Towards ISO/SAE 21434 Compliance: Quantifying Ambiguity and Detailing Requirements

Compliance with the ISO/SAE 21434 international standard is being required in order to strengthen automotive cybersecurity. Although ISO/SAE 21434 defines a variety of requirements to enhance automotive cybersecurity, a possibility of misinterpretation arises because the differences in knowledge levels and expertise of the various stakeholders may prevent them from understanding the requirements accurately. More specifically, the automotive development field is broadly divided into various work areas, with a wide variety of stakeholders and large-scale distributed development. Therefore, we believe that the key to success in enhancing cybersecurity in automotive development is to ensure that individual developers do not misinterpret the requirements of the ISO/SAE 21434 standard. To this end, in this study we quantified the ambiguity of ISO/SAE 21434 using the quality characteristics of software requirement specifications, and examined whether any requirements were difficult to interpret by third-party inspection. Then, several improvement patterns were considered for ambiguous requirements that might be difficult to interpret, and the requirements were materialized by applying the patterns to the ambiguous requirements. As a result, the quality characteristics of the specified requirements were improved.