Navigating the Risk Treatment Decision in TARA

The final step in the TARA process, as outlined in Clause 15 of ISO/SAE 21434, is making a risk treatment decision. This step includes a single requirement: selecting and applying one or more risk treatment options from the provided choices. As a requirement, this step is mandatory and must be implemented. The outcome of this process is a work product known as risk treatment decisions, derived from [RQ-15-17]. In this blog post, we will explore the reasoning behind these risk treatment decisions.

Further considerations

• Once other steps in the TARA process are completed and the attack feasibility (high, medium, low, or very low) is evaluated, it should become easier to decide which risk treatment option(s) to apply. If attack feasibility is considered very low for example, then perhaps depending on the situation, the appropriate option would be to avoid or reduce the risk. The organization must have a clearly defined policy for which risk scores can be accepted and which ones require reduction or are shared.
  
• The rationales for retaining the risk and sharing the risk are recorded as cybersecurity claims and are subject to cybersecurity monitoring and vulnerability management. A cybersecurity claim is a statement about a risk. This involves providing justification for the risk treatment option to either share or retain the risk.
  
• When the decision is to reduce the risk, it may sometimes be difficult to completely eliminate the threat and there might be some residual risk left which must be captured, along with the respective treatment decision (for example, the residual risk may be shared with the system integrator).
  
• Risks that have been reduced result in the creation of a cybersecurity goal. A cybersecurity goal is a concept-level cybersecurity requirement associated with one or more threat scenarios. The cybersecurity goals are further refined into system-level cybersecurity requirements.

Conclusion

In conclusion, the risk treatment decision is a critical step in the TARA process, as it directly influences how an organization manages potential cybersecurity threats. By selecting from options such as avoiding, reducing, sharing, or retaining risks, organizations can strategically address vulnerabilities while balancing cost, feasibility, and market demands. The process requires thorough evaluation and justification, with decisions documented as cybersecurity claims subject to ongoing monitoring. Even when risks are reduced, some residual risk may remain, necessitating careful management and the establishment of cybersecurity goals that guide the development of specific system-level requirements. This comprehensive approach ensures that cybersecurity measures are not only effective but also aligned with the organization’s overall risk management strategy.

References:

• ISO/SAE 21434
• Automotive Cybersecurity Engineering Handbook by Dr. Ahmad MK Nasser

Need support?

Block Harbor is here to help with any TARA related activities. Block Harbor now offers a TARA package that includes a detailed cybersecurity risk treatment guide as well other guidance and template documentation. Contact us here for more information.