ISO 21434 Consulting: What a Programme Buys and What Drives the Cost

“What will ISO 21434 consulting cost us?” has the same honest answer as every engineering-services question: it depends on what you are buying. A two-week gap analysis for a Tier-2 sensor supplier and a CSMS deployment for an OEM heading into its first UNECE R155 assessment are both “ISO 21434 consulting”, and the effort differs by an order of magnitude. This post sets out what an engagement actually buys, the drivers that move the number, typical durations by scope, and how to read a quote so you can compare providers on the same terms. There are no prices here: scope sets the price, and a number offered before scoping is a guess.

What a Programme Actually Buys

Strip away the labels and an ISO/SAE 21434 engagement delivers some combination of five things:

• A gap analysis — your processes and evidence reviewed against Clauses 5–15, with a prioritised roadmap of what to close and in which order.
• A TARA — the Clause 15 method run on a defined item, producing damage and threat scenarios, feasibility and risk ratings, treatment decisions and the cybersecurity goals that follow from them.
• CSMS process deployment — the policy, processes, roles, competence, audit and continual activities of Clauses 5–8, run on an anchor project so they are demonstrably operating rather than shelf-ware.
• Supplier evidence — cybersecurity interface agreements under Clause 7, responses to customer questionnaires, and the work products a contract names.
• Assessment readiness — the cybersecurity case assembled, evidence mapped to the questions the assessor will ask, and a rehearsal before the real thing.

Each can be bought on its own, and they are often bought in sequence. The sequence matters: a TARA run before the item definition is stable, or a rehearsal before the evidence exists, is money spent twice. If the standard itself is still new to the team, start with ISO/SAE 21434 explained.

Eight Drivers Behind Every Quote

1. Your role in the supply chain

An OEM needs an organisational CSMS that an approval authority will assess under UNECE R155, plus vehicle-level evidence for each type. A Tier-1 needs the parts of that system its customer agreements assign to it. A Tier-2 often needs a component TARA, an answered interface agreement and a handful of named work products. Scoping a Tier-2 as if it were an OEM is an easy way to overpay.

2. Starting maturity

Existing management systems shorten the work. An ISO 9001 quality system, an ISO/IEC 27001 information-security system, an ISO 26262 safety process or an Automotive SPICE process landscape already supplies document control, competence management, audit and change control that a CSMS can reuse. A gap analysis is the cheapest way to find out how much of the CSMS you already have.

3. Number and complexity of items

TARA effort scales with items, interfaces and variants. A gateway with cellular, Bluetooth, diagnostics and several buses is a larger analysis than a sensor on a single CAN bus, and every platform variant that changes the attack surface needs its delta analysed. Count interfaces, not boxes.

4. Supplier interfaces

Every OEM–Tier-1 and Tier-1–Tier-2 boundary needs a cybersecurity interface agreement. Five suppliers mean five negotiations, each moving at the speed of the other party’s reviewers, and the quote should say how many are in scope.

5. Who holds the pen

Advisory review — your engineers author, the consultant reviews and coaches — costs less per month and builds in-house capability. Authored delivery is faster but leaves you dependent unless knowledge transfer is scoped explicitly. A common pattern mixes the two: authored for the first item, reviewed for the ones that follow.

6. Depth of verification and validation evidence

Clauses 10 and 11 call for evidence that controls were verified and goals validated. Planning and reviewing that evidence is consulting work; producing it through penetration testing or fuzz testing is testing work, scoped and priced separately. The automotive penetration testing cost guide covers that side of the budget.

7. The assessment date

A fixed date with a large gap compresses the schedule, which means more people working in parallel and less reuse between workstreams. The same scope started a quarter earlier tends to cost less, because work can be sequenced instead of overlapped.

8. Tooling and evidence ownership

Spreadsheet TARAs are cheap to start and expensive to maintain across variants and releases. A workspace such as KAVACH shortens analysis and authoring and keeps traceability intact; its licence is a separate line item. Either way, you should own the evidence and be able to export it when the engagement ends.

Typical Durations by Scope

The ranges below are typical ranges, not commitments. They assume the inputs described under the cost levers below and a customer team that is available for workshops; the scope statement in your proposal is what binds.

What a Quote Should Itemise

Two proposals are only comparable if they describe the same work. Ask every provider for the same line items:

• Items and boundaries — which ECUs, systems or components, and which variants.
• Clauses and work products in scope — named by WP identifier, with what is authored and what is reviewed.
• Engagement model — advisory, fixed-scope project, embedded engineers, or a mix.
• Inputs you provide — architecture, interface descriptions, existing processes, named owners — and what happens to the schedule if they arrive late.
• Workshops and on-site days, and who pays for travel.
• Tooling — whose tool, whose licence, and the export format of the evidence.
• Exclusions — penetration testing, R156 software-update processes, production-line changes — stated, not implied.
• Acceptance criteria— what “done” means for each deliverable.

Levers That Cut Cost Without Cutting Evidence

• Run the gap analysis first and buy only what it shows is missing.
• Reuse what your ISO 9001, ISO/IEC 27001 or ISO 26262 processes already provide instead of building a parallel CSMS.
• Freeze the item definition before the TARA starts; a moving boundary forces rework across every downstream work product.
• Analyse one representative item fully, then reuse its threat library and structure across variants.
• Name an owner for each clause on your side and book their workshop time at kickoff.
• Agree work-product templates once, up front, so documents do not cycle on format.
• Choose advisory review where your team has capacity, and authored delivery where the schedule demands it.

Red Flags

A few patterns are worth walking away from:

• “ISO 21434 certification guaranteed.” There is no ISO-run certification scheme for the standard, and nobody can guarantee an approval authority’s decision.
• A template pack sold as compliance. Templates are useful; empty ones are not evidence. Assessors read for activities that happened.
• The same people write and assess your case. Clause 6 expects the cybersecurity assessment to be independent of the work it judges.
• A price before a scoping call. It means the scope has not been understood.
• Evidence locked in someone else’s tool. If you cannot export it, you will pay to recreate it.
• No named engineers. Ask who sits in the TARA workshop and what they have built.

Our guide to choosing an automotive cybersecurity vendor turns these into evaluation questions for a shortlist.

India and Germany: What Changes

The method does not change with geography; the logistics do. For Indian programmes, workshops are domestic and in your time zone, and the same evidence supports AIS 189 and AIS 190 assessments by CMVR test agencies, notably ARAI and iCAT — with applicability dates set by MoRTH notification, so confirm the latest one before planning.

For German and wider European programmes, delivery is typically remote-first in your toolchain, with on-site workshops for the TARA kickoff and the assessment rehearsal planned around travel and visa lead time. India Standard Time runs three and a half hours ahead of Central European Summer Time and four and a half in winter, which leaves a working overlap every day. Evidence is structured for the technical services that report to approval authorities such as KBA and RDW, and where architecture data must stay in the EU, KAVACH can run on-premise or in a customer-dedicated EU cloud. Agree documentation language, templates and data-handling rules at kickoff.

Take-Aways

Scope before price. Run the gap analysis, size the work by items and interfaces rather than by clause count, reuse the management systems you already have, keep testing as its own line, insist on independence for the assessment and ownership of the evidence, and compare quotes item by item. The cheapest ISO/SAE 21434 programme is the one whose evidence an assessor accepts the first time.

Agnile Technologies scopes ISO/SAE 21434 consulting per programme after a scoping call and returns a scope-specific proposal; engagements run under ISO 9001:2015 and ISO/IEC 27001:2022 certified management systems. Durations above are typical ranges, not commitments; the scope statement is.