ISO/SAE 21434 · Type Approval · Infotainment · Connected Services

A risk-based standard does not reward switching things on. Every control has to trace back to a threat.

Thirteen other standards on this site reach your JavaScript indirectly, and this one does too. What makes it worth its own page is a reversal that catches teams arriving from checklist regimes: here, a control nobody can connect to an identified threat scenario is not a bonus, it is an unexplained behaviour in a vehicle function. The analysis is the deliverable. The setting is a consequence of it.

The Short Version

Justify, then configure

Four contact points, and the sharpest one is a safety argument rather than a security one.

An unjustified control is a findingEvery control is expected to trace to a threat scenario and a risk value, or to be explained.
Safety content changes the answerEvery failure action except degrade ends by throwing. On a display with a safety role that is a hazard.
Your build record is a deliverableUnder an interface agreement, the manifest and reproducible build flow upward on request.
What The Standard Actually Governs

A process, a risk assessment, and a set of work products

The standard is a description of how to engineer cybersecurity across the life of a vehicle item, from concept through production to the end of support. None of it describes source code style, and no assessor will ask whether your bundle is obfuscated. Knowing which phase a question comes from is most of the work of answering it.

The risk assessment at the centre

Identify the assets and what damage looks like if their properties are lost, derive the threat scenarios that could cause that damage, rate the resulting risk, and decide how each risk is treated. Everything else in the process refers back to this. It is also what makes the standard unusual to work with: the analysis, not the control, is the primary deliverable.

The lifecycle around it

Concept, product development, validation, production, and then operations and maintenance, including monitoring for new vulnerabilities, handling incidents and eventually decommissioning. The post-production phases carry real weight, because a vehicle stays in service far longer than the software practices that built it.

The work products

The process is evidenced by named artifacts produced at each stage rather than by assertion. Your build pipeline can contribute genuine ones, and it is worth knowing which: a reproducible build record, a per-file manifest, a component inventory, and an archived symbol map are all things a reviewer can check rather than believe.

The Reversal

An unjustified control counts against you

This is the section to read if you read only one, because it inverts the instinct that most security work is built on. Breadth is not diligence here. Traceability is.

Why enabling everything is the wrong move

Under a checklist regime, switching on an additional security feature is free or mildly positive, so teams switch on everything and present the breadth as care. Under a risk-based process, each control is expected to trace back to a threat scenario and to have been selected over the alternatives for a stated reason. A guard nobody can connect to a threat scenario is an unexplained behaviour in a vehicle function, and an assessor is entitled to ask what it treats and what happens when it fires.

What a good entry looks like

A threat scenario, the asset and property at stake, the risk rating, the treatment decision, the option chosen, the failure action configured, and the reason that action was chosen over the others. That is a defensible half page. It is also considerably easier to write before the options are enabled than afterwards, which is the practical argument for doing the analysis first rather than retrofitting a justification to a configuration file.

Contact Point One

Where safety and security meet on a display

Head units have quietly become mixed-criticality surfaces. The moment one renders something with a safety role, the calculus around any control that can interrupt it changes completely.

What the failure actions actually do

When a guard in this engine trips it performs the configured failure action. Blanking clears the document element, reloading calls the location reload function, redirecting assigns to location, and each of those paths still ends by throwing. The single exception is the degrade action, which sets a global flag and raises a custom event, leaving your own code to decide what happens next. Knowing this before enabling an option is the difference between a documented decision and a surprise in the field.

Why a display with safety content cannot fail closed

A panel that clears itself during a manoeuvre is not a security outcome, it is a loss of information at the moment it is least affordable, and if the surface renders a camera view or a warning indicator then the control has entered the territory of a safety goal rather than only a security one. Any control able to produce that result has to be weighed against the harm it prevents. If a guard is used on such a surface at all, degrade is the only action worth defending in a hazard analysis.

Contact Point Two

Type approval, updates and the evidence that flows upward

The engineering standard sits underneath a regulatory layer that asks for an audited management system and keeps asking after the vehicle is sold. That changes which parts of your pipeline are in scope.

A management system, not just a project

Approval expects a cybersecurity management system covering development, production and the post-production phase, operating continuously rather than assembled for an audit. Practically, that means your build evidence has to be produced routinely by the pipeline, because evidence generated by hand for one review does not demonstrate a system.

Software updates are separately governed

A distinct regime covers how updates are specified, verified and delivered to vehicles in the field. Being able to state exactly what an update contained, show it was built from the source you claim, and reproduce it afterwards moves from good practice to in-scope requirement.

