prEN IEC 63452:2025/prAA

Railway Applications – Cybersecurity prEN IEC 63452:2025/prAA

Scope

This document provides a consistent approach to manage cybersecurity of railway applications in a railway system. It is applicable across all domains within the scope of CLC TC 9X, which includes railway networks (including highspeed lines, mainlines, and freight-lines), urban transport networks (including metros, tramways, trolleybuses, and fully automated transport systems), and magnetic levitated transport systems. It includes rolling stock, fixed installations, operational management systems (including supervision, information, communication,
signalling, and processing systems) for railway operation.
This document refers and adapts the relevant part of the EN IEC 62443 series of standards to the railway domain, detailing the cybersecurity management, zoning, risk management, supply chain management, cybersecurity requirements, cybersecurity assurance, as well as operational, maintenance, and decommissioning requirements. It outlines the cybersecurity activities and cybersecurity deliverables needed to identify, monitor, and manage cybersecurity risks within a railway application life cycle and in its operational environment (railway system) to a level tolerable by the railway duty holder. It also provides guidance on how to secure legacy
system.
Furthermore, this document provides guidance on coordinating and synchronising the cybersecurity activities with the generic reliability, availability, maintainability, and safety (RAMS) life cycle defined in EN 50126:2017, and provides criteria for application to other life cycles.
Lastly, while this document does not provide safety requirements or constraints on the safety case for railway applications, it does offer guidance on the relationship between cybersecurity and safety.