Rail Cybersecurity: TS 50701 in Practice | Advanced Masterclass

In the era of digital transformation, the European rail system is experiencing unprecedented technological evolution. Subsystems such as Control-Command and Signalling (CCS), radio block centres including the European Rail Traffic Management System (ERTMS), traffic management, diagnostics, and passenger services have transitioned from proprietary, isolated architectures to deeply interconnected, cloud-based ecosystems. While essential for efficiency, this connectivity has eroded the boundaries between corporate IT and operational technology (OT), significantly expanding the cyberattack surface.

This training course is designed for all professionals and organizations operating within the railway ecosystem, including Railway Undertakings (RU), Infrastructure Managers (IM), National Safety Authorities (NSA), Entities in Charge of Maintenance (ECM), and suppliers of technologies, services, Interoperability constituents, and Rolling stock (RST). In the railway sector, a cyber incident can result in traffic disruption across an entire corridor or, in the worst-case scenario, directly impact the physical safety of passengers.

The primary educational objectives of the course are structured around the following strategic and operational pillars:

1. Mastering the Regulatory Framework and Reference Standards The course aims to provide a clear and detailed roadmap for navigating complex European and international legislation. Participants will acquire the skills necessary to understand and apply the obligations arising from the NIS2 Directive, the Cyber Resilience Act (CRA), and the GDPR within the railway context. Concurrently, the course will delve into fundamental industry standards, such as the IEC 62443 series, the CENELEC TS 50701 Technical Specification, and the upcoming vertical standard IEC 63452. This will enable organizations to align their practices with the highest certification and compliance requirements for the Union rail system.
2. Implementing Secure Architectures and “Security by Design” A crucial objective is to teach the application of integrated security methodologies right from the design phase. The curriculum guides learners through the core concepts of “Defense in Depth” and the “Zero Trust” approach. Operators and suppliers will learn how to securely design Control-Command and Signalling (CCS) systems (e.g., SCADA, European Train Control System (ETCS)), On-board train communication networks, and Rolling Stock architectures. This training ensures that vulnerabilities to spoofing and man-in-the-middle attacks are mitigated at the root, securing both passenger trains and freight trains.
3. Developing Threat Response and Incident Management Capabilities The rise in targeted attacks, such as ransomware or the tampering of main signals, necessitates a shift in operational mindset. The course aims to train personnel capable of understanding the threat landscape and planning effective responses. Participants will be trained in “Compliance and Incident Management” procedures, learning to handle simulated cyberattacks, analyze events, and implement robust strategies for recovery and business continuity within Operation and traffic management (OPE).
4. Securing the Entire Ecosystem and the Supply Chain Railway resilience is not limited to a single train but requires a holistic vision. The course objectives extend to teaching best practices for the security of Station information systems, Wi-Fi networks, and the protection of passenger transactions. It also addresses cybersecurity applied to freight transport logistics, Intermodal Loading Units, and IoT systems for the predictive monitoring of critical Infrastructure such as track, bridges, and tunnels. Finally, the course trains participants on managing supply chain vulnerabilities, promoting proactive and secure collaboration among contracting entities, suppliers, and Notified bodies (NoBo).

In conclusion, the ultimate goal of this program is to transform organizations by making their personnel the first and strongest shield against cyber threats. The course will equip railway operators with the tools, a common vocabulary based on the ERA Railway Terminology Collection, and the technical competencies to ensure that the digital transformation of rail transport proceeds with maximum safety, protecting the business, the railway infrastructure, and the users of the network.

The “Railway Cybersecurity Masterclass” does not only provide a theoretical or regulatory framework, but dedicates a large part of its syllabus to the analysis of the railway threat landscape and specific “representative attack scenarios”. The objective is to enable railway professionals to translate fundamental security principles into daily practice, such as defense in depth, the zero trust approach, and security by design.

Through the application of the European regulatory framework (such as NIS2 obligations and the Cyber Resilience Act) and key standards (IEC 62443, TS 50701, and IEC 63452), learners will tackle the following concrete application areas:

1. Securing Control-Command and Signalling Systems (ERTMS and others) The course addresses the secure design of signalling systems. Through the analysis of these environments, participants will see typical cybersecurity controls and solutions to protect operational networks. Examples will particularly focus on the security of railway control systems, such as the European Rail Traffic Management System (ERTMS), ensuring that the systems governing the movement of the train and the trackside infrastructure are isolated and protected against unauthorized access.
2. Mitigation of Spoofing and Man-in-the-Middle On-board Today, Rolling Stock represents a complex and interconnected architecture. The course explores typical train architecture and related cyber threats, teaching how to mitigate specific vulnerabilities on-board. A central application case will be the security of communication systems on-board trains (ECN networks). The instructor will guide learners through the study of techniques for the direct mitigation of complex attacks, such as spoofing (device identity falsification) and man-in-the-middle (interception and alteration of data in transit). The practical application will also extend to data management and the protection of event recording systems (on-board recording devices).
3. Protection of Stations and Digital Passenger Services Railway cybersecurity also encompasses the safeguarding of public environments. We will see application scenarios focused on public information systems (PIS) installed at stations, as well as the securing of public Wi-Fi networks and video monitoring systems. We will cover the convergence with GDPR (Data Protection) requirements for the protection of personal data and financial transactions occurring through online passenger systems.
4. Security of Freight Transport, Infrastructure, and Supply Chain We will also look at advanced logistics and predictive monitoring. Practical examples will address security in freight management systems, such as the continuous tracking and monitoring of cargo. Concurrently, we will analyze the integration of cybersecurity within predictive maintenance systems for the protection of sensors installed on critical railway infrastructure (track, bridges, and tunnels). As a corollary, practical cases will deal with the management of vulnerabilities in the supply chain and validation processes in collaboration with suppliers and security certifiers (conformity assessment bodies).

