ISO/SAE 21434 RQ-09-04: [RQ-09-04] Risk treatment decision per threat scenario

Using what RQ-09-03 produced, a risk treatment decision shall be made for every threat scenario as 15.9 describes; avoiding a risk by removing its cause may mean changing the item through change management.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Clause 9: Concept – ISO/SAE 21434

RQ-09-01 [RQ-09-01] Item definition
RQ-09-02 [RQ-09-02] Operational environment description
RQ-09-03 [RQ-09-03] Risk analysis of the item
RQ-09-05 [RQ-09-05] Cybersecurity goals
RQ-09-06 [RQ-09-06] Cybersecurity claims
RQ-09-07 [RQ-09-07] Verification of goals and claims
RQ-09-08 [RQ-09-08] Description of cybersecurity controls
RQ-09-09 [RQ-09-09] Cybersecurity requirements and requirements on the operational environment

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ISO/SAE 21434 controls