Engineering · Automotive Cybersecurity

ISO/SAE 21434 Consulting: Gap Analysis to Assessment Readiness

From the first gap analysis to the Cybersecurity Case. Agnile’s automotive cybersecurity engineers build the CSMS, run the TARA, draft the Interface Agreements and prepare the evidence your assessor will actually read — for OEMs and Tier-1 and Tier-2 suppliers in Germany, across Europe and in India.

Reviewed by Shreyansh, Founder & CTO, Agnile Technologies • Last reviewed 14 October 2026

What is ISO 21434 consulting?

ISO 21434 consulting is specialist support for applying ISO/SAE 21434:2021, the road-vehicle cybersecurity engineering standard, to an organisation and its programmes so the evidence holds up when UNECE R155 or AIS 189 is assessed. Agnile Technologies delivers seven things: a clause-by-clause gap analysis, CSMS and process deployment, Threat Analysis and Risk Assessment (TARA), Cybersecurity Interface Agreements, the Cybersecurity Case, audit and assessment preparation, and supplier evidence for OEM customers — for OEMs and suppliers in Germany, Europe and India.

New to the standard? ISO/SAE 21434 explained covers the clauses in plain terms, and the ISO/SAE 21434 compliance overview shows how the standard and the regulation fit together.

Scope

What Our ISO 21434 Consulting Covers

Engagements start in one of two places: a programme that needs the standard deployed from zero, or a programme mid-flight that needs specific evidence closed before an assessment or a customer audit. The seven services below can be taken together or one at a time.

Gap Analysis Against Clauses 5–15

We review your processes, templates and existing evidence clause by clause, interview the engineers who own each activity, and return a prioritised remediation roadmap — what exists, what is missing, what an assessor will challenge, and the order in which to close it. Typical duration is two to four weeks.

CSMS and Process Deployment

UNECE R155 makes the Cybersecurity Management System the unit of organisational assessment, and ISO/SAE 21434 Clauses 5–8 define what a working one looks like. We author the cybersecurity policy, organisational rules and processes, competence and audit structures, and the continual activities — monitoring, vulnerability analysis and vulnerability management under Clause 8 — then run the system on an anchor project so it is demonstrably operating, not shelf-ware. Annex A of the standard defines 42 work products across the lifecycle; our 42 work products checklist breaks down the full set.

Threat Analysis and Risk Assessment (TARA)

TARA is the analytical core of the standard and the first thing many customers ask for. We run the Clause 15 method — asset identification, damage scenarios, threat scenarios, attack paths, attack feasibility, risk determination and risk treatment — as facilitated workshops or as delivered analysis. See what TARA is and how it runs, or the automotive TARA solution for the method in detail.

Cybersecurity Interface Agreements

Distributed development is where programmes lose time. Clause 7 requires Cybersecurity Interface Agreements that pin down who does what between OEM and supplier, and between Tier-1 and Tier-2. We draft the agreements, align the responsibility split, evaluate supplier capability, and prepare responses when you are the supplier receiving one. Our guide to Cybersecurity Interface Agreements under Clause 7 covers the template and the negotiation points.

The Cybersecurity Case

Clause 6 asks for a Cybersecurity Case: the structured argument, supported by the work products, that cybersecurity has been achieved for the item or component. We build it claim by claim, with each claim traced to its evidence — TARA, requirements, verification and validation results, and penetration-test findings with their closure — so an assessor can follow the argument without reconstructing it.

Audit and Assessment Preparation

For programmes heading into a UNECE R155 assessment — mandatory for all new cars, vans, trucks and buses registered in the EU since 7 July 2024 — an AIS 189 assessment in India, or an OEM supplier audit, we map the evidence to the questions the assessor will ask and run rehearsals so the first hard questions come from us rather than the technical service.

Supplier Evidence for OEM Customers

Tier-1 and Tier-2 suppliers rarely need an OEM-grade CSMS; they need the evidence their customers request. We answer incoming cybersecurity questionnaires and Interface Agreements, produce component TARAs and TARA extracts, package verification evidence, and set up the vulnerability-management and incident commitments the contract names — built as reusable packs so the next customer request starts from existing evidence.

