Towards the first international railway cybersecurity standard – why standards are important for safe railways

Cybersecurity standards such as CENELEC TS-50701 and IEC 62443 have been quietly working to ensure robust security and resilient operation of critical rail vehicles and infrastructure. Standards are sometimes overlooked, but they are a critical element in protecting transport networks from potential cyber threats.

Hear from Eddy Teze, Vice President of Cybersecurity Products and Solutions at Alstom, who was at the forefront of developing the first international railway cybersecurity standard, and understand the importance of adopting standards for railway companies.

A new international standard for the railway industry

Cybersecurity standards will allow the rail industry to better protect against cyber threats. Widely adopted, IEC 62443 already provides a comprehensive framework for securing industrial automation and control systems, including railway networks, devices, and operations centers.

Despite its coverage, IEC 62443 lacks a proven track record for mixed distributed systems, a key characteristic of railway systems, and the CENELEC technical standard TS 50701 was introduced to address that gap. To do. With TS 50701 laying the foundation for the first international railway cybersecurity standard (IEC 63452), future IEC 63452 standards will integrate cybersecurity management in railway systems and build on the IEC 62443 series to is built for a specific operational environment.

Why are cybersecurity standards important?

• Threat identification and risk assessment: Understand vulnerabilities and prioritize mitigation strategies.
• Security management: Implement measures such as network segmentation, access control, and intrusion detection.
• Incident response: Establish clear procedures to identify, contain, and recover from cyberattacks.
• Patch management: Keep your system up to date with the latest security fixes.

“The new standard provides powerful tools for building layered defenses against cyber threats,” Eddy explains. “It provides a holistic approach to addressing vulnerabilities across the system, from trains to back-office IT to remote shared resources.”

Alstom, a central figure in standard formation

Alstom recognizes the potential to transform industry standards and actively contributes to shaping them. Here are his four ways to leverage and interpret these standards to benefit railroad companies.

1. Future-proof security: “Cyber ​​threats are constantly evolving,” says Eddie. “The new standards are designed to be flexible and adaptable, allowing us to stay ahead of the curve and ensure long-term cybersecurity.” By adhering to these standards, railroads can You can be confident that your systems are built with future threats in mind.
2. Increased efficiency: Standardized security practices across the supply chain streamline communication and collaboration. This reduces integration costs, accelerates project schedules, and promotes interoperability between different systems and vendors.
3. Best practices for security operations and maintaining effective defenses: At Alstom, we believe the new standard is a way for railway companies to achieve a higher level of security awareness in their day-to-day operations by promoting a proactive security culture, and we believe that training and internal audits will improve the overall cybersecurity of the company. It has become standard practice to strengthen the system.
4. Building trust and transparency: Compliance with industry-recognized standards demonstrates a robust cybersecurity commitment. This builds trust with regulators, passengers and other stakeholders and ultimately enhances the reputation of the rail industry.

The future of cybersecurity standards

For railway companies looking to take advantage of the efficiencies and innovations of digitalisation, adopting these new standards is not just an option, it is a necessity. Eddy concluded, “By making cybersecurity a core part of digital transformation efforts, railroads can unlock the full potential of technology while protecting critical networks and operations.” .

The journey towards a truly safe and connected rail network begins with the seemingly invisible forces of standards and regulations that structure the industry. By working together and leveraging these powerful tools, the rail industry can build a future where security is fundamental to progress, not just an afterthought.

ISO27001 – Standards for Information Security Management Systems (ISMS).

IEC 62443 – A set of standards that defines the requirements and processes for implementing and maintaining electronically secure industrial automation and control systems (IACS).

CLC/TS 50701 – A technical specification introducing requirements and recommendations for addressing cybersecurity within the railway sector. TS 50701 was proposed to the IEC as an international standard and is currently under development as IEC 63452.