Safety and availability come first
A cyber weakness can stop trains, affect signalling interfaces, or force degraded operation. Treatment has to respect safety cases and service windows.
Transportation · Rail, metro, tram
Rail and transit cybersecurity that understands signalling, safety, and service.
CYNAPSE connects stations, depots, control centres, signalling, rolling stock interfaces, telecom, AFC, and SCADA into one governed risk and assurance model, from design through commissioning and operation.
The challenge
What sets Transportation apart.
Signalling, control centres, rolling stock, and station systems in one evidence trail that satisfies operators, integrators, and assessors.
Many parties, one accountable operator
Integrators, subsystem suppliers, and maintainers each own a piece. The operator still has to prove the whole system is secure at handover.
Evidence for acceptance
Assessors expect requirements, zones, security levels, and validation evidence that trace cleanly from design to commissioning.
In scope
The systems you can model.
Each system becomes assets, zones, and interfaces in one project, so risk, exposure, and evidence stay connected to what actually runs.
- Signalling (CBTC, ETCS, interlocking)
- Operations control centre
- SCADA and power supply
- AFC and ticketing
- Telecom backbone and radio
- Passenger information and CCTV
- Depot and maintenance systems
- Rolling stock interfaces
How CYNAPSE helps
Engineer cyber resilience across the full transport system.
RABUILD GRC carries the risk, controls, and security case. Exposure Engine ranks vulnerabilities by what the asset does. Navai Assistant guides each step.
Model systems and interfaces
Trace system-to-system communication paths, dependencies, trust boundaries, zones, conduits, traffic flows, and shared network services.
Protect service and safety continuity
Assess scenarios against passenger operations, command and control, safety functions, availability requirements, and recovery priorities.
Align engineering assurance
Structure requirements and evidence around IEC 62443, EN 50701, contractual obligations, and project security levels.
Deliver defensible acceptance
Connect controls, validation procedures, findings, treatment, approvals, and reports from design through commissioning and operation.
Standards
The standards your assessors will ask about.
Built in: control libraries ship with RABUILD GRC. Traced: captured as project requirements and linked to the same controls, evidence, and reports.
CLC/TS 50701 · EN 50701Cybersecurity for railway applicationsBuilt in
IEC 62443Zones, conduits, and security levels for control systemsBuilt in
ISO/IEC 27001Information security managementBuilt in
NIST CSF 2.0Cyber risk outcomes for leadershipBuilt in
EN 50126 / 50129RAMS and safety case interfacesTraced
NIS2 and national rulesOperator obligations for essential transport servicesTraced
Example
A new metro line before handover
An illustrative engagement showing how the work flows through CYNAPSE.
The situation
The integrator delivers signalling, SCADA, and telecom from three suppliers. The operator must accept the line with a security case the assessor will sign.
- In CYNAPSE
- 1Model the line, stations, OCC, and depot as zones and conduits, and set target security levels per zone.
- 2Assess scenarios such as remote access abuse on the SCADA conduit, and record treatments and owners.
- 3Generate validation procedures from the applied hardening and collect results per subsystem.
What you get
A security case and acceptance report tracing each EN 50701 / IEC 62443 requirement to controls, test evidence, and accepted residual risk.
See report typesFurther reading
Practical guidance from the Knowledge Center.
Field notes and playbooks written for teams that run critical systems.
Case Study
Segmenting Signaling Infrastructure Across a Multi-Line Rail Network
A regional rail operator used IEC 62443 zoning to separate signaling and interlocking systems from a converged corporate/OT network without...
Read Knowledge ArticleEN 50701 in Practice: What Rail Operators Should Ask Their Suppliers
Concrete supplier and lifecycle questions that put EN 50701's supply chain expectations into practice.
Read Knowledge ArticleScoping IEC 62443 Zones and Conduits for a Real Facility
A practical, step-by-step approach to defining zones and conduits instead of copying a generic reference diagram.
Read
Other industries
See CYNAPSE on a scenario like yours.
We walk through your systems, standards, and reporting needs, using the example above as a starting point.