulting's approach (test us with the questions above too):
- VP- and director-level consultants lead in person; nothing is outsourced
- We first clarify whether the carmaker wants UN R155 supply chain requirements, TISAX or 21434 engineering capability
- We set up a TARA method that derives cybersecurity goals and requirements, attached to the existing ASPICE or ISO 26262 framework
- The goal is passing the carmaker's development project audit; the same team supports TISAX, with named clients including Yi Fong Metal Industrial
ISO/SAE 21434 engineering, Choosing a 21434 consultant, TISAX assessment consulting. Apply for a free mechanism diagnosis
How other roles see this service
Other services for this role
- CISO implementing ISO 27001: board reporting, the ESG bonus point and certification scope
- CISO on ISO 27701 and GDPR: cross-border data, employee data and the 72-hour notice
- CISO facing NIS2: are we in scope, and how to handle several EU countries, the board and reporting?
- CISO facing DORA: serving EU financial clients, what to prepare for contracts, reporting and testing
- CISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CISO implementing ISO/IEC 29147: reporting channel, CVD policy and CRA reporting
- CISO guide to ISO/IEC 30111: linking vulnerability handling to CRA reporting
- CISO guide to IEC 62443: which parts to pursue and how it relates to the EU CRA
- CISO guide to TISAX: assessment level, ISA2027 and timeline
- CISO guide to ISO 22301: ICT recovery, RTO and exercises
- CISO guide to ISO 42001: what AI governance shares with ISO 27001
- CISO and the EU AI Act: what do AI security, logs and human oversight require?
- CISO and trade secret protection: designing classification and access logs that hold up