Framework overlap

Does Liechtenstein DPA cover ISO/SAE 21434?

You hold Liechtenstein DPA and have been told to do ISO/SAE 21434. Here is how much overlaps, control by control.

32% of ISO/SAE 21434 you already have

Liechtenstein DPA already covers about 32% of ISO/SAE 21434, leaving 34 of 50 controls as genuinely new work.

Already covered 7 Likely covered 9 New work 34

What is genuinely new work

Nothing in Liechtenstein DPA reaches these. This is the list to scope.

21434-10
Product Development at System Level
21434-10.4
Hardware and Software Component Requirements
21434-11
Cybersecurity Validation
21434-12
Production
21434-13
Operations and Maintenance
21434-14
End of Cybersecurity Support and Decommissioning
21434-15.3
Asset Identification (TARA Step 1)
21434-15.5
Threat Scenario Identification (TARA Step 2)
21434-15.6
Impact Rating (TARA Step 3)
21434-15.7
Attack Path Analysis (TARA Step 4)
21434-15.8
Attack Feasibility and Risk Determination (TARA Step 5)
21434-15.9
Cybersecurity Assurance Level (CAL) and Risk Treatment
21434-5
Cybersecurity Governance
21434-6
Cybersecurity Culture and Competence
21434-7
Continuous Cybersecurity Activities
21434-8
Risk Assessment Methods
21434-9.3
Item Definition
21434-9.4
Cybersecurity Goals and Claims
21434-Annex-E
Distributed Cybersecurity Activities and Supplier Management
ISO21434-01
Information security policy framework
ISO21434-02
Management direction and commitment
ISO21434-03
Policy review and update procedures
ISO21434-05
Contact with authorities and special interest groups
ISO21434-06
Asset inventory and ownership
ISO21434-10
Media management and disposal
ISO21434-11
Access control policy and enforcement
ISO21434-20
Key lifecycle management
ISO21434-21
Operational procedures and responsibilities
ISO21434-22
Protection from malware
ISO21434-26
Audit considerations
ISO21434-28
Network service security
ISO21434-29
Segregation in networks
ISO21434-30
Information transfer policies
ISO21434-31
Secure messaging
Show the 16 you already have
ISO21434-12
User access management and provisioning
ISO21434-14
Privileged access management
ISO21434-15
Access review and recertification
ISO21434-16
Cryptographic policy and key management
ISO21434-17
Encryption of data at rest
ISO21434-18
Encryption of data in transit
ISO21434-19
Certificate management
ISO21434-04
Roles and responsibilities definition
ISO21434-07
Acceptable use of assets
ISO21434-08
Information classification and labeling
ISO21434-09
Asset handling procedures
ISO21434-13
Authentication and password management
ISO21434-23
Backup and recovery procedures
ISO21434-24
Logging and monitoring
ISO21434-25
Technical vulnerability management
ISO21434-27
Network security management

How this is calculated

Already covered means a mapping runs from a control in Liechtenstein DPA to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition