{"id":9136,"date":"2026-09-26T12:00:00","date_gmt":"2026-09-26T04:00:00","guid":{"rendered":"http:\/\/124.222.197.95\/?p=9105"},"modified":"2026-09-26T12:00:00","modified_gmt":"2026-09-26T04:00:00","slug":"iso21434-5-tara","status":"publish","type":"post","link":"https:\/\/qinguard.cn\/en\/iso21434-5-tara\/","title":{"rendered":"ISO 21434 Deep Dive (5): The Eight-Step TARA Process and Four Risk Treatment Options (Clause 15)"},"content":{"rendered":"

Editor's note:<\/strong>This is the fifth article in our \"ISO 21434 Deep Dive\" series, covering TARA (Threat Analysis and Risk Assessment), the methodology at the technical core of the standard \u2014 and the most labour-intensive part for companies to implement.<\/p>\n

1. What Is TARA?<\/h2>\n

TARA builds a complete loop from asset inventory to treatment decision in order to systematically identify and control cybersecurity risk, and it must be executed iteratively throughout the product life cycle. It answers four questions:what must we protect, what are we afraid of, how severe would it be, and what do we do about it.<\/strong><\/p>\n

2. The Eight-Step Process<\/h2>\n
    \n
  1. Asset identification:<\/strong>locate the core data, systems and services, defining the baseline objects of protection;<\/li>\n
  2. Damage scenario:<\/strong>reason through the potential negative impact on business operations and assets should the threat event occur;<\/li>\n
  3. Threat identification:<\/strong>using internal and external intelligence, identify the specific attack behaviors and sources that could trigger the damage scenario;<\/li>\n
  4. Impact rating:<\/strong>quantify the severity of the damage across safety, financial, operational and privacy dimensions;<\/li>\n
  5. Attack path analysis:<\/strong>map the technical vulnerabilities, configuration weaknesses and human-factor weak points an attacker could exploit;<\/li>\n
  6. Attack feasibility rating:<\/strong>assess the technical barrier, cost and probability of success for an attacker using readily available means;<\/li>\n
  7. Risk determination:<\/strong>combine impact severity with attack feasibility to calculate and determine the risk level;<\/li>\n
  8. Risk treatment decision:<\/strong>based on the risk level, define the final treatment \u2014 avoid, reduce, share or accept.<\/li>\n<\/ol>\n

    3. Impact Rating: Four Dimensions<\/h2>\n