Holistic protection and seamless traceability for cybersecurity, functional safety, and the Cyber Resilience Act
Overview
Methodological excellence and tailored tools for model-based system and software engineering.
Overview
Enterprise software from a single source: AI integration, legacy migration and full-stack development — cost-efficiently and sovereignly hosted.
Overview
Cybersecurity is no longer optional for connected products: it is a market access requirement. In the automotive sector, UNECE regulation R155 makes a Cybersecurity Management System (CSMS) a condition for type approval. In the industrial environment, IEC 62443 sets the benchmark for plants, controls and critical infrastructure. Both worlds share the same logic: systematically assess threats, demonstrate security across the entire lifecycle and document it in an audit-ready way. Anyone building products with software and interfaces cannot avoid one or both standards.
ISO/SAE 21434 «Road vehicles — Cybersecurity engineering» (published in August 2021) describes a continuous cybersecurity engineering process across the entire vehicle lifecycle: from concept and development through production and operation to decommissioning.
It applies to electrical and electronic systems in road vehicles, their components and interfaces. It is binding for OEMs as well as the entire supply chain: Tier-1 and Tier-2 suppliers must demonstrably fulfil their contribution to vehicle cybersecurity.
The Tier-1 inherits the OEM’s requirements and must fulfil them demonstrably, often for many variants in parallel. This is exactly where a consistent, reusable TARA becomes either a bottleneck or a competitive advantage.
The Threat Analysis and Risk Assessment (TARA) is the heart of ISO 21434. It identifies assets worth protecting, derives threat scenarios, assesses damage potential and attack probability, and prioritises the security measures from these.
In practice, TARA rarely fails at the concept level: it fails at scope and maintenance. Spreadsheet-based TARAs age quickly, quality varies depending on who carries them out, and every change effectively restarts the assessment from scratch.
itemis SECURE makes the TARA model-based: threats, attack paths and measures are anchored to a consistent model. AI Assistants propose threats and attack trees, and changes propagate through the model instead of being manually tracked. According to itemis, agentic automation reduces TARA effort by up to 80 %, with full human-in-the-loop control.
The same TARA methodology also underpins the Cyber Resilience Act: details in the spoke Cyber Resilience Act.
ISO 21434 is a standard; R155 is mandatory. UN Regulation No. 155 requires a demonstrated Cybersecurity Management System for type approval. ISO 21434 is the technical framework manufacturers use to provide this proof.
The deadlines
Without a robust CSMS and without documented TARA, there is no type approval, and therefore no market access. This shifts cybersecurity from a technical recommendation to a commercial prerequisite.
Where ISO 21434 addresses the vehicle, IEC 62443 covers operational technology: industrial controls, automation systems, energy supply and critical infrastructure. The standard series addresses all roles, from component manufacturer through system integrator to the asset owner who operates the plant.
The fundamental principle is segmentation. Assets with similar protection needs are grouped into zones; communication between zones runs via controlled conduits. This creates a defensible architecture instead of a flat network, often oriented around the Purdue model of manufacturing levels.
Important: the security level is not a single value but a vector across seven foundational requirements. Each zone and each conduit receives its own protection level, derived from the risk, not imposed uniformly.
The short answer: ISO 21434 for road vehicles and their components, IEC 62443 for industrial automation and OT. The longer answer is more interesting, because many manufacturers need both today.
A supplier building control units for vehicles and for industrial plants faces both standards simultaneously. The good news: the methodological basis is related. Both work risk-based, both require security across the lifecycle, both rely on structured threat analysis.
And both feed into the Cyber Resilience Act, which sits above both as a horizontal EU regulation. Whoever sets up their TARA methodology cleanly once serves ISO 21434, IEC 62443 and CRA from one model, instead of maintaining three separate compliance worlds. For products that simultaneously require ISO 26262 and IEC 61508, HARA and TARA share the same system boundary: safety protects the environment from the system, security protects the system from the environment.
itemis SECURE is the model-based platform for both standards. Instead of fragmented spreadsheets, a living security model is created: TARA, risk assessment, measure tracking and reporting in one tool, with AI support for threat intelligence and attack trees, and with documentation that passes an audit.
The lever is reuse and maintenance. A TARA modelled once can be scaled across variants, new vulnerabilities flow into the model, and the compliance evidence is a by-product of the work, not a separate effort before the audit.
The AI support is not a bolted-on add-on. The agentic capabilities sit on a deterministic model layer, so the AI does not work in a vacuum but uses the complete TARA context. Via the Cybersecurity Lifecycle Integration, the system connects requirements, architecture components and software vulnerabilities with end-to-end traceability directly in the security model. The heavy lifting runs automated, the expert retains control, and every conclusion is grounded in real engineering data.
| Pillar | Function | Benefit |
|---|---|---|
| Lifecycle Management | End-to-end security traceability across development and product lifecycle | Eliminates virtually all manual documentation work for audits |
| Model-Based Governance | Industry-specific rule sets, plausibility and consistency checks | AI suggestions comply with guidelines and regulatory requirements |
| Agentic Automation | Context-aware, automated generation of TARA elements with human-in-the-loop | Up to 80 % less TARA time |
| Live Vulnerability Sync | Continuous triage of SBOM components and CVEs | Living documents for ISO/SAE 21434, IEC 62443 and CRA |
According to itemis, agentic automation reduces TARA effort by up to 80 %, with full human-in-the-loop control. This way even small teams maintain a living security posture and serve ISO/SAE 21434, IEC 62443 and CRA from one model.
itemis SECURE is used by cybersecurity teams in automotive and industry, including ZF, AVL and Sygic.
Excel template for CRA risk analysis: TARA in line with ISO 21434 and IEC 62443 — how to start methodically, what you can import, and when Excel becomes the bottleneck.
Read Article
Jens Bühl
6 min read
A TARA is not a threat catalogue — it is an auditable record of risk decisions: what it involves, how the process works, and when Excel reaches its limits.
Read Article
Jens Bühl
6 min read
In the automotive domain, security is becoming more and more important – especially for the new generations of connected, (semi-)autonomous vehicles. Learn how to develop a secure system design and which additional security challenges may arise.
Read Article
Dirk Leopold
9 min read
In times of Spectre and Meltdown it's totally clear that security is a big engineering challenge. Learn more about safety and security in this post.
Read Article
Dirk Leopold
8 min read
The increased share of software solutions places high demands on Automotive Security. But what changes are coming for the industry and manufacturers?
Read Article
Dirk Leopold
5 min read
How leading OEMs and Tier-1 suppliers unite Functional Safety and Cyber Security enterprise-wide — without disrupting proven engineering environments.
Download Whitepaper
