How TARA, Threat Models, and Cybersecurity Risk Assessments Differ
Risk assessment, risk management, threat model, threat analysis, TARA, cybersecurity risk assessment: these terms come up again and again in projects for connected products. Sometimes they mean the same thing, sometimes something fundamentally different. If you as a manufacturer must comply with several regulations and standards at once, you need a clear mapping. Which term appears in which standard, and which activities does it trigger?
At a glance
- The confusion comes from the terms, not from the formulas. It is greatest at the boundary between safety (the risk assessment of hazards) and security (threat analysis and risk assessment).
- The Machinery Regulation requires a risk assessment in the sense of functional safety, the CRA an assessment of cybersecurity risks. These are separate steps with different goals.
- Most regulations and standards define risk as a combination of likelihood and impact. This applies to the CRA (Article 3(37)), EN 40000-1-2 (6.4.4), the draft EN IEC 62443-4-1 prAA (SRM-5), and ISO/SAE 21434 (15.8).
- A cybersecurity risk assessment has three steps: building a threat model, rating the risk of the identified threats, and deriving risk-reducing measures for the critical threats.
- The TARA from ISO/SAE 21434 is the automotive-specific end-to-end method for threat analysis and risk assessment.
- The CRA term “cybersecurity risk assessment” works best as the umbrella term. Strictly speaking, the activity is cybersecurity risk management, and the assessment is only one part of it.
What is a cybersecurity risk assessment?
A cybersecurity risk assessment answers three questions. Which threats can affect the product, how high is the resulting risk, and which risk-reducing measures are necessary? Methodically, it rests on three building blocks: the assets worth protecting and their security objectives, the identified threats, and the risk rating as a combination of likelihood and impact. On this basis, the manufacturer decides how to treat the risk and which measures should reduce the critical threats.
That is the shared logic. In practice, each regulation and standard names this activity differently and sets its own priorities.
Which terms do the regulations and standards use?
The table maps the original terms to their sources and shows what each one requires.
| Source | Original term | What is required | Scope |
|---|---|---|---|
| Machinery Regulation (Regulation (EU) 2023/1230) | Risk assessment | Safety risk assessment of the machinery, methodically following EN ISO 12100; relevant for cybersecurity are especially Annex III, sections 1.1.9 (protection against corruption) and 1.2.1 (safety and reliability of control systems) | Safety, machinery as a whole |
| EN 50742 | Threat assessment | After the risk assessment according to EN ISO 12100, in which all hazards have been identified, the designer carries out a threat assessment | Interface between safety and security on the machine |
| Cyber Resilience Act (Regulation (EU) 2024/2847) | Cybersecurity risk assessment | Manufacturers carry out an assessment of the cybersecurity risks (Article 13(2)), document it (Article 13(3), Annex VII, point 3), and derive from it which essential cybersecurity requirements of Annex I, Part I apply | Security, product with digital elements |
| EN 40000-1-2 (draft) | Risk assessment (within risk management) | Structured method: assets and security objectives (6.4.2), threats (6.4.3), risk estimation (6.4.4), risk evaluation (6.4.5); threat modeling is part of the risk analysis | Security, product, intended as a harmonized standard for the CRA |
| IEC 62443-4-1 Ed. 1 | Threat model (SR-2) | Process for a threat model with trust boundaries, attack vectors, threats with their severity (for example CVSS), and mitigations | Security, secure development process |
| EN IEC 62443-4-1 prAA (draft) | Security risk management (SRM), including threat model (SRM-4) | Separate risk management practice: method and acceptance criteria (SRM-1), rating of threat scenarios by likelihood and impact (SRM-5), risk treatment (SRM-6) | Security, secure development process |
| ISO/SAE 21434 | Threat analysis and risk assessment (TARA) | Modular end-to-end method (clause 15): asset identification, threat scenario identification, impact rating, attack path analysis, attack feasibility rating, risk value determination, risk treatment decision | Security, road vehicles and their components |
Why safety and security are not the same
The most common terminology error concerns machinery. The Machinery Regulation requires a risk assessment, but it means the safety assessment of hazards according to EN ISO 12100. That assessment asks what danger the machine poses to people. A cybersecurity risk assessment asks something else: what are the consequences if critical threats are exploited, and which appropriate measures can counter them?
EN 50742 makes this order explicit. First comes the risk assessment according to EN ISO 12100 with the complete identification of hazards. Then the designer carries out a threat assessment. The standard deliberately separates two steps: safety first, then security. In English, both the Machinery Regulation and the CRA speak of a “risk assessment”. If you file both activities under that one term, you lose exactly this separation.
The CRA confirms this. Recital 53 of the CRA states that compliance with the essential cybersecurity requirements could facilitate compliance with certain requirements of the Machinery Regulation. This applies in particular to the protection against corruption and to the safety and reliability of control systems. Facilitate, not replace. Manufacturers of machinery with digital elements must carry out both assessments, and the two complement each other.
Threat model, risk assessment, and TARA: three levels, one misunderstanding
Within security, too, the terms get mixed up. It helps to distinguish three levels.
