ISO 21434 Training

Lesson 1 • Evolution of Connected Vehicle Systems

Traces the shift from isolated ECUs to networked vehicle architectures. Provides context for understanding why cybersecurity risks have grown alongside connectivity.

Lesson 2 • Cybersecurity Risks and Consequences

Examines real-world attack scenarios and their safety, financial, and reputational impacts. Grounds abstract risk concepts in documented automotive incidents.

Lesson 3 • Regulatory and Standards Landscape

Surveys the global regulatory environment driving automotive cybersecurity compliance. Positions ISO 21434 within the broader ecosystem of vehicle safety standards.

Lesson 1 • Information Security Management Integration

Examines how automotive cybersecurity management aligns with broader information security practices. Reduces duplication by mapping overlapping controls across management systems.

Lesson 2 • Management System Auditing and Review

Teaches internal audit planning, execution, and management review processes for cybersecurity governance. Prepares learners to demonstrate ongoing compliance to auditors.

Lesson 3 • Organisational Cybersecurity Policy

Covers the elements of a cybersecurity policy and how leadership commitment is documented. Links policy structure to clause requirements for organisational governance.

Lesson 4 • Cybersecurity Culture and Awareness

Addresses training programmes, awareness campaigns, and cultural indicators that sustain a security-conscious workforce. Connects human factors to systemic cybersecurity performance.

Lesson 1 • Item Definition and Boundary Setting

Guides learners through defining the item under development and its operational environment. Accurate item definition is prerequisite to all subsequent risk analysis activities.

Lesson 2 • Cybersecurity Plan Development

Covers mandatory plan elements including activities, milestones, resources, and evidence artefacts. Connects planning outputs to project lifecycle gates and review checkpoints.

Lesson 3 • Tailoring and Reuse Decisions

Addresses how to adapt standard activities for project context and leverage prior cybersecurity work. Teaches the criteria for justified tailoring without compromising compliance.

Lesson 1 • Asset Identification and Security Properties

Teaches systematic identification of cybersecurity-relevant assets and their confidentiality, integrity, and availability properties. Forms the analytical foundation for damage scenario development.

Lesson 2 • Attack Feasibility Rating

Explains the ISO 21434 attack feasibility rating methods and their application to scored attack paths. Enables consistent, defensible feasibility determinations across project teams.

Lesson 3 • Threat Scenario and Attack Path Analysis

Guides learners through identifying threat scenarios and modelling attack paths using structured techniques. Links threat actors, entry points, and attack steps to damage scenarios.

Lesson 4 • Damage Scenario and Impact Analysis

Covers construction of damage scenarios and rating their impact across safety, financial, operational, and privacy dimensions. Produces the impact ratings used in risk determination.

Lesson 1 • Requirements Derivation and Specification

Teaches techniques for deriving verifiable cybersecurity requirements from goals and concepts. Applies quality criteria such as completeness, testability, and unambiguity.

Lesson 2 • Cybersecurity Claim and Concept Development

Explains how cybersecurity concepts translate goals into architectural and design strategies. Bridges high-level goals to concrete technical and organisational countermeasures.

Lesson 3 • Cybersecurity Goal Formulation

Covers the derivation of cybersecurity goals from risk treatment decisions and their linkage to damage scenarios. Goals form the top-level security objectives for the item.

Lesson 1 • Secure Design Principles for Vehicles

Introduces foundational secure design principles applicable to automotive hardware and software. Provides a principled basis for evaluating design choices against security objectives.

Lesson 2 • Software Cybersecurity Controls

Addresses secure coding practices, memory protection, and software integrity verification for automotive software. Connects software controls to requirement traceability.

Lesson 3 • Communication Security in Vehicle Networks

Examines security mechanisms for in-vehicle and external communication channels including authentication and encryption. Addresses protocol-specific security considerations.

Lesson 4 • Hardware Cybersecurity Controls

Covers hardware-level security mechanisms including secure boot, hardware security modules, and tamper protection. Links hardware controls to specific cybersecurity requirements.

Lesson 1 • Penetration Testing for Automotive Systems

Teaches penetration testing methodology adapted for automotive ECUs, networks, and external interfaces. Produces structured findings that feed back into the TARA and design processes.

Lesson 2 • Vulnerability Analysis Methods

Introduces structured vulnerability analysis techniques applicable at design and implementation stages. Connects identified vulnerabilities to risk treatment and requirement updates.

Lesson 3 • Verification Planning and Strategy

Covers the development of a cybersecurity verification plan aligned with project milestones and requirement coverage. Defines the scope, methods, and acceptance criteria for verification.

Lesson 4 • Cybersecurity Validation and Case Closure

Addresses validation activities that confirm the item meets its cybersecurity goals in the operational context. Produces the cybersecurity case and release recommendation.

Lesson 1 • Cybersecurity Incident Response

Defines the incident response lifecycle for automotive cybersecurity events from detection to closure. Prepares learners to lead or support structured incident response activities.

Lesson 2 • End-of-Life and Decommissioning

Covers cybersecurity obligations at product end-of-life including data deletion and support termination. Ensures residual risks from decommissioned products are identified and mitigated.

Lesson 3 • Vulnerability Management in the Field

Covers triage, prioritisation, and remediation of vulnerabilities discovered in fielded products. Connects field vulnerability management to TARA updates and patch deployment.

Lesson 4 • Cybersecurity Monitoring and Intelligence

Establishes processes for continuous monitoring of deployed vehicles and collection of threat intelligence. Feeds monitoring outputs into vulnerability management and incident response.