Rail Cybersecurity Guide (TS 50701): Zones, Conduits and Signalling Security

Railways combine safety-critical signalling, decades-old field equipment and modern IT on networks that stretch for thousands of kilometres, and the security methods built for factories do not fit them without adaptation. The European answer is CENELEC CLC/TS 50701, which applies IEC 62443 to rail and is being turned into the international standard IEC 63452. This guide explains how rail systems are divided into zones and conduits, how target security levels are assigned, how signalling and rolling stock are protected, and how TS 50701 sits beside the TSA rail security directives in the US and NIS2 in the EU. It is written for infrastructure managers, railway undertakings, metro operators and the suppliers who build and maintain their systems. General OT and IEC 62443 practice is covered in the linked guides and not repeated here.

Key takeaways

• TS 50701 is IEC 62443 adapted for rail. It keeps the zones, conduits and security levels of IEC 62443 and aligns them with the railway RAMS life cycle, and IEC 63452 is its international successor.
• Zone by safety first. ENISA's railway guidance puts safety-related assets in dedicated zones and treats a whole zone as safety-related if any safety asset sits in it.
• Signalling usually needs the highest targets. ENISA reports that signalling zones typically receive target security level SL-T 3, sometimes SL-T 2, while fixed installations need at least SL 1.
• Radio is part of the attack surface. In August 2023 unauthenticated analogue radio-stop commands halted about 20 trains in Poland, according to The Record.
• Regulation is converging on the same controls. The TSA rail directives and NIS2 both demand segmentation, access control, monitoring, patching and incident reporting.

Standards status: TS 50701 and IEC 63452

CLC/TS 50701 is a CENELEC Technical Specification. ENISA's 2021 report refers to the 2021 edition, and DIN lists CLC/TS 50701:2023 as the previous edition of the IEC 63452 project. TS 50701 was offered to the IEC and developed as IEC 63452, Railway applications: Cybersecurity. Drafts circulated as IEC 9/3232/CDV and prEN IEC 63452:2025, DIN showed a planned publication of July 2026, and a supplier article in April 2026 still described the standard as proposed with release scheduled for the second quarter of 2026. We could not confirm from an IEC or CENELEC source that IEC 63452 had been published when this guide was checked in October 2026, so confirm the current edition with your national standards body before referencing it in a contract. A CENELEC work item for EN IEC 63452 also proposes European annexes, including Annex ZC on alignment with NIS2 and the Cyber Resilience Act.

Why rail is different from plant OT

• Distributed systems: interlockings, trackside equipment and radio block centres are spread along lines, with physical access points every few kilometres and communications over long-distance networks. Alstom notes that IEC 62443 had little track record for these mixed distributed systems, which is the gap TS 50701 fills.
• Safety cases: signalling and train protection are safety-approved. A security change, even a patch, can invalidate the safety case, so security work has to run inside the safety assurance process, not beside it.
• Long life: rolling stock and signalling stay in service for decades, so legacy systems are the norm. ENISA's advice is to give legacy systems their own zones protected by firewalls on the conduits.
• Moving assets: trains connect to wayside systems, depots and maintenance networks, and each connection is a conduit.
• Several duty holders: infrastructure managers, railway undertakings, rolling stock owners and maintainers each own part of the system, so zone ownership and conduit agreements cross organisational boundaries.

Zones and conduits for railway systems

ENISA's 2022 report Zoning and Conduits for Railways builds on TS 50701 and IEC 62443 and sets out a nine-step zoning process (ZCR 1 to ZCR 9). It is the clearest public method for rail and maps well onto the TS 50701 risk assessment.

• Communication matrix: ENISA's matrix marks each zone pair as two-way ("+"), read-only ("R") or prohibited ("-"). It becomes the rule base for conduit firewalls and the baseline for monitoring.
• Conduits carry the security level: in ENISA's model conduits are the gateways between zones and carry the security devices; each conduit is assigned a target security level from SL-T 0 to SL-T 4. Higher levels cost more and can affect process communication, so they should follow the risk assessment rather than be set uniformly high.
• Separate IT from OT: business IT and control assets go in different zones, with corporate IT never a transit route between OT zones.

Typical rail zone model

Signalling, train radio and rolling stock

• Signalling: treat each interlocking area and radio block centre as part of the signalling core zone, with only documented, read-only or tightly filtered conduits to traffic management. Changes to signalling software and data go through both security and safety change control.
• Train radio: the Polish incident showed that an emergency stop function that does not authenticate the sender can be abused by anyone with a radio. CERT Polska, quoted by The Record, said the analogue system lets any train or post signal an emergency stop to nearby trains. Migration to authenticated digital radio removes the weakness; until then, monitor for unexpected stop commands and have operational procedures to resume service quickly.
• Rolling stock: keep passenger connectivity and infotainment in a separate on-board zone from train control and management. Depot wireless networks and maintenance laptop connections are conduits and need the same controls as fixed conduits.
• Positive Train Control in the US: TSA directive SD 1580/82-2022-01C requires PTC systems to be treated as Critical Cyber Systems, with only limited physical-security exceptions for locomotive components.

The regulatory picture

TS 50701 is a voluntary standard; obligations come from regulation and from contracts that cite it. Status below was checked in October 2026.

The 01C revision was set to expire on 2 May 2025, and TSA has renewed the series repeatedly, so check TSA for the revision currently in force. Under 01C the assessment plan is due within 60 days of plan approval, an architecture design review within 12 months and at least every two years after, and at least one third of measures must be assessed each year so that all are covered in three years.