A threat model is a sub-step, not the complete risk assessment. In IEC 62443-4-1 Ed. 1, SR-2 describes the threat model with trust boundaries, data flows, attack vectors, and threats with their severity. This edition does not yet contain a separate risk management practice. Only the draft EN IEC 62443-4-1 prAA adds a complete security risk management practice (SRM). SRM-1 requires a method that rates the threat scenarios identified in the threat model by likelihood and impact and derives the risk from them. The threat model requirement moves to SRM-4.
EN 40000-1-2, which is intended as a harmonized standard for the CRA, describes the elements of risk management in clause 6. These are the context, the method, the risk assessment including the threat model, risk treatment, and risk communication. Here the threat model is explicitly a building block of the risk assessment, not a substitute for it.
The TARA is the automotive-specific end-to-end method of ISO/SAE 21434. It combines threat analysis and risk assessment in one named, modular procedure. The term TARA belongs in the automotive context. For an industrial product under the CRA, “TARA” is the wrong term, even though the underlying logic is almost identical.
How close the methods really are
Despite their different names, the methods are very close in content. EN 40000-1-2 defines threats in 6.4.3 through three elements: the affected asset, the compromised security objective, and the cause of the compromise. ISO/SAE 21434 describes a threat scenario in RQ-15-03 in almost the same words: targeted asset, compromised cybersecurity property, cause of compromise.
The standards also meet on risk treatment. EN IEC 62443-4-1 prAA lists four options in SRM-6: avoidance, reduction through measures, sharing or transfer, and acceptance. ISO/SAE 21434 lists the same four in RQ-15-17: avoiding, reducing, sharing, and retaining. EN 40000-1-2 also defines four options in 6.5: risk avoidance, risk mitigation, risk transfer, and risk acceptance.
If you master one method, you already understand the basic logic of the others. What differs is the level of detail, the scales, and the required scope and content of the evidence.
Common pitfalls for manufacturers
Example 1: connected machine control with remote maintenance. It falls under the Machinery Regulation and, as a product with digital elements, also under the CRA. Some manufacturers create only a “safety risk assessment” and believe it covers both. They miss one point: the safety assessment according to EN ISO 12100 does not capture the threats to the remote maintenance interface. That requires the cybersecurity risk assessment under the CRA, methodically supported by EN 40000-1-2.
Example 2: industrial IoT sensor whose development process follows IEC 62443-4-1. If the team maintains only the threat model according to SR-2, the explicit risk assessment and the risk treatment are missing. Both are expected by the CRA and the upcoming 62443 drafts. The threat model alone does not meet the obligation to assess cybersecurity risks.
Example 3: a language pitfall. “TARA” is increasingly used outside the automotive industry. In the documentation and conformity evidence for a CRA product, you should use the term set by the applicable regulation or standard instead.
One umbrella term, clearly separated steps
Risk assessment, risk management, threat model, threat analysis, TARA, and cybersecurity risk assessment share the same core risk logic. What matters is choosing the right term in each case and keeping safety separate from security. For product security, “cybersecurity risk assessment” is the recommended umbrella term, because it follows the terminology of the CRA and of EN 40000-1-2, 6.4. The threat model remains a sub-step for identifying threats, and TARA remains reserved for automotive. The risk assessment under the Machinery Regulation describes the safety assessment, not the cybersecurity assessment.
Frequently asked questions
Is a risk assessment under the Machinery Regulation the same as a cybersecurity risk assessment?
No. The risk assessment under the Machinery Regulation is a safety assessment of hazards according to EN ISO 12100. The cybersecurity risk assessment under the CRA looks at threats, vulnerabilities, and the resulting cybersecurity risk. Manufacturers of machinery with digital elements need both.
Is a threat model according to IEC 62443-4-1 enough for the CRA?
Not on its own. The threat model according to SR-2 is a sub-step. The CRA requires a complete cybersecurity risk assessment, including an estimate of the likelihood and impact of threats, risk evaluation, and risk treatment. For this, the draft EN IEC 62443-4-1 prAA adds a separate security risk management practice (SRM) that includes the threat model.
What is the difference between a TARA and a cybersecurity risk assessment?
TARA (threat analysis and risk assessment) is the automotive-specific method defined in ISO/SAE 21434 for assessing and treating cybersecurity risks. Cybersecurity risk assessment is the general umbrella term from the CRA. The two overlap strongly in content, but the term TARA belongs in the automotive context.
How is cybersecurity risk calculated?
In all the regulations and standards covered here, as a combination of likelihood and impact. The CRA defines cybersecurity risk accordingly in Article 3(37). EN 40000-1-2 (6.4.4), EN IEC 62443-4-1 prAA (SRM-5), and ISO/SAE 21434 (15.8) follow the same logic.
Which term should manufacturers use in their documentation?
For product security, use “cybersecurity risk assessment”. This term matches the terminology of the CRA. “Threat model” refers to the sub-step of identifying threats, and “TARA” remains reserved for the automotive context.
Once you separate safety from security and distinguish the umbrella term from the sub-step, the terms are easy to map.
Which assessment applies to your product?
Do you want to clarify which assessment is binding for your products and how to combine the Machinery Regulation, the CRA, and the relevant standards? Feel free to contact me.
