INDUSTRY FACT FILE · RAILWAYS, METRO & SURFACE TRANSPORT

Cybersecurity FAQs for Railways, Metro and Surface Transport

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, signalling and operations heads, ticketing and commercial teams, toll operators, procurement and privacy teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, safety and compliance 3.  Category 3: Signalling, control, communications and suppliers 4.  Category 4: Ticketing, payments and SOC 5.  Category 5: Passenger data, privacy and partners

Audience: Boards, chairmen, MDs, general managers and CISOs

Q1. Why are railways, metros and transport operators cyber targets?

They run safety-critical operations that cannot stop without public impact, carry symbolic value for hacktivists and states, process enormous volumes of small payments and depend on suppliers—attracting ransomware groups, saboteurs, fraudsters and bots alike.

Q2. Which incidents should the Board know about?

Denmark's trains stopped for hours in October 2022 after an attack on supplier Supeo; Transport for London's 2024 intrusion cost about £29 million; ransomware locked around 2,000 Muni systems in 2016 and halted Pittsburgh's light rail in December 2024; false messages hit Iranian station displays in 2021.

Q3. What are the biggest risks for an Indian transport operator?

Ransomware across stations and ticketing, intrusion into signalling and control, supplier access and outages, bots and fraud on ticketing and toll platforms, false passenger information and weak monitoring of stations and OT.

Q4. Why link cybersecurity and railway safety?

Attacks on interlocking, Kavach, CBTC or control centres can create unsafe conditions or force services to stop, so cyber risk belongs inside the safety case and the CRS and CMRS certification process.

Q5. What should the Board review each quarter?

OT and supplier risks, ticketing platform test results, incidents and near misses, audit findings, NCIIPC and CERT-In status, backup and fallback test results, SOC coverage and exercise outcomes.

Q6. Who should own OT security?

The CISO jointly with signalling, telecom, electrical and operations leadership, with a single asset inventory per line or division and clear ownership of OEM access.

Q7. How should we prioritise investment?

Isolate signalling and control from IT, broker supplier access, map critical suppliers and fallbacks, harden ticketing and payment platforms, protect passenger information channels, and build monitoring—in that order.

Q8. How can Codec Networks help?

Codec Networks provides ticketing and API testing, signalling and OT assessments, communications security reviews, supplier programmes, 24x7 IT/OT SOC, DPDP programmes and incident exercises with operations and suppliers.

Audience: Compliance, safety, company secretarial and CISO offices

Q9. Do CERT-In Directions apply to us?

Yes. Cyber incidents must be reported within six hours and ICT logs kept for 180 days in India. CERT-In's 2025 audit guidelines expect independent audits that include OT/ICS.

Q10. Does NCIIPC apply to our systems?

Transport is a notified critical sector, and Indian Railways has identified systems such as PRS, FOIS, traffic management, Kavach and SCADA as critical information infrastructure. Duties attach to systems notified as protected systems; good practice aligns with NCIIPC guidance regardless.

Q11. How do safety regulators relate to cybersecurity?

The Commission of Railway Safety and the Commissioner of Metro Railway Safety certify lines and investigate incidents; a cyber event that affects signalling, control or safe operation engages those processes.

Q12. What payment rules apply to ticketing and tolling?

RBI tokenisation prohibits merchants from storing card data, NPCI scheme rules govern NETC FASTag and NCMC participation, and PCI DSS applies to payment environments; obligations depend on your role in the payment chain.

Q13. What must listed railway PSUs disclose?

Under SEBI's LODR Regulations, listed entities disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report.

Q14. Does DPDP apply to a transport operator?

Yes. Passenger identity and contact data, card and wallet tokens, travel histories, CCTV footage and employee data are in scope; most obligations under the DPDP Rules take effect in May 2027.

Q15. Which standards should we align to?

IEC 62443 for OT security, ISO/IEC 27001 for the management system and PCI DSS for payments; railway-specific guidance on cyber in safety management complements them.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT/OT audits, NCIIPC-aligned control reviews, IEC 62443, ISO 27001 and PCI DSS gap assessments.

Audience: Signalling, telecom, operations, maintenance and procurement teams

Q17. How should IT and OT be separated in a station or control centre?

