Built on the standards your auditors read
Each standard says what the analysis must contain. SecBerg Core structures the work so the evidence comes out of it.
Automotive
ISO/SAE 21434
Road vehicles: cybersecurity engineeringA cybersecurity engineering process across the vehicle lifecycle, with threat analysis and risk assessment at its centre.
TARA from the item model to risk treatment, cybersecurity goals and concepts, and phase reviews.
UNECE R155
Cyber security and cyber security management systemA certified cyber security management system for vehicle type approval. Mandatory for every new vehicle sold in the EU since July 2024.
Mitigations from the regulation's Annex 5 catalogue, and the evidence a type-approval authority asks to see.
UNECE R156
Software update and software update management systemA managed process for software updates, including updates over the air.
Software versions tracked on the bill of materials, and a released revision of the analysis for every change.
GB 44495
Technical requirements for vehicle cybersecurity, ChinaChina's mandatory vehicle cybersecurity requirements, applied to new vehicle types from January 2026.
Built on the same TARA and evidence as ISO/SAE 21434.
ASPICE for Cybersecurity
Process assessment model for cybersecurity engineeringA process assessment model that carmakers use to assess how their suppliers engineer security.
Process evidence from reviews, work products and the audit ledger.
Also in use: AIS 189 in India and the MLIT rules in Japan, both built on UNECE R155.
Railway
CLC/TS 50701
Railway applications: cybersecurityCybersecurity for railway systems, applying the IEC 62443 zones, conduits and security levels to rail.
Zones, conduits and target security levels, on the same model you use for IEC 62443.
IEC 63452
Railway applications: cybersecurityThe international railway cybersecurity standard, built on CLC/TS 50701.
The same model and method as CLC/TS 50701.
Maritime
IACS UR E26 and E27
Cyber resilience of ships, and of on-board systems and equipmentE26 covers the ship as a whole, E27 the systems and equipment on board. Both apply to ships contracted from July 2024.
The ship's networks as zones and conduits, and the equipment requirements handed to each supplier.
Industrial and every industry
IEC 62443
Security for industrial automation and control systemsZones and conduits, a target security level for each, and requirements across seven foundational requirements.
Target security levels per zone and conduit, and the gap per foundational requirement, on one grid.
Cyber Resilience Act
EU Regulation 2024/2847Security requirements for products with digital elements sold in the EU. Reporting duties apply from September 2026, the rest from December 2027.
Software bills of materials from the model, and advisories matched to the products that ship the affected part.
Start with
one programme
Live within a month. Proven on real work within three.
- 01Book a workshopBring one programme and the standards it answers to.
- 02Model it togetherOur engineers build it with yours, live in the platform.
- 03Run the pilotReal work, real evidence, signed off in three months.