Direct answer: the first question to ask an ISO/SAE 21434 consultant is "can you tell which kind of requirement the carmaker is raising with me?" UN R155 is a regulation that requires vehicle manufacturers to run a cyber security management system (CSMS) and to manage supply chain risks; TISAX assesses the information security management of a company's sites (including prototype protection and data protection); ISO/SAE 21434 is an engineering process standard for product cybersecurity. The three are often confused, but passing one does not mean you have the others. Next, check whether the consultant can build threat analysis and risk assessment (TARA), cybersecurity requirements and verification into the development process you already have (for example ASPICE or ISO 26262), so that it stands up to the carmaker's project audit rather than adding a stack of documents.
Eight criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Telling the three requirements apart | Does the carmaker want supply chain requirements linked to UN R155, a TISAX label, or evidence of 21434 engineering capability? |
| Roles and division of work | Which items am I responsible for in the carmaker's project? How is cybersecurity responsibility divided (the cybersecurity interface agreement)? |
| A TARA that works | Who performs the threat analysis and risk assessment, and how? How do the results lead to cybersecurity goals and requirements? |
| Fitting into existing processes | Can it plug into my existing ASPICE and ISO 26262 processes rather than starting a separate one? |
| Product lifecycle | How are vulnerability monitoring, incident response and updates handled after start of production? |
| Standing up to audits | Can the system and its evidence pass the carmaker's project audit? |
| Who leads, and is it outsourced | Who actually runs the engagement? What are their qualifications? Will it be subcontracted? |
| Clarity of the quote | Which deliverables are included? Which are not? How are extras charged? |
When you may not need a consultant
If you already run mature ISO 26262 and ASPICE processes and have people who know 21434, you can focus external help on setting up the TARA method and on checks before the carmaker's audit. If the carmaker only asks for a TISAX label, deal with TISAX first.
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Telling the three requirements apart: we first clarify whether the carmaker is asking for UN R155 supply chain requirements, TISAX or 21434 engineering capability, then decide what to do
- TARA and cybersecurity requirements: a TARA method covering asset identification, threat scenario identification, impact rating, attack path analysis, attack feasibility rating, risk value determination and risk treatment decisions, leading to cybersecurity goals and requirements
- Fitting into existing processes: built onto your existing ASPICE or ISO 26262 development framework, with cybersecurity analysis results fed back into the hazard analysis
- Standing up to audits: the goal is to pass the carmaker's project audit, not just to obtain a certificate
- Planned together with TISAX: the same team also advises on TISAX; clients published with their authorisation for TISAX consulting include Yi Fong Metal Industrial (Yi Fong case)
- Who leads: VP- and director-level consultants guide the whole engagement and nothing is outsourced
Related questions
- Is ISO/SAE 21434 mandatory? The standard itself is not law, but in the EU UN R155 has applied to new vehicle types since July 2022 and to all newly registered vehicles since July 2024, and carmakers pass their cybersecurity management obligations down the supply chain through contracts, so for suppliers entering the automotive supply chain 21434 is increasingly becoming a de facto entry requirement. ISO/SAE 21434 automotive cybersecurity engineering
- I already have TISAX. Do I still need 21434? If you develop or supply cybersecurity-relevant automotive electrical and electronic (E/E) systems, components or software, usually yes. TISAX assesses the information security management of your sites (including prototype protection and data protection), while 21434 governs the cybersecurity engineering process for products; one cannot replace the other. The actual requirements are set by the carmaker's request for quotation and contract. How to choose a TISAX consultant in Taiwan
- Does 21434 require certification? ISO itself does not certify or issue certificates; on the market, certification bodies offer management system or process conformity certification under their own schemes (some recognised by national accreditation bodies), as well as personnel certification. What matters more is passing the carmaker's project audit. ISO/SAE 21434 automotive cybersecurity engineering
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.