ISO 21434 Compliance and UN R155 Readiness: An ISO/SAE 21434 Gap Assessment for Vehicle Makers and Suppliers
ISO 21434 is the standard vehicle makers use to show cybersecurity is engineered into every ECU, sensor, and line of code. It underpins the cybersecurity management system UN R155 requires before a vehicle can be sold in the EU, the UK, Japan, and other markets. Accredify Global runs an independent gap assessment against your real projects. You get a tailored proposal after a free scoping review.
What Is ISO 21434?
ISO 21434, published as ISO/SAE 21434:2021, is the international standard for cybersecurity engineering of road vehicles. It sets requirements for managing cyber risk in vehicle electrical and electronic systems. Those requirements run from concept and development through production, operation, and decommissioning. It applies to vehicle makers and to every supplier whose components or software end up in the vehicle.
ISO 21434 is a process standard. It does not prescribe specific technology or encryption. Instead it asks you to find threats, rate the risk, and show the controls and testing that bring that risk down.
Accredify Global does not issue certificates for this standard or UN R155 approvals. We provide an independent ISO 21434 gap assessment and R155 readiness review. We also certify the ISO 27001 information security systems many automotive suppliers run alongside it.
ISO 21434 and UN R155 in 2026: Editions, Deadlines, and Who Certifies What
ISO/SAE 21434:2021 is the current edition. ISO and SAE International published it on 31 August 2021, through ISO/TC 22/SC 32. It is now under ISO's routine systematic review, which decides whether a revision is needed.
There is no accredited ISO 21434 certificate. It is not a management system standard, and no IAF-accredited certification scheme exists for it. ISO/PAS 5112:2022 gives guidance for auditing cybersecurity engineering against it.
UN R155 is where the legal requirement sits. The vehicle maker needs a CSMS certificate of compliance from an approval authority, valid for up to three years. In the EU, R155 has applied to new vehicle types since July 2022 and to all new vehicles since July 2024. China's GB 44495-2024 has applied to new type approvals since 1 January 2026.
Sources: ISO/SAE 21434:2021 (ISO) · ISO/PAS 5112:2022 (ISO) · GB 44495-2024 (TÜV SÜD)
Who Needs ISO 21434 Compliance?
Vehicle makers carry the R155 obligation, then pass cybersecurity requirements down the supply chain.
OEMs that need a CSMS certificate before vehicle type approval.
ECU, ADAS, braking, and powertrain suppliers. See ISO certification for automotive.
Microcontrollers, secure elements, and sensors built for vehicle use.
Connectivity units, head units, and cloud back ends that talk to the car.
Operating systems, middleware, and over-the-air update platforms.
Onboard chargers and battery systems. See ISO for electronics.
ISO 21434 Requirements, Clause by Clause
ISO/SAE 21434 sets its requirements in clauses 5 to 15. These are the work products we look for in each.
| Clause | What it covers | What we look for |
|---|---|---|
| 5. Organizational | Cybersecurity policy, rules, culture, and information sharing | A cybersecurity policy with named roles and an audit of the organization |
| 6. Project | Cybersecurity plan, case, and assessment per project | A plan and cybersecurity case for a live project |
| 7. Distributed | Work shared with suppliers and customers | Signed cybersecurity interface agreements |
| 8. Continual | Monitoring, event evaluation, and vulnerability management | A working route from threat intelligence to fixes |
| 9. Concept | Item definition, goals, and cybersecurity concept | Goals traced to a TARA on the item |
| 10. Development | Design, integration, and verification | Requirements traced into design and test results |
| 11. Validation | Validation at vehicle level | Evidence that goals are met, including penetration testing |
| 12. Production | Controls in manufacturing | Secure key injection and flashing at the line |
| 13. Operations | Incident response and updates in the field | An incident response plan that has been exercised |
| 14. End of support | End of cybersecurity support and decommissioning | Customers told when support ends |
| 15. TARA methods | Threat analysis and risk assessment | A consistent method used across projects |
How a TARA Works: Threat Analysis and Risk Assessment
Auditors and approval authorities spend the most time here. So does our gap assessment.
How It Compares: UN R155, R156, ISO 26262, TISAX, and ISO 27001
Automotive suppliers often face all of these at once. Here is what each one covers.
| Standard or rule | What it covers | How it relates to ISO 21434 |
|---|---|---|
| UN R155 | Mandatory CSMS and vehicle type cybersecurity | The usual way to meet it |
| UN R156 and ISO 24089 | Software update management | Same approach, applied to updates |
| ISO 26262 | Functional safety of vehicle electronics | Safety faults vs deliberate attacks; run side by side |
| TISAX | Information security in your company | Protects your data and sites; the vehicle standard protects the product |
| ISO 27001 | Information security management system | An accredited certificate that supports TISAX and R155 back ends |
| IATF 16949 | Automotive quality management | Quality processes that cybersecurity work plugs into |
How to Get Ready for a UN R155 or Customer Cybersecurity Audit
Six stages from first look to a customer or approval authority audit. We lead the assessment; your engineers and your customer own the rest.