Process

How an ISO 21434 Consulting Engagement Runs — Five Steps

The same five steps run on every engagement, in every market. Durations are typical for one organisation and one anchor programme; design, verification and validation evidence then accumulates with the development programme itself, commonly over 12 to 24 months of programme schedule.

Gap analysis 2–4 weeks
Clause-by-clause review of your processes, templates and existing evidence against ISO/SAE 21434 Clauses 5–15, interviews with the engineers who own each activity, and a mapping to what your target assessment — UNECE R155, AIS 189 or an OEM supplier audit — will ask for. Output: a gap report ranked by assessment risk.
Plan 1–2 weeks
A remediation roadmap sequenced backwards from your assessment or start-of-production date, the Cybersecurity Plan (Clause 6) with tailoring rationale and named owners, and the work split with customers and suppliers that the Interface Agreements will formalise.
Work products 3–6 months for process deployment
CSMS processes for Clauses 5–8 designed in four to six weeks, then run on an anchor project so they are demonstrably operating; Item Definition, TARA, Cybersecurity Goals and Concept; Cybersecurity Interface Agreements. A manual TARA cycle commonly takes four to eight weeks per item; on KAVACH it compresses without losing engineer review.
Evidence review 2–4 weeks per evidence set
Traceability and consistency review across the work products — goals to requirements to verification (Clause 10) and validation (Clause 11) evidence, penetration-test closure, vulnerability-management records (Clause 8) — with every gap logged against the assessor question it would raise.
Assessment readiness Final 4–6 weeks before the audit
The Cybersecurity Case assembled, an evidence index mapped to the questions the technical service, OEM auditor or Indian test agency will ask, and a rehearsal assessment run against it — CSMS rehearsals use the audit guidance in ISO/PAS 5112 — so the first hard questions come from us.

Evidence

Evidence Map: Work Product, Clause and Who Reads It

Every work product has a reader. Knowing who reads it — and what they check — decides how it is written. Scope flexes: a Tier-2 delivering one component needs a fraction of this table; an OEM platform needs all of it. The ISO/SAE 21434 guide covers every clause behind these rows.

Work product	ISO/SAE 21434 clause	Who reads it
Cybersecurity policy, organisational rules and processes, competence and organisational audit records	Clause 5	The technical service at the R155 CSMS audit; OEM supplier audits; your internal auditors
Cybersecurity Plan, tailoring rationale and release for post-development	Clause 6	Your cybersecurity assessor; the OEM, as the agreed plan for supplier activities
Cybersecurity Interface Agreement and responsibility matrix	Clause 7	The customer's purchasing and product-security teams; your own suppliers
Cybersecurity monitoring, event evaluation, vulnerability analysis and vulnerability management records	Clause 8	The technical service, checking that R155 monitoring and response processes operate; the OEM's incident response team
Item Definition, Cybersecurity Goals, Cybersecurity Claims and Cybersecurity Concept	Clause 9	Your assessor and architects; the OEM, which builds on your claims and assumptions
TARA — assets, damage and threat scenarios, attack paths, attack feasibility, risk determination and treatment	Clause 15 methods, applied in Clause 9	The technical service at vehicle type, checking the R155 Annex 5 threats were considered; OEMs, through TARA extracts
Cybersecurity specifications, integration and verification reports, penetration-test findings	Clause 10	Your assessor; the technical service, as R155 paragraph 7.3.6 testing evidence
Cybersecurity validation report at vehicle level	Clause 11	Your assessor; the technical service at vehicle type
Cybersecurity Case and cybersecurity assessment report	Clause 6	The independent cybersecurity assessor; the technical service; the OEM at supplier release
Production control plan, incident response plan and end-of-support communication	Clauses 12–14	The OEM's production and field teams; the technical service, for post-production monitoring and response

In India, the CMVR test agencies assessing AIS 189 read the same evidence set. Much of the Clause 10 and Clause 11 evidence comes from testing — see automotive penetration testing for how findings are written to feed the TARA and the Cybersecurity Case.

Germany and Europe

ISO 21434 Consulting in Germany and Europe: KBA, TISAX, NIS2 and Supplier Evidence

German and European programmes sit inside a dense assessment stack: R155 type approval, OEM supplier requirements, TISAX-governed data exchange and NIS2 at company level. The engineering method is the same everywhere; what changes is who reads the evidence and what else sits beside it.

