Abstract Cybersecurity has become one of the most crucial challenges in the automotive development lifecycle. The upcoming ISO/SAE 21434 standard provides only a generic framework that is insufficient to derive concrete design methods. This article proposes an actionable cybersecurity development lifecycle model that provides concrete action and work product guidance aligned with the ISO/SAE 21434 and Automotive SPICE® extension for cybersecurity. The model has been inspired by action research in “next” industry practice pilot projects, which ensures that it is actionable. It has been augmented by insights gained from literature research in cybersecurity development for embedded systems. The proposed lifecycle model complements the ISO/SAE 21434 standard and provides the basis for the company‐specific process and practice specifications. It has been validated through the integration of cybersecurity‐related aspects in an electric power steering system. A core characteristic of the model is the central role of threat modeling, vulnerability analyses, and cybersecurity requirements derivation on both system and subsystem levels. Without concrete practice guidelines, the ISO/SAE 21434 is very difficult to understand and apply at this stage. This contribution aims to fill this gap through a model inspired by cutting‐edge embedded cybersecurity practices interpreted for the current and near‐future automotive electronic architectures.

Background: Industrial Product-Service Systems (IPSS) denote a service-oriented way of providing access to cyber-physical systems' (CPS) capabilities. The design of such systems bears high risk due to uncertainty in requirements related to service function and behavior, operation environments, and evolving customer needs. Such risks and uncertainties are well known in the IT sector, where DevOps principles ensure continuous system improvement through reliable and frequent delivery processes. A modular and service-oriented system architecture complements these processes to facilitate IT system adaptation and evolution.

Cyber security is increasingly recognized as an essential topic for automotive systems, especially in the area of connected and automated driving. Upcoming regulation defines requirements for cyber security on multiple levels in the automotive domain in order to achieve type approval. On the organizational level, a cyber security management system (CSMS) which covers the whole vehicle lifecycle and ecosystem is required. In addition, an argumentation for the cyber security of each vehicle type for which type approval is requested has to be given. Due to the novel nature of these requirements compared to existing type approval requirements, a test phase is ongoing. The components and scope of a CSMS are an open issue. We give an overview of the requirements for a CSMS, identify approaches and gaps, and give an outlook towards a potential framework which can address the requirements.