ISO/SAE 21434 RQ-09-02: [RQ-09-02] Operational environment description

Information on the item's operational environment that matters for cybersecurity shall be described, so that threat scenarios and attack paths can be found; this includes assumptions, for example that each PKI certificate authority the item depends on is managed correctly.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Clause 9: Concept – ISO/SAE 21434

RQ-09-01 [RQ-09-01] Item definition
RQ-09-03 [RQ-09-03] Risk analysis of the item
RQ-09-04 [RQ-09-04] Risk treatment decision per threat scenario
RQ-09-05 [RQ-09-05] Cybersecurity goals
RQ-09-06 [RQ-09-06] Cybersecurity claims
RQ-09-07 [RQ-09-07] Verification of goals and claims
RQ-09-08 [RQ-09-08] Description of cybersecurity controls
RQ-09-09 [RQ-09-09] Cybersecurity requirements and requirements on the operational environment

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ISO/SAE 21434 controls