kevinferron.comKevin Ferron

The standards map

Which standard governs which stage of a vehicle program: functional safety, SOTIF, cybersecurity, type approval and process assessment, laid along the lifecycle.

  • ISO 26262
  • ISO 21448
  • ISO/SAE 21434
  • UNECE R155
  • ASPICE

Eight documents come up again and again around a software-defined car. Safety, cybersecurity, software updates, process quality and diagnostics each have their own, and one program meets them all together.

Not all of them are standards. UN Regulations 155 and 156 are regulations: the first requires a cybersecurity management system, the second a software update management system. The ISO standards are bought from ISO, and I use only their public catalogue abstracts. Automotive SPICE is neither; it is a process model from VDA QMC.

Only some of them say where in a vehicle’s life they apply. ISO/SAE 21434 spans concept to decommissioning. UN R155 asks for its management system across development, production and post-production. For R156 and ISO 24089 the placement is my reading of the scope, and I mark it as that. For the rest, the sources say nothing about lifecycle stages, so they sit apart rather than on a guess.

Relationships are the same story. ISO 21448 says what it leaves out: faults that ISO 26262 covers, and cybersecurity threats. ISO says 21434 supports compliance with UNECE regulations, and R155 names 26262, 21448 and 21434 as examples of competence areas. Beyond that, no regulator in my sources says that one standard satisfies another, so the map does not either.

Two things are left out because the sources do not have them: the ASIL levels in ISO 26262, and the release date of Automotive SPICE 4.0.

Concept

Development

Production

Operation

Decommissioning

Stage not given by the sources

Stated by the source Placed by reading the scope No stage given

ISO/SAE 21434: Cybersecurity engineering for road vehicles

standard

A standard published jointly by ISO and SAE. This page uses only the public catalogue abstract.

Edition
Edition 1, 2021-08, 81 pages. The catalogue notes a revision under development.
Where on the lifecycle
Span stated by the sourceThe abstract gives the span itself: concept to decommissioning.ISO/SAE 21434: Catalogue abstract: from concept to decommissioning

What it covers

  • Engineering requirements for cybersecurity risk management across the electrical and electronic lifecycle.ISO/SAE 21434: Catalogue abstract: scope
  • Replaces SAE J3061.ISO/SAE 21434: Catalogue abstract

How the sources connect it to others

  • ISO says it supports compliance with UNECE WP.29 regulations. The sources do not go further than that, so this page does not say that following it satisfies UN R155.ISO/SAE 21434: Catalogue abstract: supports WP.29 compliance
  • UN R155 names it in a footnote as an example of a competence area.UN R155: Footnote naming ISO 26262-2018, ISO/PAS 21448 and ISO/SAE 21434

Sources

  1. UN R155 UN Regulation No 155: Cyber security and cyber security management system. Original text, OJ L 82/30, 9 March 2021.

    • 2.3: CSMS
    • 7.2.2.1
    • Footnote naming ISO 26262-2018, ISO/PAS 21448 and ISO/SAE 21434
    • 2.3: definition of CSMS
    • Scope
    • 7.2.2.1, 6.7 and 7.4.1
    • Annex 5, parts A, B and C

  2. UN R156 UN Regulation No 156: Software update and software update management system. Original text, OJ L 82/60, 9 March 2021.

    • 7.1.1: SUMS
    • Scope; 7.1.1
    • 7.1.1
    • 7.2.1.1 and 7.2.2
    • 6.6
    • 7.1.1 and 7.2.2

  3. Automotive SPICE VDA QMC, Automotive SPICE. as read October 2026 (page names 4.0 and 4.1).

    • Own process reference and assessment model
    • Model description
    • Capability levels; history

  4. ISO/SAE 21434 Road vehicles — Cybersecurity engineering. Ed. 1, 2021 (catalogue abstract).

    • Catalogue abstract: from concept to decommissioning
    • Catalogue abstract: supports WP.29 compliance
    • Catalogue abstract: scope
    • Catalogue abstract

  5. ISO 21448 Road vehicles — Safety of the intended functionality (SOTIF). Ed. 1, 2022 (catalogue abstract).

    • Catalogue abstract: exclusions
    • Catalogue abstract: scope

  6. ISO 26262-1 Road vehicles — Functional safety — Part 1: Vocabulary. Ed. 2, 2018 (catalogue abstract).

    • Catalogue abstract: scope

  7. ISO 26262-9 Road vehicles — Functional safety — Part 9: ASIL-oriented and safety-oriented analyses. 2018 (catalogue entry).

    • Part 9 title

  8. ISO 24089 Road vehicles — Software update engineering. Ed. 1, 2023; Amd 1:2024 (catalogue abstract).

    • Catalogue abstract
    • Catalogue abstract: scope

  9. ISO 17978-1 Road vehicles — Service-oriented vehicle diagnostics (SOVD) — Part 1. Ed. 1, 2026 (catalogue abstract).

    • Catalogue abstract: Part 1

  10. AUTOSAR Adaptive AUTOSAR Adaptive Platform. R25-11.

    • Diagnostic Management: UDS over DoIP and SOVD over HTTP/REST

Everything here is paraphrased from the pinned sources, not quoted, and figures are attributed to them. Anything illustrative is labelled as such. Where a source is silent the page says so instead of filling the gap.