Use IEC 62443 zones and conduits: a station or OCC DMZ, no dual-homed systems, controlled diagnostic flows and the ability to run operations without office IT.

Q18. How do we assess signalling safely?

Passive discovery, offline configuration and architecture reviews, and any active testing in possession windows agreed with signalling and safety teams—never unplanned scanning of live safety systems.

Q19. How should OEM remote access work?

Brokered, time-bound sessions with MFA, named accounts, approval per request and recording—never standing connections with shared passwords.

Q20. How do we manage contractor laptops and maintenance ports?

Scan and control devices, lock maintenance ports, provide segmented temporary access, use named accounts and remove access after work.

Q21. Which suppliers could stop our services?

Map every supplier system that operations cannot run without—driver apps, fare systems, telecom—set recovery objectives in contracts, define offline fallbacks and rehearse them.

Q22. How do we protect passenger information and PA systems?

Segregate them from office IT, enforce content approval, give stations a fast manual override and monitor for unauthorised changes.

Q23. What about train radio, GPS and telecom?

Review radio and telecom architectures, monitor for interference and spoofing, and keep procedures for operating when tracking or radio is degraded.

Q24. How do we secure fleet telematics and ticketing machines?

Assess devices and back ends, change default credentials, segment device networks, monitor state monitoring centre connections and plan for device compromise.

Audience: Commercial, ticketing, toll operations, SOC and incident response teams

Q25. How do we stop bots and scalping on ticketing?

Test APIs for authentication and authorisation flaws, enforce rate limits and device attestation, deploy bot management and monitor booking patterns for automation and resale.

Q26. What should we test before a ticketing or app launch?

Web, mobile and API security, payment integration, load under bot pressure, authorisation on every object reference and the refund and cancellation workflows.

Q27. How do we protect FASTag and toll settlements?

Secure plaza systems and readers, verify bank-detail changes by call-back with dual approval, reconcile daily and monitor settlement flows.

Q28. Do transport operators need an OT SOC?

Yes. Monitoring stations, OCCs, enterprise IT and ticketing platforms 24x7 is essential for early detection, safe containment and six-hour reporting.

Q29. What should the SOC monitor?

Station and OT networks, supplier sessions, engineering activity, ticketing and payment anomalies, passenger information changes, cloud and identity events and threat intelligence.

Q30. What should incident playbooks include?

Safety decisions, degraded-mode operation, containment, CERT-In and NCIIPC reporting, safety-regulator engagement, passenger communication and disclosure.

Q31. How should backups and fallbacks be designed?

Immutable or offline backups of ticketing, enterprise and OT configurations with regular restore tests, plus paper and manual procedures for ticketing and operations.

Q32. When should forensics be engaged?

As soon as OT compromise, ransomware or data theft is suspected, with investigators who can preserve evidence and support regulators, schemes and insurers.

Audience: Privacy, legal, commercial partnership and procurement teams

Q33. Which passenger data do we hold and where?

Identity documents and contact data for reserved travel, card and wallet tokens, travel histories, loyalty data, CCTV footage and app telemetry across operators, PSUs and partners—map it before DPDP arrives.

Q34. How does DPDP affect ticketing partners and apps?

Partners and app vendors processing passenger data need contracts, safeguards, retention limits and breach notification arrangements; operators remain accountable as data fiduciaries.

Q35. How do we handle CCTV and facial data?

Define purposes, retention and access, secure the video network and storage, and assess any analytics or recognition before deployment.

Q36. How should we assess OEMs, app vendors and concession partners?

Tier them by criticality, assess security and incident history, add security, notification and recovery clauses to contracts and review their access to your systems.

Q37. Our operator customer is auditing our security—what now?

Map the questionnaire to ISO 27001, IEC 62443 and PCI DSS controls, close gaps and build an evidence pack you can reuse for every operator.

Q38. How do we train staff and agents?

Run phishing and BEC simulations for finance and commercial teams, awareness for station and depot staff and secure-coding training for development teams.

Q39. What should a breach response for passenger data include?

Containment, forensic analysis, CERT-In reporting, DPDP breach intimation when in force, partner notification, passenger communication and remediation.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your corridors, control systems, ticketing platforms and suppliers; Codec Networks will propose a safety-aware assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, safety or regulatory advice. Confirm obligations against the official instruments applicable to your organisation, lines, systems and contracts.