openXSAM (Open eXchange Format of Security Analysis Models)
openXSAM (Open eXchange Format of Security Analysis Models) is an open, XML-based format for exchanging security analyses. It represents the content of a Threat Analysis and Risk Assessment (TARA) under ISO/SAE 21434 in machine-readable form, so it can move between tools, departments and companies.
What is openXSAM needed for?
A TARA rarely stays in one tool. The architecture comes from the modelling tool. The supplier hands its analysis to the OEM. Test teams derive their test plans from the risks. ISO 21434 says which work products must exist. It doesn’t say how they get from one tool into the next. In practice that often means Excel, PDF and retyping.
That’s where openXSAM comes in. Instead of a dedicated interface between every pair of tools, an export on one side and an import on the other is enough.
What is inside an openXSAM file?
The specification splits the data model into modules. A file can hold a complete model or just individual modules, down to single elements.
| Module | Content |
|---|---|
| Item Definition | Functions, components, data, channels and data flows |
| Method Configuration | The assessment model: impact levels, feasibility model, risk matrix |
| Security Analysis | Assumptions, damage scenarios, threat scenarios, attack steps |
| Risk | Risks with their treatment decision |
| Controls | Controls and the elements they act on |
Elements reference each other by name, by their own ID or by an external ID. Name references stay readable and survive changes to the assessment model. Vendor-specific additions go into their own XML namespaces without breaking the core format.
Use cases
The specification names four:
- Sharing risk information, in-house and with partners.
- Deriving test plans from the TARA and mapping test results back to the risks.
- Feeding the risk model into attack surface management and detection & response.
- Composing supplier and OEM TARAs into a vehicle-level TARA. This part is still work in progress.
Origin
openXSAM goes back to XSAM. The format was created in the SecForCARs research project and is in productive use in itemis SECURE. In 2020 itemis turned it into an open, cross-vendor initiative, and in 2022 it became a Technical Committee of the Automotive Security Research Group (ASRG). Version 1.0 of the specification was published in 2023. The specification and XML schemas are public in the ASRG GitHub repository.
The practical limitation
As with ReqIF, the format defines what can be carried. Whether two tools exchange a file without loss only shows in a test with exactly those tools. The XML schemas help here. A file that doesn’t validate isn’t worth importing.
The article The TARA Arrives, Its References Don’t shows what an openXSAM file looks like for the headlamp example from the standard. How itemis SECURE exchanges TARA data is described on our Cyber Security page.