This thesis investigated cybersecurity, data privacy and regulatory challenges associated with Connected and Automated Vehicles (CAV) deployment. It puts forward the current state-of-the art of these three pillars and identifies existing limitations. The consolidated insights led to the importance of conducting cybersecurity and data privacy assessment using standardised methodologies. Threat Analysis and Risk Assessment (TARA) is considered, by the core regulations and standards, as the efficient way to keep systems at an acceptable level of risk. However, existing TARA frameworks are designed for general motor vehicles and do not address the specific properties of autonomous driving. To address this gap, the thesis proposes an enhanced framework, TARA 2.0, which offers a customised assessment for L4 and L5 CAVs. This new approach prioritises privacy concerns and provides a detailed analysis of expert objectivity during the assessment process. The framework is demonstrated through a step-by-step implementation and a proof of concept.