# ISO/SAE 21434 that survives the audit and the attacker.

> ISO/SAE 21434 is the international standard for cybersecurity engineering of road vehicles. It requires a Cybersecurity Management System (CSMS), a Threat Analysis and Risk Assessment (TARA) for each item, cybersecurity requirements, verification and validation, and monitoring after production. It is the common way to meet UN Regulation No. 155 for type approval. Zyberum offers gap analyses, CSMS implementation, TARA, test planning and audit preparation, combined with hands-on ECU penetration testing.

ISO/SAE 21434 consulting by certified experts: gap analysis, CSMS implementation, TARA, verification and audit preparation for UN R155. With real testing.

Source: https://zyberum.com/iso-21434-consulting

A cybersecurity management system on paper does not stop anyone. We build your CSMS and your TARA from the attacker’s side: with people who pentest ECUs every week and hold the SAE and TÜV SÜD Automotive Cybersecurity Certification.

## From gap analysis to audit

### Gap analysis

Your processes against the clauses of ISO/SAE 21434, with a prioritised roadmap and realistic timelines.

### CSMS implementation

Policies, roles, competence management and continuous improvement that fit how your teams actually work.

### TARA

Assets, damage and threat scenarios, attack feasibility, risk values and treatment decisions, based on how ECUs are really attacked.

### V-model integration

Cybersecurity activities placed into your existing development lifecycle, from concept to production.

### Verification & validation

Test strategy, test cases derived from the TARA, penetration testing and fuzzing as validation evidence.

### Audit preparation

Cybersecurity case, assessment report and traceability from requirement to evidence, reviewed before the auditor does.

## How a project runs

1. **Current state** We assess your processes, tools and documents against the standard and establish the baseline.
2. **Process design** Compliant processes tailored to your organisation, with templates that connect to your PLM and ALM tools.
3. **Pilot with coaching** A real TARA and cybersecurity case on one of your projects, so your team learns by doing.
4. **Audit support** We review all work products, prepare your team and support you during the audit.

## A TARA written by people who attack ECUs

Attack feasibility ratings are only as good as the experience behind them. We rate them from practice: we know how long it takes to get firmware out of an ECU, and which diagnostic services fall first.

The same team can then test what the TARA predicts, by hand or automated with AutoST, and feed the results back as verification evidence. That closes the loop the standard asks for.

**Deliverables**

- Gap analysis report with roadmap
- CSMS documentation: policies, roles, procedures
- TARA method and templates
- Cybersecurity case template and example
- Test plan with derived test cases
- Audit preparation package

## FAQ

**What is a TARA?**

A Threat Analysis and Risk Assessment is the core method of ISO/SAE 21434. It identifies assets, derives damage and threat scenarios, rates attack feasibility and impact, and determines risk values that drive cybersecurity goals and requirements.

**Do suppliers need ISO/SAE 21434?**

UN R155 obliges the vehicle manufacturer, who passes the requirements to suppliers by contract through a Cybersecurity Interface Agreement. In practice, Tier-1 and Tier-2 suppliers must provide a TARA, requirements and test evidence for their component.

**How long does it take to implement a CSMS?**

For a supplier starting from an existing quality or safety process, typically six to twelve months to audit readiness, with the first pilot project in parallel.

**Is there a course for our team?**

Yes, a one-day ISO/SAE 21434 compliance course with a hands-on TARA exercise, in-house or remote.

---
Zyberum GmbH. Canonical page: https://zyberum.com/iso-21434-consulting