How KBA’s technical services read ISO/SAE 21434 evidence for R155

In Germany the Kraftfahrt-Bundesamt (KBA) grants UNECE R155 approvals on the basis of assessments by the technical services it has designated for cybersecurity — TÜV SÜD (designated June 2021), TÜV Rheinland and GTÜ’s Ateel among them. Elsewhere in Europe, RDW is the approval authority in the Netherlands, and UTAC acts as a technical service in France.

The assessment runs at two levels. First the CSMS: the organisation’s processes are audited and, if they hold, the authority grants a Certificate of Compliance valid for up to three years — this is where Clauses 5 to 8 are read. Then the vehicle type: the technical service looks for proof the processes were applied — a risk assessment that considered the 69 threat examples in R155 Annex 5, mitigations traced to it, testing under paragraph 7.3.6, and managed supplier dependencies — which is where Clauses 9 to 11, Clause 15 and the Cybersecurity Case are read. R155 does not name ISO/SAE 21434, but evidence structured to its clauses lets the assessor follow the argument without a translation step. More on the relationship in ISO/SAE 21434 vs UNECE R155.

What German and European OEMs expect from suppliers

R155 requires the manufacturer to show how its CSMS manages dependencies on suppliers, so the requirement reaches Tier-1s and Tier-2s through contracts. Terms vary by OEM and stay confidential; in generic terms, suppliers are commonly asked for:

A Cybersecurity Interface Agreement under ISO/SAE 21434 Clause 7, with a responsibility matrix for TARA, verification, vulnerability handling and incident response
A component TARA or TARA extracts, with the assumptions and cybersecurity claims the OEM's vehicle-level analysis depends on
Cybersecurity requirements traced to verification evidence, including penetration-test results where the agreement assigns testing to the supplier
Vulnerability monitoring and management for the product's support period under Clause 8, increasingly backed by a software bill of materials
Incident notification into the OEM's incident response process within agreed timelines, and a defined end-of-support commitment
Evidence that the supplier's own cybersecurity processes operate — some OEMs assess these against Automotive SPICE for Cybersecurity, the VDA QMC process assessment model

TISAX-governed data exchange

German OEMs and many Tier-1s use TISAX — the assessment and exchange scheme operated by the ENX Association on the VDA ISA catalogue — to decide who may receive sensitive development data. Where your programme applies TISAX rules, we agree the exchange with your security team before any architecture data moves: what is shared, through which channel, and where it is stored. Agnile’s own operations run under ISO/IEC 27001:2022, and KAVACH can be deployed on-premise or in a customer-dedicated EU VPC so vehicle-architecture data stays inside a boundary you define.

NIS2UmsuCG: a separate, company-level obligation

Germany’s NIS2 implementation act, the NIS2UmsuCG, has been in force since 6 December 2025. It treats motor-vehicle and parts manufacturers above the size threshold as important entities under the recast BSI-Gesetz: they register with the BSI, implement risk-management measures across their networks, production systems and supply chain, and report significant incidents. That is an enterprise obligation, not a vehicle one — an ISO/SAE 21434 programme does not discharge it, and NIS2 measures do not produce R155 evidence. The two can share incident-handling roles and supplier controls, but each needs its own evidence. See NIS2 for automotive suppliers in Germany.

R155 for two-wheelers and L-category vehicles from 2027

Delegated Regulation (EU) 2025/1455 extends R155 to L-category vehicles in the EU: new types from 11 December 2027, existing types from 11 June 2029. Two- and three-wheeler manufacturers exporting to Europe — including Indian manufacturers whose home market sits largely outside AIS 189 scope — need a CSMS Certificate of Compliance and vehicle-type evidence on the same pattern passenger cars met between 2022 and 2024. Read two-wheeler and EV cybersecurity before the 2027 R155 deadline.

Primary sources: Regulation (EU) 2019/2144, Delegated Regulation (EU) 2025/1455. For how R155, R156, ISO/SAE 21434, the CRA, NIS2 and TISAX fit together, see the automotive cybersecurity regulations map. For testing evidence delivered to European technical services, see automotive penetration testing in Germany and Europe.