Where identity fits

• Maintainer and supplier access: signalling and rolling stock suppliers often need remote diagnostics. Broker the access, require MFA, limit it to the zone needed and record sessions. See the OT Remote Access Guide.
• Shared accounts: TSA 01C requires limits on shared accounts and least privilege; control centre and depot workstations are where shared logins persist.
• Device and system identities: wayside and on-board equipment authenticate to each other with keys and certificates; inventory them and plan their renewal across the asset's life.
• Domain trust: TSA 01C asks for periodic review of domain trust relationships, which matters where OT domains trust corporate Active Directory.

See the OT and ICS Identity and Access Guide and the Transportation Identity and OT Access Guide.

How to implement

1. Define the system under consideration: agree the boundary, duty holders and interfaces for the line, fleet or control centre in scope. See the OT Asset Visibility Guide.
2. Inventory and initial risk: complete ZCR 1 and 2, rating safety, availability and financial impact.
3. Draw zones and the communication matrix: complete ZCR 3 and 4. Capture current traffic passively first so the matrix reflects real flows.
4. Set SL-T per conduit: run the detailed risk assessment and record countermeasures in a cybersecurity requirements specification that suppliers sign up to.
5. Integrate with safety: route every security change affecting a safety-related zone through the safety case and RAMS process before deployment.
6. Migrate in monitor mode: deploy conduit firewalls logging only, compare against the matrix for a full operating cycle, including timetable changes and maintenance windows, then enforce. Keep the previous rule set ready to restore if a safety or service function is affected, and document the missing flow before reapplying.
7. Operate: monitor conduits, reassess at least annually, and feed findings into procurement for the next fleet or resignalling project.

Decision guidance

• New build versus brownfield: on resignalling and new fleets, write TS 50701 or IEC 63452 requirements and SL-T into the tender. On existing lines, start with zoning and conduit controls around legacy islands rather than changing safety-approved equipment.
• Which standard to cite: cite IEC 63452 once your standards body confirms publication; until then cite CLC/TS 50701:2023 and require suppliers to state their plan for the successor.
• Infrastructure manager versus operator: infrastructure managers own signalling and fixed installations; railway undertakings own rolling stock and operational IT. Agree conduit ownership and incident reporting between them in writing.
• Large versus small operators: a national infrastructure manager can run its own OT monitoring and rail-specific risk method; a small heritage, freight or tram operator can apply the same zoning steps at smaller scale and buy monitoring as a service.

Detection and measurement

Monitor traffic on every conduit against the communication matrix, sign-ins to supplier remote access, configuration and software changes on signalling and train control, and unexpected emergency or stop commands on train radio. Metrics:

• Percentage of the system under consideration covered by an approved zone model and communication matrix.
• Number of conduit flows not in the matrix found per month, trending to zero.
• Percentage of conduits whose achieved security level meets the SL-T.
• Percentage of supplier access paths brokered, time-limited and using MFA.
• Known exploited vulnerabilities on critical cyber systems beyond the agreed remediation time.
• Time to restore normal service after an exercise involving loss of control centre IT.

Framework mapping

Common failure patterns

• Uniform SL-T: setting every conduit to the highest level makes projects unaffordable and drives exceptions; setting all to the lowest leaves signalling exposed.
• Corporate IT as transit: control centre traffic routes through business IT, so an IT ransomware incident forces an operational shutdown. The Colonial Pipeline ransomware attack shows the pattern: an unused VPN account without MFA led to IT compromise, and the operator shut down pipeline operations to contain it.
• Security outside the safety case: patches or firewall rules applied to safety-related zones without safety assessment, or security work deferred indefinitely because nobody owns the safety impact.
• Unauthenticated radio and legacy protocols: assuming that physical remoteness protects functions any transmitter can trigger.
• Supplier access left open: permanent maintenance connections to signalling or rolling stock that nobody reviews.
• Zone models that stop at handover: the model is approved for the project but not maintained when the line or fleet changes.

Lessons from incidents

On the weekend of 26 August 2023, unauthorised radio-stop signals halted about 20 freight and passenger trains in Poland, and Polish police arrested two men. The Record reported that the radio system lacked encryption and authentication and that Poland planned to move to GSM-based radio with both. No network was breached; the attack used a designed safety function that trusted any sender. The defensive lessons are to include radio and safety functions in the threat model, to treat sender authentication as a migration priority, and to have operational procedures that restore service quickly after spurious stops. See the OT Incident Response Guide.

Practitioner checklist

• Confirm which edition of TS 50701 or IEC 63452 your contracts cite and plan the transition.
• Define the system under consideration and its duty holders.
• Complete an asset inventory and initial risk assessment covering safety, availability and cost.
• Build the zone model and communication matrix, with safety assets in dedicated zones.
• Assign SL-T per conduit from a detailed risk assessment and record it in the CRS.
• Put legacy equipment in its own zones behind conduit firewalls.
• Broker and record all supplier remote access with MFA.
• Route security changes in safety zones through the safety case process.
• Test TSA or NIS2 incident reporting with a control centre exercise.
• Reassess the zone model at least annually and on every major change.

Standards and references

• ENISA: Zoning and Conduits for Railways
• ENISA: Railway Cybersecurity, Good Practices in Cyber Risk Management
• TSA: Security Directive 1580/82-2022-01C, Rail Cybersecurity Mitigation Actions and Testing
• Federal Register: Ratification of Security Directives for critical rail entities
• DIN: Draft DIN EN IEC 63452 Railway applications, Cybersecurity
• BSI: EN IEC 63452 European annexes work item
• NIST: Cybersecurity Framework 2.0
• The Record: Two suspects arrested following Poland railway hack

Related NHI Mgmt Group resources: OT Security Guide · IEC 62443 Guide · OT and ICS Identity and Access Guide · NIS2 Directive Guide. This guide summarises rail cyber security standards and regulations and is not legal advice.