Glossary · ISO/SAE 21434
Also known as: Threat Analysis and Risk Assessment
TARA: Threat Analysis and Risk Assessment — the structured cybersecurity risk method of ISO/SAE 21434. TARA is the analytical core of ISO/SAE 21434 Clause 15.
Where this matters: ISO/SAE 21434 Consulting
It moves from item definition and asset identification, through damage and threat scenarios, attack-path and attack-feasibility analysis, risk determination, and risk treatment. The output drives cybersecurity goals, claims, requirements, controls, and the verification evidence captured in the cybersecurity case.
Why it matters
TARA is the activity assessors and OEM cybersecurity teams scrutinise hardest. Inconsistent risk scoring and thin attack-path coverage are the most common audit findings.
Related terms
Component, function, data flow, or property of an item whose compromise can cause harm.
Description of the harm that occurs when a cybersecurity property of an asset is compromised.
Plausible way an attacker can compromise a cybersecurity property of an asset.
Sequence of attacker steps from initial access to compromise of a cybersecurity property.
Estimation of how achievable an attack path is, expressed via factors such as elapsed time, expertise, knowledge, opportunity, and equipment.
ISO/SAE 21434 risk score derived from impact (SFOP) and attack feasibility.
Top-level cybersecurity objective derived from a threat scenario at the item level.
Need help applying TARA on a programme? Use the contact form to reach Agnile’s engineering team.