Cyberattack Simulations and Incident Management To test actual operational readiness, the course concludes with practical lessons dedicated to incident management (Compliance and Incident Management). In addition to proactively planning responses to potential crises, the program includes “cyberattack simulations”. Critical scenarios will be analyzed and recovery strategies studied, ultimately ensuring the resilience of the critical infrastructure within the rail system.

In the international railway sector, events in recent years have demonstrated that cybersecurity can no longer be regarded as an optional choice or simply as good corporate practice. It has become a strategic and regulatory requirement: underestimating cybersecurity can expose railway organisations to unacceptable levels of risk.

The increasing convergence between traditional Information Technology (IT) networks and Operational Technology (OT) — including signalling systems, train control and traffic management systems such as ERTMS and SCADA, and rolling stock onboard architectures — has significantly expanded the attack surface of critical railway infrastructure.

This evolution is also reflected in CLC/TS 50701: previously isolated industrial systems are increasingly interconnected and make greater use of standard protocols and commercial components, making cybersecurity a key concern for critical railway systems.

The CIFI Railway Cybersecurity Masterclass therefore places the main cybersecurity standards and European regulatory requirements at the core of its programme, providing railway organisations with a structured path towards effective and sustainable cybersecurity compliance.

1. The European Regulatory Framework: NIS2 and the Cyber Resilience Act (CRA)

NIS2 and the Cyber Resilience Act establish key regulatory requirements for cyber resilience in Europe.

NIS2 Directive. NIS2 establishes measures aimed at achieving a high common level of cybersecurity across the European Union by strengthening cybersecurity risk management, resilience and incident response. It covers critical sectors including energy, transport, banking and financial market infrastructures, healthcare, water, digital infrastructure, public administration and space.

Within the transport sector, NIS2 covers aviation, rail, water and road transport. In the railway sector, it introduces cybersecurity governance, risk-management and incident-reporting obligations for organisations falling within its scope, including in particular Railway Undertakings (RUs) and Infrastructure Managers (IMs).

This terminology is also consistent with CLC/TS 50701, which uses the concept of the railway duty holder and identifies railway undertakings and infrastructure managers as its typical duty holders.

Cyber Resilience Act (CRA). The CRA addresses cybersecurity across the digital product supply chain by introducing mandatory cybersecurity requirements for products with digital elements, covering hardware and software products and their associated components. Its principles reinforce the need to address cybersecurity throughout the product lifecycle, including vulnerability handling and secure product development.

2. The Industrial OT Framework: IEC 62443 Series

To implement cybersecurity measures within Industrial Automation and Control Systems (IACS) and Operational Technology environments, the IEC 62443 series provides the fundamental international framework.

The CIFI Railway Cybersecurity Masterclass explains how its core concepts and models can be applied in the railway environment, including network segmentation into Zones and Conduits, the definition and derivation of Target Security Levels (SL-T), and the application of the seven Foundational Requirements (FRs).

These concepts are directly incorporated into CLC/TS 50701. The railway specification requires the System under Consideration (SuC) to be analysed through initial and detailed risk assessment, partitioned into zones and conduits, and provided with cybersecurity requirements and countermeasures appropriate to the identified risks.

In the rolling stock domain, for example, the TS provides zoning examples that distinguish between functions such as signalling/ATP, TCMS, doors, traction and braking, diagnostics, Passenger Information Systems and public Wi-Fi, according to their different criticalities and security needs.

3. The Railway-Specific Framework: CLC/TS 50701

While IEC 62443 provides a generic industrial cybersecurity framework, CLC/TS 50701 – Railway applications – Cybersecurity translates and adapts these principles specifically to the railway domain.

CLC/TS 50701 provides railway operators, system integrators and product suppliers with guidance and specifications for managing cybersecurity within the EN 50126-1 RAMS lifecycle. It applies to Communications, Signalling and Processing, Rolling Stock and Fixed Installations.

The specification provides a consistent approach to cybersecurity risk management throughout the railway system lifecycle and addresses the interfaces between cybersecurity and safety, while maintaining the distinction between the two disciplines.

Its objective is not simply to prescribe individual security controls. It provides a structured process through which cybersecurity risks can be identified, assessed, mitigated and managed to an acceptable level, supported by appropriate cybersecurity requirements, verification, validation and assurance activities.

Importantly, CLC/TS 50701 states that compliance can be used to demonstrate that a railway system is at the state of the art in terms of cybersecurity, fulfils its targeted Security Level and maintains its security throughout operation and maintenance.

