ISO/SAE 21434 RC-15-14: [RC-15-14] Attack-vector-based approach

Where the attack-vector-based method is chosen, the rating should come from assessing which attack vector dominates the attack path (Annex G.4); this method fits early phases, before the specific paths are known.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Clause 15: Threat analysis and risk assessment methods – ISO/SAE 21434

RC-15-11 [RC-15-11] Attack feasibility method
RC-15-12 [RC-15-12] Attack-potential-based approach
RC-15-13 [RC-15-13] CVSS-based approach
RQ-15-01 [RQ-15-01] Damage scenarios
RQ-15-02 [RQ-15-02] Assets with cybersecurity properties
RQ-15-03 [RQ-15-03] Threat scenarios
RQ-15-04 [RQ-15-04] Impact rating in four categories
RQ-15-05 [RQ-15-05] Impact rating levels

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ISO/SAE 21434 controls