ISO/SAE 21434 RC-15-11: [RC-15-11] Attack feasibility method

To rate attack feasibility, one of three methods should be used, attack-potential-based, CVSS-based or attack-vector-based, picked according to the lifecycle phase and the information at hand.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Clause 15: Threat analysis and risk assessment methods – ISO/SAE 21434

RC-15-12 [RC-15-12] Attack-potential-based approach
RC-15-13 [RC-15-13] CVSS-based approach
RC-15-14 [RC-15-14] Attack-vector-based approach
RQ-15-01 [RQ-15-01] Damage scenarios
RQ-15-02 [RQ-15-02] Assets with cybersecurity properties
RQ-15-03 [RQ-15-03] Threat scenarios
RQ-15-04 [RQ-15-04] Impact rating in four categories
RQ-15-05 [RQ-15-05] Impact rating levels

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ISO/SAE 21434 controls