4. The Evolution towards an International Railway Cybersecurity Standard: IEC 63452

The CIFI Masterclass also looks beyond the current European framework by examining IEC 63452 – Railway applications – Cybersecurity, the international standardisation development intended to establish a globally applicable railway cybersecurity framework.

The IEC work builds directly upon CLC/TS 50701. The original IEC TC 9 project explicitly established that the international standard would be based on TS 50701, while maintaining consistency with the horizontal IEC 62443 series.

The objective is to provide a consistent international approach to the management of railway system cybersecurity, mapping and adapting IEC 62443 requirements to the railway application domain and its operational environment, while interfacing the cybersecurity process with the railway RAMS lifecycle.

This evolution is particularly significant because it extends the railway-specific cybersecurity approach developed within CENELEC towards an international IEC framework applicable across the global railway industry.

Why are these standards and regulations a cornerstone of the CIFI Masterclass?

Using CLC/TS 50701, IEC 62443, IEC 63452, NIS2 and the CRA as a common thread throughout the Masterclass enables participants to move beyond theoretical cybersecurity concepts and understand how cybersecurity requirements can be translated into a structured, risk-based approach throughout the railway system lifecycle.

Participants learn how to identify and assess cyber risks, define cybersecurity requirements, establish appropriate security architectures, apply suitable countermeasures, manage residual risk and develop the evidence required to support cybersecurity assurance.

This approach is particularly relevant in the railway sector, where cybersecurity requirements need to be allocated and traced from system level down to subsystems, components and devices. CLC/TS 50701 explicitly calls for such traceability and for a top-down allocation of requirements combined with bottom-up verification.

Ultimately, this provides railway organisations with the methodology required to demonstrate a state-of-the-art approach to cybersecurity, support cybersecurity assessment and assurance activities, and build effective cyber resilience throughout the railway value chain.

The deeply interconnected nature of the modern Union rail system has radically transformed the threat landscape. Once isolated and proprietary subsystems, such as Control-Command and Signalling (CCS), traffic management, and traction control, are now open, data-driven architectures, blurring the traditional boundaries between corporate IT and operational technology (OT). This evolution makes cybersecurity a shared and transversal responsibility. For this reason, the “Railway Cybersecurity” course is addressed to a broad, diverse, and multidisciplinary audience, encompassing all key stakeholders within the railway value chain.

Specifically, the training program has been meticulously structured to meet the needs of the following professional categories and organizations:

1. Railway Undertakings (RU) and Infrastructure Managers (IM) These entities represent the operational core of rail transport. The course is essential for Chief Information Security Officers (CISOs), Safety Managers, operational directors, and network engineers. For Infrastructure Managers, the training focuses on protecting trackside control-command and signalling networks (e.g., SCADA systems, ERTMS) and securing IoT technologies applied to the predictive monitoring of infrastructure elements like track, bridges, and tunnels. For Railway Undertakings, the focus is on the secure architecture of Rolling Stock (RST), the protection of on-board control-command and signalling and train communication networks (ECN), as well as the securing of Passenger Information Systems (PIS) and station Wi-Fi networks.
2. Entities in Charge of Maintenance (ECM) and Technical Staff With the increasing digitalization of maintenance activities, workshop engineers and operators face new challenges related to remote diagnostics and software updates. The course provides these professionals with the skills to securely manage data, on-board recording devices, and maintenance processes, preventing intrusions via test and diagnostic equipment.
3. Technology Suppliers, System Integrators, and Manufacturers (Supply Chain) In compliance with the European Cyber Resilience Act (CRA) and the “Security by Design” approach, designers, software developers, and system architects in the railway industry must imperatively integrate security requirements from the conceptual phase. The target audience includes those who develop Interoperability constituents, learning essential methodologies to mitigate critical vulnerabilities such as spoofing or man-in-the-middle attacks.
4. Incident Management Teams and CyberSOC Operators A vital section of the audience consists of personnel dedicated to monitoring and crisis response, including operators of railway Security Operations Centers (CyberSOCs). They will receive training on attack simulation procedures, cybersecurity incident management, response planning, and recovery strategies to ensure business continuity.
5. National Safety Authorities (NSA), Standardisation Bodies, and Conformity Assessment Bodies Inspectors, assessors, and auditors working for supervisory authorities or Notified Bodies (NoBo) and Designated Bodies (DeBo) will find the tools to understand the interdependence between physical safety and cybersecurity. The course provides the foundations for assessing regulatory compliance against directives like NIS2 and key standards such as IEC 62443, CENELEC TS 50701, and the upcoming IEC 63452.
6. Logistics and Freight Transport Operators Finally, the course addresses professionals in the cargo sector, covering targeted topics such as the protection of tracking and monitoring systems for freight trains, data security, and the safeguarding of critical communications between intermodal terminals and various logistics operators.

In summary, the course is intended for anyone operating in the railway sector, starting from a fundamental premise explored in the early lessons: an organization’s strongest and most impenetrable firewall is not made of code or algorithms, but of the staff themselves, suitably trained and aware.