The interface agreement decides your scope

Where you are a supplier, an agreement allocates the cybersecurity activities between you and the manufacturer and defines what evidence flows upward and when. Your manifest and reproducible build are frequently contractual deliverables. Read it early; discovering the obligation late is a commercial problem rather than a technical one.

Contact Point Three

Serviceability across a fifteen-year support life

This is the requirement teams most often miss, and the one where a protection step can quietly make a product worse if the archive is not treated as part of the deliverable.

Archive the inputs, not only the outputs

A field report can arrive years after a release, against a build made by people who have moved on, using a toolchain that has since changed. What makes it diagnosable is the exact source, the exact configuration including the seed, the symbol map for that build, and a documented way to rebuild it and confirm the reproduction matched. Store those against the release as a deliverable rather than as a build artifact.

Set retention from the programme, not the pipeline

Continuous integration systems default to retention measured in weeks. Vehicle support is measured in years after the last unit is produced. If the two are not reconciled deliberately, the default wins silently, and the first time anyone notices is when a report arrives against a release whose symbol map expired. Match the retention period to the support commitment and record that you did.

Contact Point Four

Scanners, inventories and the ordering rule

Every serious lifecycle expectation includes knowing what third-party code is in your product and being able to respond when a vulnerability is published against it. Protection interacts with that in one specific way.

Run everything that reads code first

Composition analysis identifies dependencies by recognising known code, and transformed output is much harder to recognise, so a scanner pointed at a protected bundle under-reports and hands you a falsely clean picture. Generate the inventory from your dependency manifests and lock files before the protection step. The same ordering applies to static analysis and to licence scanning, and it is covered in detail in obfuscation and your software inventory.

Keep the inventory with the release

An inventory that lives in a pipeline log is not evidence a year later. Attach it to the same release record that carries the manifest and the build seed, so that when a vulnerability is published against a component, answering whether a given vehicle software version contains it is a lookup rather than an investigation.

Questions

Frequently asked questions

Does ISO 21434 require obfuscation of our infotainment JavaScript?

No, and the standard is structured in a way that makes the question slightly the wrong shape. It does not contain a list of mandatory controls at all. It describes a risk-based engineering process: identify assets and their damage scenarios, derive threat scenarios, rate the risk, decide how to treat it, and keep the work products that show you did. A control appears in your file because a risk assessment put it there. So the honest answer is that obfuscation is required exactly when your own analysis concludes it treats an identified risk, and not otherwise, and the analysis is the deliverable rather than the control.

What is different about a risk-based standard compared with a checklist?

An unjustified control counts against you, which surprises teams arriving from checklist regimes. Under a checklist, switching on an extra security feature is free or mildly positive. Under a risk-based process, every control in the product is expected to trace back to a threat scenario and a risk value, and to have been chosen over the alternatives for a stated reason. A runtime guard nobody can connect to a threat scenario is not a bonus, it is an unexplained behaviour in a vehicle function, and an assessor is entitled to ask what it is for and what happens when it fires. Enable less, and document why, rather than enabling everything and hoping breadth reads as diligence.

Where does browser-style code actually appear in a vehicle programme?

In more places than the phrase in-vehicle suggests, and they have different risk profiles. The head unit interface is often built with web technology running in an embedded engine. There is usually a companion mobile application with a substantial web component, a telematics or connected-services portal, a dealer and service tool, and increasingly a web view embedded in the vehicle for third-party content. Each sits in a different place relative to the vehicle network, and treating them as one asset is the most common scoping error. Assess the head unit and the connected-services portal separately, because their damage scenarios have almost nothing in common.

Our head unit renders a rear-view camera view and warning telltales. Does that change our options?

Substantially, and this is the sharpest engineering point on the page. Once a display renders anything with a safety role, a control able to blank or halt that display interacts with a safety goal rather than only with a security one. The failure actions this engine offers are worth knowing precisely before enabling any of them. Blanking clears the document element, reloading calls the location reload function, redirecting assigns to location, and every one of those paths ends by throwing. The single exception is the degrade action, which sets a flag and raises a custom event for your own code to handle. On a display with any safety-related content, degrade is the only action defensible in a hazard analysis, and the reasoning belongs in the file alongside the decision.

How do the environment locks behave in an embedded head unit?

