SAE J3061 (Cybersecurity Guidebook for Cyber-Physical Vehicle Systems)
SAE J3061 (“Cybersecurity Guidebook for Cyber-Physical Vehicle Systems”) is a Recommended Practice from SAE International, issued in January 2016. It was the first guidebook to describe cybersecurity across a vehicle’s entire lifecycle. Today ISO/SAE 21434 has replaced it.
What is in SAE J3061?
J3061 describes a framework for the cybersecurity process. It covers the concept phase, production, operation, service and decommissioning. Each organisation is meant to tailor it to its own development process. It also sets out guiding principles for secure vehicle systems and gives an overview of common tools and methods.
The appendices take up a lot of space. They present techniques for threat analysis and risk assessment, threat modeling and vulnerability analysis, such as attack trees. Other appendices list sample controls based on NIST SP 800-53, vulnerability databases, security test tools and research projects since 2004.
Guidebook, not requirements
J3061 is a guidebook. For risk analysis it puts several methods side by side and leaves the choice to the user.
ISO/SAE 21434 goes further. The standard defines which steps a Threat Analysis and Risk Assessment (TARA) consists of and what each step delivers. It asks for work products that a customer can request from its supplier. That makes analyses from different companies easier to compare.
Status today
On its product page, ISO describes ISO/SAE 21434 as the replacement for the earlier SAE guideline J3061. SAE set J3061 to “Stabilized” in December 2021. The document has not been withdrawn, but it is no longer reviewed regularly.
For type approval under UNECE R155, J3061 plays no role. The regulation does not prescribe a standard. In its 2021 text it mentions ISO/SAE 21434 only in a footnote.
J3061 in a specification
If J3061 still shows up in a specification or a process description, it is worth asking whether ISO/SAE 21434 is meant. The successor took over J3061’s basic idea: cybersecurity is a process across the whole lifecycle, not a one-off check. It adds binding work products and a uniform TARA method.
The article What Is a TARA? walks through a TARA under ISO/SAE 21434 step by step. Our Cyber Security page shows how itemis SECURE supports this analysis.