India

ISO 21434 Consulting in India: AIS 189 Alignment

AIS 189 is India’s derivation of UNECE R155, and AIS 190 of R156; assessments are performed by CMVR test agencies, notably ARAI (Pune) and iCAT (Manesar). Because AIS 189 follows the R155 structure, one ISO/SAE 21434 evidence set — CSMS processes, TARA, verification and the Cybersecurity Case — can serve an Indian approval and a European customer’s Interface Agreement. India is not a party to the UNECE 1958 Agreement, so exporters still need a separate R155 approval for Europe. Applicability and dates are set by MoRTH notification and are still evolving; confirm the latest notification before planning. Start with the AIS 189 and AIS 190 guide; for the testing evidence, see automotive penetration testing in India.

Engagement models

Four Ways to Engage

Advisory

A senior consultant alongside your team on a defined cadence — reviewing TARAs and work products, coaching process owners, answering assessor-facing questions, and stepping in before milestones. The lightest engagement; suits teams with capacity that need direction and review depth.

Project-Based Delivery

A fixed-scope package delivered against milestones — a gap analysis, a TARA on a defined item, a CSMS deployment, or a complete work-product set for one ECU or platform. Clear deliverables, clear acceptance criteria, scoped per programme.

Staff Augmentation

Agnile cybersecurity engineers embedded in your programme, working in your toolchain and your meetings — carrying TARA, requirements and evidence work as part of the team for as long as the programme needs it.

KAVACH-Accelerated Delivery

Any of the above, delivered on KAVACH, our AI-assisted ISO/SAE 21434 workspace — threat identification grounded in a curated automotive threat database, consistent risk scoring across analysts, and work products generated with traceability to source. You keep the workspace and the evidence after the engagement ends.

Practicalities

Engagement Practicalities

The questions procurement, legal and programme managers ask before the scoping call, answered up front — for programmes in Germany, elsewhere in Europe and in India.

Who we work with	OEMs, Tier-1 and Tier-2 suppliers, and two- and three-wheeler manufacturers — CSMS owners, product-security teams and programme managers
Delivery model	Remote-first from Bengaluru, working in your toolchain — requirements management, document templates, issue tracker — with TARA workshops, kick-offs and assessment rehearsals on-site in Germany, elsewhere in Europe or in India; European on-site phases planned four to six weeks ahead to cover visa lead time
Working window	India is 4.5 hours ahead of CET and 3.5 hours ahead of CEST, giving a shared working window every European morning
Language	Deliverables, workshops and walkthroughs in English
Data handling	Operations under Agnile's ISO/IEC 27001:2022 ISMS (Certificate No. 25110402); where your programme applies TISAX rules, we agree the exchange with your security team; KAVACH deploys on-premise or in a customer-dedicated EU VPC when architecture data must stay inside a boundary you define
Contracting	Agnile Technologies Private Limited; governing law and currency agreed per contract; mutual NDA before scoping
Independence	We prepare the evidence; approval authorities, technical services and independent auditors assess it. Agnile does not certify
Typical duration	Gap analysis 2–4 weeks; process deployment 3–6 months; a manual TARA 4–8 weeks per item; a complete work-product set tracks 12–24 months of programme schedule
Cost drivers	CSMS maturity, items and ECUs in scope, interfaces needing Interface Agreements, verification and validation depth, on-site days, advisory or full delivery — a specific proposal after scoping
Deliverables	Gap report and roadmap, Cybersecurity Plan, CSMS process set, TARA, Interface Agreements, Cybersecurity Case and an assessment-readiness pack

What moves the scope and the price — and how to compare proposals — is covered in ISO 21434 consulting cost and scope.

Why Agnile

Specialists Who Sign Their Work

Plenty of firms will sell you ISO/SAE 21434 slideware. Fewer will sit in the TARA workshop, argue attack feasibility with your architects, and put their name on the Cybersecurity Case.