Poorly, because their assumptions are those of a public web page. The domain lock resolves the browser hostname and, when there is no usable value, fires the failure action before consulting your allowlist at all. Content loaded from local storage or an embedded viewer frequently has no meaningful hostname, so the guard fails in exactly the environment you are shipping into. The browser and operating-system locks read the navigator object and take the same failure path when it is absent, and an embedded engine that does not match their patterns classifies as unknown, which is never in an allowlist. These options are built for a site served over the public internet, and a vehicle head unit is not that.

What does type approval add on top of the engineering standard?

An audited management system and a requirement that it keeps operating after the vehicle is sold. The regulation your programme is approved against expects a cybersecurity management system covering development, production and the post-production phase, and a separate software update management system governing how updates are specified, verified and delivered to vehicles in the field. The practical consequence for a build pipeline is that your update evidence matters as much as your development evidence: being able to state exactly what an update contained, prove it came from the source you say it did, and reproduce it later, is directly in scope rather than a nice-to-have.

We are a supplier rather than the manufacturer. What is actually expected of us?

Whatever the interface agreement says, which is why reading it early is worth more than any tool decision. The relationship between manufacturer and supplier is expected to be governed by an agreement that allocates the cybersecurity activities between the parties, names who performs which analysis, and defines what evidence flows upward and when. Your build records are frequently a contractual deliverable rather than an internal artifact. If your pipeline cannot produce a manifest, a reproducible build and a component inventory on request, that becomes a commercial problem at the least convenient point in the programme.

How long do we have to keep the material needed to diagnose a release?

Longer than any build system default, and this is the requirement most often missed. Vehicles are supported for many years after the last one is produced, and a report can arrive against a release built by people who have left, using toolchains that have moved on. What you need archived is the exact source, the exact configuration including the seed, the symbol map for that build, and a documented way to rebuild and confirm you reproduced it. Set the retention policy from the support commitment for the vehicle programme, not from your continuous integration retention setting. Without that archive, protection has made a long-lived product harder to service, which is a genuine engineering cost.

Does the transformation interfere with our component inventory obligations?

It does if the inventory is generated from the shipped artifact, and the fix is ordering rather than configuration. Composition analysis recognises known code, and transformed output is much harder to recognise, so a scanner pointed at a protected bundle under-reports and produces a falsely clean inventory. Generate the inventory from your dependency manifests and lock files before the protection step, attach it to the release record, and keep the two together. This is the same ordering rule that applies to every tool that works by reading code.

Where should logic that matters to the vehicle actually live?

Behind the gateway, on the electronic control units that own the function, which is also what the architecture already assumes. A head unit is a presentation surface. Authority for anything consequential belongs to the units that enforce it and to the interfaces between them, and a check performed only in the interface layer is a check that anyone with access to that layer can remove. No build setting changes where a decision is being made. Treating the head unit as a renderer, with consequential decisions enforced further in and the boundary between them explicitly modelled, is both better engineering and a far easier position to defend in an assessment.

What is a defensible entry to put in the cybersecurity case?

A short, accurate one. State that a protection step is applied to the named interface bundles as the final stage of the build, that it is an obfuscating transformation intended to raise the cost of reading and casually modifying delivered code, and that it is not relied on as the treatment for any risk in the assessment unless your analysis specifically says so and shows the trace. Record which runtime options you deliberately left off and the availability or safety reasoning behind it. Then attach the evidence the pipeline produces: the reproducible build record and seed, the manifest, the pre-transformation component inventory, and the symbol map retention matched to the programme's support life.

Related Guides

Other standards and delivery models

IEC 62443 and industrial systems

The closest neighbour: another operational-technology standard where availability outranks confidentiality and the same guards become hazards.

Medical device software

Another regulated lifecycle sector, with the same conclusion that process and records are what the assessment reaches.

The Cyber Resilience Act

The European product regulation reaching connected products, with duties around vulnerability handling and support periods.

Reproducible builds

How a recorded seed turns a randomised build into an artifact you can rebuild and compare years later.

Next Step

Write the trace before you change a setting

The order of work matters more here than in any other regime on this site. Identify the asset and its damage scenarios, derive the threat scenarios, rate the risk, and only then decide what treats it. If a protection option survives that, record the trace from threat scenario to option, along with the failure action you chose and the safety reasoning behind it. Then attach the pipeline evidence: the reproducible build record and seed, the manifest, the pre-transformation component inventory, and a symbol map retained for the support life of the vehicle programme.