TARA 2.0 for Connected and Automated Vehicles

Connected Automated Vehicles (CAVs) represent a transformative shift in transportation, offering enhanced safety, and efficiency. However, achieving full automation at levels four and five of the Society of Automotive Engineering (SAE) scale poses significant cybersecurity and privacy risks. To address these risks, United Nations Economic Commission for Europe (UNECE) regulations and ISO/SAE 21434 mandate Threat Analysis and Risk Assessment (TARA) as a core methodology for cyber risk management. Existing TARA frameworks, designed for conventional vehicles, fall short for higher automation levels, neglecting complexities such as the absence of human control and data-driven decision making concerns. This work, conducted within ULTIMO, a project tackling the CAVs deployment challenges, introduces TARA 2.0, an enhanced framework addressing cybersecurity, privacy, and expert subjectivity in risk assessment. A step-by-step experimental implementation demonstrates its feasibility, compliance with standards, and potential to secure the deployment of fully automated vehicles.