Facing a customer cybersecurity audit or a type approval date? A free scoping review shows what needs doing first.
Book a free scoping reviewWhat You Receive From the Gap Assessment
Every requirement in the standard rated as met, partly met, or missing.
Your method and one real TARA checked for coverage and consistency.
Your CSMS mapped to what an approval authority asks to see.
Interface agreements and supplier evidence traced end to end.
Gaps ordered by customer and regulatory risk, so you fix the right things first.
A short report for management, with a view on audit readiness.
ISO 21434 Gap Assessment Cost and Timeline
There is no list price. A free scoping review gives you a tailored proposal for the gap assessment.
What drives the cost
- Products: how many items or components are in scope
- Teams: development sites and engineering groups
- Supply chain: suppliers sharing cybersecurity work
- Regulation: whether R155 or GB 44495 readiness is included
- Starting point: an existing ISO 27001 or TISAX setup helps
What sets the timeline
| Assessment | Planned around releases |
|---|---|
| Closing gaps | Depends on the gap list |
| Project evidence | One live project, start to finish |
| External audit | Set by your customer or authority |
Frequently Asked Questions About ISO 21434
Straight answers on certification, UN R155, TARA, CALs, cost, and timeline.
What is ISO 21434?
ISO/SAE 21434 is the international standard for cybersecurity engineering of road vehicles. It sets requirements for managing cyber risk in vehicle electrical and electronic systems across the lifecycle, from concept to decommissioning. ISO and SAE International published it jointly in August 2021.
Is there an accredited ISO 21434 certification?
No. It is an engineering process standard, not a management system standard. There is no IAF-accredited certification scheme for it. Some assessment bodies issue their own statements of conformity, and ISO/PAS 5112 gives guidance for auditing against it.
Does Accredify Global issue ISO 21434 certificates?
No. We run an independent gap assessment and UN R155 readiness review. The CSMS certificate of compliance under UN R155 comes from a vehicle approval authority, not from us.
Is ISO 21434 mandatory?
ISO/SAE 21434 itself is voluntary. UN R155 is mandatory in the markets that apply it, such as the EU, the UK, Japan and South Korea. Most vehicle makers use the standard to show their cybersecurity management system meets R155.
What is the difference between ISO 21434 and UN R155?
UN R155 is a regulation that requires a certified cybersecurity management system and secure vehicle types. The standard describes how to engineer cybersecurity. R155 says what must be achieved, and the standard is the usual way to show how.
When did UN R155 become mandatory in the EU?
For new vehicle types from July 2022, and for all newly registered vehicles from July 2024. Vehicles without R155 approval can no longer be registered in the EU.
Who needs ISO 21434 compliance?
Vehicle makers, and Tier 1 and Tier 2 suppliers of ECUs, sensors, telematics, infotainment, and software. Vehicle makers pass these requirements to suppliers through cybersecurity interface agreements.
What is a TARA in ISO 21434?
TARA stands for threat analysis and risk assessment. Clause 15 of the standard describes the methods: identify assets, threat scenarios, impact, attack paths and attack feasibility. Then decide how to treat each risk.
What is a CAL in ISO 21434?
A cybersecurity assurance level, from CAL 1 to CAL 4. It is an informative concept in Annex E that sets how much rigor a component needs. Higher CALs need more thorough verification and testing.
How is ISO 21434 different from ISO 26262?
ISO 26262 covers functional safety, meaning faults that could cause harm. The cybersecurity standard covers deliberate attacks. The two are often run side by side, with shared interfaces between safety and security analyses.
How is ISO 21434 different from TISAX?
TISAX assesses information security in your company, based on the VDA ISA catalog. The automotive standard covers the cybersecurity of the vehicle and its components. Many suppliers need both.
What is ISO 24089?
ISO 24089:2023 covers software update engineering for road vehicles. It supports UN R156, the regulation on software update management systems, in the same way ISO 21434 supports R155.
Does China require vehicle cybersecurity compliance?
Yes. GB 44495-2024 applies to new vehicle type approvals from 1 January 2026. Vehicles approved before then must comply by 1 January 2028.
How long does ISO 21434 readiness take?
It depends on your gaps. Suppliers with mature engineering processes may need a few months to close findings. Building a full cybersecurity management system from scratch usually takes much longer.
How much does an ISO 21434 gap assessment cost?
There is no list price. Cost depends on how many products, sites and development teams are in scope, and whether R155 readiness is included. A free scoping review gives you a tailored proposal.
Know Your Cybersecurity Gaps Before Your Customer Does
Tell us about your products, customers, and deadlines. We'll scope a gap assessment and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global certification team.