ISO 21434 Deep Dive (6): Concept Phase, Cybersecurity Goals, and CAL (Clause 9)

By /

Editor's note:This is the final article in our "ISO 21434 Deep Dive" series, covering Clause 9, the "Concept Phase", and CAL (Cybersecurity Assurance Level) — the standard's core measure of the degree of security assurance.

1. What Happens in the Concept Phase

The concept phase is where security work begins: its task is to turn the conclusions of risk assessment into executable top-level design requirements. It comprises two parts: the cybersecurity goals and the cybersecurity concept.

2. Cybersecurity Goals

  • Source:derived from the results of risk assessment, in particular from "reduce risk" decisions;
  • Definition:a high-level security statement that clearly describes the assets to be protected and the degree of assurance the system must achieve;
  • Purpose:it is the top-level basis for subsequent security design, setting the direction for the requirements, design and verification that follow.

3. The Cybersecurity Concept

At its core, the cybersecurity concept converts abstract security goals into concrete, executable technical and organizational requirements. It bridges "security goals" and "system implementation", ensuring that security requirements are correctly allocated to hardware, software or the operational environment so that security remains traceable. Implementation has four steps:

  1. Goal analysis:break down the high-level goals and identify the key security properties and constraints that must be satisfied;
  2. Requirement definition:turn the analysis into specific, measurable technical and non-technical requirements;
  3. Requirement allocation:map the security requirements onto specific system components, subsystems or processes;
  4. Verification and validation:verify that the requirements are consistent and complete, and confirm they are compatible with the architecture.

Do this thoroughly and every later stage — development, verification, production — has something solid to build on; cut corners here and the risk multiplies after series production.

4. CAL: The Cybersecurity Assurance Level

CAL is the core indicator of the degree of cybersecurity assurance and directly determines how rigorous product development and verification activities must be. The higher the level, the stricter the protection required against potential threats, and the more detailed and in-depth the corresponding verification process.

How it is determined:CAL is driven by two dimensions — the risk impact level (for example severe, major, moderate) and the attack vector (physical, local, adjacent, network). The more severe the consequence and the easier the attack path, the higher the CAL required.

The four levels:

  • CAL 1 · Basic verification:for low-risk scenarios — consistency testing of core functions and basic structural checks, with a comparatively streamlined process;
  • CAL 2 · Systematic review:systematic functional testing and design review, verifying the logical completeness of security mechanisms and the compliance of the implementation;
  • CAL 3 · Enhanced review:n independent security design review combined with in-depth testing and vulnerability analysis, ensuring resistance to medium-strength malicious attacks;
  • CAL 4 · Highest assurance:for extremely high-risk scenarios — the most rigorous independent full-process testing and expert review, used to defend against advanced persistent threats.

5. Key Figures at a Glance

  • Impact rating:S3 Severe (life-threatening) / S2 Major (severe injury) / S1 Moderate (recoverable) / S0 Negligible (no substantial injury);
  • Attack feasibility:High (basic tools suffice) / Medium (professional knowledge or bespoke tools) / Low (very high skill and expensive equipment) / Very Low (practically infeasible);
  • Risk value (1–5):calculated from the "impact × attack feasibility" matrix — level 5 must be mitigated immediately, level 3 requires an action plan;
  • CAL (1–4):basic assurance → systematic assurance → in-depth assurance → highest assurance, with verification rigour increasing at each step.

6. Series Wrap-Up

Across the six articles, the skeleton of ISO 21434 is now clear:the organization sets the rules (Clause 5) → the project lays out the plan (Clauses 6 and 7) → continual vigilance after launch (Clause 8) → risk quantified through TARA (Clause 15) → and in the concept phase risk becomes design (Clause 9)..

For companies in China, our recommended pace is: start with a gap analysis to determine whether what you lack is management-system documentation, technical analysis or the evidence chain, then advance in batches according to project priority rather than trying to establish everything at once.

More in This Series

Need Compliance Support?

Is your company working towards ISO 21434 / CSMS compliance? Contact us for a free compliance assessment. QinGuard specializes in automotive cybersecurity consulting, providing end-to-end services from gap analysis and risk assessment to system implementation and certification support.

Scroll to Top