The rail sector needs to rethink security to stay ahead of a growing range of challenges. Cyber threats should top that list. Yet, according to a recent study from the Mineta Transportation Institute, many transit agencies are ill-prepared for them.   

Combating digital threats demands integrating protective strategies at every stage of system development and operation and, increasingly, aligning them with the rail sector’s own emerging cybersecurity standard, IEC 63452.

Secure by Design

Historically, the rail industry treated cybersecurity as a discipline separate from systems engineering, often reactive and largely siloed rather than integrated from the start.

Today, best practice demands the opposite: security must be embedded from the initial concept phase, ensuring security controls are architecturally native to the system, not disruptive add-ons applied after the fact. This is the principle behind IEC 63452, the first international cybersecurity standard written specifically for rail. Expected to be published in 2026 and built on the industrial-security backbone of IEC 62443, it maps cybersecurity activities phase-by-phase onto the RAMS (Reliability, Availability, Maintainability and Safety) V-cycle that rail projects already run on, turning “secure by design” from an aspiration into a defined, traceable engineering process.

This "secure by design" approach is as much a project management imperative as it is an engineering one. Effective cybersecurity outcomes depend on integrating security early into the project's scope, schedules, budgets, and procurement activities. Effective project management ensures these security requirements are planned, resourced, and coordinated across the entire system lifecycle.

Because cyber defense activities generate highly sensitive assurance evidence, vulnerability logs, and design blueprints, project management protocols must include strict document control to prevent this sensitive data from becoming a target.

As the project moves from design to development and integration, these controls must be rigorously implemented, tested, and verified against defined standards before extending into operations and maintenance.

An Interconnected Risk Ecosystem

Cybersecurity within a railway project does not operate as a standalone technical function; it depends on and directly influences four related disciplines:

• Information Security: While traditional Information Technology (IT) focuses on enterprise networks, Operational Technology (OT) cybersecurity extends these principles straight to the tracks. Protecting the confidentiality, integrity, and availability of sensitive operational data, design blueprints, and personal passenger data is paramount. The greatest vulnerabilities often lie at the seams where enterprise IT networks interface with OT controls, as well as across organizational and supplier boundaries. These junctions require strict alignment, clear data classification, and robust protection strategies to prevent sensitive intelligence from being weaponized against control systems.
• Physical Security: Physical defense is a foundational dependency for rail cybersecurity. Even with the strongest logical firewalls, an attacker who can physically access a trackside enclosure or a critical server room can easily bypass or undermine digital controls. Cyber threat scenarios and network zoning models must deeply integrate physical access assumptions. This requires robust countermeasures such as electronic access restrictions (badges, PINs), time-synchronized CCTV, and environmental monitoring for tampering, working together to safeguard the operational environments they protect.
• Reliability, Availability, and Maintainability (RAM): Beyond physical access, cybersecurity directly influences system performance. Cyber incidents can degrade performance, eliminate critical redundancy, and prolong recovery times, bringing freight and passenger services to a halt. Integrating cybersecurity with RAM objectives ensures networks remain resilient enough to maintain high availability and recover quickly from faults, even under duress. This synergy safeguards software integrity and data flows, while secure remote maintenance access and patching strategies ensure the network remains maintainable over its long lifespan.
• Safety Integration: Ultimately, in rail operations, safety and security are inseparable. Traditional safety engineering accounts for random hardware failures or foreseeable misuse. In contrast, cyber threats are intelligent, intentional, and adaptable, specifically designed to bypass fail-safes or corrupt safety-critical data. The guiding principle of IEC 63452 is that cyber controls must support, not impair, essential safety functions. For the first time, a cybersecurity case now sits alongside the safety case – and where a safety argument depends on a security control staying in place (a Security-Related Application Condition, or SecRAC), that dependency must be specified, tested and handed over. Break the security condition, and the safety claim no longer holds. However, these protective activities, such as applying patches, changing configurations, or responding to live incidents, must be carefully engineered to align with strict safety approval processes, Safety Integrity Level (SIL) requirements, and daily operational rules.

The Path to Ongoing Resilience

Once a rail system enters revenue service, operators face another challenge: a cybersecurity posture begins degrading the moment it becomes static. This necessitates an active approach to promote ongoing resilience.

That can be difficult to achieve because standard enterprise IT strategies cannot simply be copy-pasted into a railway incident response plan. In a commercial IT department, neutralizing a threat might mean taking a server offline for a quick software update. Live railway systems cannot afford this luxury.

Securing a live rail network is a core operational function, distinct from enterprise IT. Updating a safety-critical control component often requires months of safety approvals before it can return to operation. In the United States, these run through the Federal Railroad Administration (FRA) and agency safety-assurance processes; in Europe, the equivalent independent checks are performed by an Assessment Body (AsBo) and a Notified Body (NoBo).

Instead of standard IT patching, railways require a risk-based, engineering-led methodology that uses formal risk assessments, compensating controls, and tightly managed change processes to prioritize service continuity and safe operations over immediate technical fixes.

Regulatory frameworks like the Transportation Security Administration (TSA) Security Directives set mandatory baselines, requiring rail operators to conduct risk assessments and report incidents. The NIST Transit Cybersecurity Framework Profile and CISA’s OT-specific guidance push in the same direction. These shouldn’t be "check-the-box" compliance exercises. Accounting for the rapid pace of technological change and evolving threat actors requires comprehensive strategies that look beyond static minimum requirements to consider factors such as:

• System-wide physical security assessments that evaluate not just major control centers, but the full distributed network of remote signaling assets and trackside enclosures.
• Digital tools and advanced analytics that enable deep packet inspection and anomaly detection, helping operators map potential attack chains before they escalate into service disruptions.
• Automated monitoring technologies, including intrusion detection sensors, time-synchronized cameras, and environmental monitors, to provide real-time insight into remote equipment and critical railway infrastructure.
• Integrated crisis management and incident response planning, ensuring that response strategies are both actionable and aligned to bridge the gap between tactical control room operations and strategic crisis room protocols.

Standards like IEC 63452 will shape this landscape faster than any single mandate – not because regulators cite them on day one, but because they show up as procurement and contract language. Once an agency or OEM writes “comply with IEC 63452” into an RFP, it becomes effectively mandatory for everyone bidding. Operators that understand the standard’s vocabulary (zones and conduits, security-level targets, the cybersecurity case) will be the ones setting the terms rather than reacting to them.

We are entering a new era of digital risk, requiring a fundamental rethink of how we protect our transit networks. This shift requires prioritizing critical vulnerabilities, modernizing incident response strategies, and moving away from static compliance milestones toward a continuously evolving approach. This owner-side, safety-integrated posture, aligning cyber strategy with the safety regime rail already runs on, will separate the operators who lead this transition from those who merely comply.

About the Author: Angela Schwarz is SVP, Transit and Rail Market Leader at WSP in the U.S., one of the world's leading professional services firms.