Independent specialist. Automotive cybersecurity is the core practice, not a side offering of a general consultancy — the same engineers do process work, product security work and validation.
Evidence in the assessor's structure. Work products are written against ISO/SAE 21434 clauses and mapped to R155 Annex 5 and AIS 189 from the first draft, so nothing has to be translated before a technical service or test agency reads it.
Certified operations. Agnile is certified to ISO 9001:2015 (Certificate No. 25110401) and ISO/IEC 27001:2022 (Certificate No. 25110402) — the engagement itself runs under an audited quality and information-security system.
KAVACH advantage. Consulting delivered on our own ISO/SAE 21434 workspace means faster analysis, consistent risk scoring and evidence that stays traceable after we leave.
Built for what comes next. ISO/SAE 21434:2021 entered systematic review in July 2026. We structure evidence by clause and trace it to source so it carries forward into a second edition, an R155 amendment or the L-category extension rather than needing a rewrite.

What the second edition is likely to change is tracked in ISO/SAE 21434 second edition. Consulting sits inside our wider automotive cybersecurity practice.

FAQ

ISO 21434 Consulting Questions

Cost and scope are covered in depth in ISO 21434 consulting cost and scope; TARA tooling on the KAVACH page.

Scope, not a rate card. The drivers are how much of the CSMS already exists, the number of items and ECUs in scope, the number of customer and supplier interfaces that need Cybersecurity Interface Agreements, the depth of verification and validation evidence required, on-site days, and whether you need advisory review or full delivery. We scope per programme and return a specific proposal after a scoping call.

Process deployment typically takes three to six months: a two-to-four-week gap analysis, four to six weeks of process design, then a reference implementation on an anchor project. A manual TARA cycle commonly takes four to eight weeks per item. Design, verification and validation evidence accumulates with the development programme, so a first complete work-product set commonly tracks 12 to 24 months of programme schedule.

No. Agnile is a consultancy, not a certification body or technical service, and the party that helped build your evidence should not be the one judging it. Under UNECE R155 the approval authority — KBA in Germany, RDW in the Netherlands — grants the CSMS Certificate of Compliance and vehicle type approval on the basis of a technical service's assessment. We prepare you; independent auditors and technical services assess.

Not by name. UNECE R155 sets outcomes — a certified CSMS, a risk assessment that considers the 69 threat examples in Annex 5, mitigations, and appropriate and sufficient testing under paragraph 7.3.6 — without mandating a standard. ISO/SAE 21434 was developed alongside R155 and covers the same engineering activities, so evidence structured by its clauses gives the technical service an argument it can follow without a translation step.

Yes. The method and deliverables are the same in both markets; only logistics differ. Analysis, authoring and review run remotely from Bengaluru in your toolchain, with TARA workshops, kick-offs and assessment rehearsals on-site in Germany or elsewhere in Europe. India is 3.5 to 4.5 hours ahead of Central European time, deliverables are in English, and where your programme applies TISAX rules we agree the exchange with your security team.

Where your programme already runs a TARA tool and your customers expect its output, we work within it. Otherwise we deliver on KAVACH, Agnile's AI-assisted ISO/SAE 21434 workspace: threat identification grounded in a curated automotive threat database, consistent risk scoring across analysts, and work products traceable to source, with an engineer reviewing every result. You keep the workspace and the evidence after the engagement ends.

An OEM needs the full CSMS behind the UNECE R155 Certificate of Compliance plus vehicle-type evidence across every item. A Tier-1 needs the processes its customers audit, a component-level TARA, Cybersecurity Interface Agreements in both directions, verification evidence and vulnerability management for the product's support period. Tier-2 scope narrows to what the customer's agreement names, so we scale to the contract rather than the whole standard.

No — they are separate obligations. Germany's NIS2UmsuCG, in force since 6 December 2025, regulates the company: its networks, production systems and supply chain, with BSI registration and incident reporting. ISO/SAE 21434 and UNECE R155 address the vehicle and its components. Incident-handling roles and supplier controls can be shared, but neither programme's evidence substitutes for the other's.

Explore next

Plan the engagement around your programme

The ISO/SAE 21434 guides, the regional regulation pages for Germany, Europe and India, the compliance hubs the evidence maps to, and the testing that produces the verification evidence.

Germany & Europe

ISO/SAE 21434 Guides

Germany, Europe and India

Compliance

Penetration Testing

Scope Your ISO/SAE 21434 Engagement

A 60-minute scoping call: bring your assessment date, your customer's questionnaire or Interface Agreement, or your half-finished TARA. We respond to qualified enquiries within one business day.

Read the ISO/SAE 21434 Guide