Cybersecurity Awareness
Project tasks
- PROSE presentation on the current state of the railway industry
- PROSE presentation on the future development of the railway industry
- In-depth discussion on TS 50701, security vs. safety and discussion on standards
- Interactive brainstorming on the gap analysis
- Consolidation of the results of the gap analysis and prioritisation
- Analysis of the customer’s security documentation
- Summary and definition of the next steps and goal
Our approach
The digital transformation of the rail industry is accelerating at an unprecedented pace. With increasing connectivity comes the urgent need to improve cybersecurity frameworks to ensure resilience against evolving threats. A recent industry workshop highlighted key findings on the current state of cybersecurity in railway systems and the expected regulatory changes that will shape the future.
Security in the railway sector has traditionally focused on protecting people and machines. However, cybersecurity has now become a critical factor in protecting IT systems, infrastructure and sensitive data. Despite their relevance, many existing railway standards provide only limited guidance on cybersecurity. Important standards such as EN 50126, EN 50716 and EN 50129 recognise security concerns but do not provide concrete measures. The IEC 62443 series, which emerged in the 2010s, has become a fundamental security framework, but its full integration into railway systems is still a work in progress.
A key challenge in cybersecurity is the human factor. Unclear role definitions in projects can lead to security risks – for example, through software updates that are implemented without sufficient validation and can compromise critical systems. Clear role definitions and structured safety processes are necessary to minimise such risks.
The future of railway safety will be shaped by new guidelines and harmonised standards designed to close existing safety gaps. Several regulatory developments will redefine safety requirements in the sector. The NIS 2 Directive obliges operators of critical infrastructure, including the railway industry, to take comprehensive cybersecurity measures. Companies in the supply chain will also have to prove their compliance in future.
The Cyber Resilience Act (CRA) places strict security requirements on manufacturers and suppliers of digital products, including railway technology. IEC 63452 is expected to become a global benchmark for cybersecurity in railway systems and combines elements from IEC 62443 and TS 50701 to create a standardised security framework. In addition, there is a trend towards common cybersecurity services – for example in the areas of authentication, logging and network security to ensure standardised protective measures for critical rail systems.
Customer benefit
Railway operators, manufacturers and suppliers must proactively adapt to these new regulations. Key recommendations include:
- Identification and inventory of all assets (especially SW)
- Conducting cybersecurity risk assessments to identify vulnerabilities
- Establish clear security requirements for suppliers and ensure compliance throughout the value chain
- Implementing security-by-design principles in the development of new products
- Strengthen security incident response capabilities to effectively manage threats
By taking a proactive approach, the industry can ensure the safety, reliability and resilience of railway systems in an increasingly connected world.