Resources Categories
INDUSTRY FACT FILE · RAILWAYS, METRO & SURFACE TRANSPORT
Industry Overview: Railways, Metro and Surface Transport in India
Who runs India's railways, metros, buses, tolling and ticketing platforms, the safety, sector and cyber obligations that apply, who buys cybersecurity and why each type of operator needs a distinct approach.
|
In this document 1. Why transport cybersecurity matters now 2. The ecosystem at a glance 3. Categories of rail, metro and surface transport organisations 4. The safety, sector and cyber framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside a transport organisation 7. Why each type of operator needs a different approach 8. How Codec Networks works with transport organisations |
|
Sector scope Sector: Indian Railways and its PSUs, metro and RRTS corporations, state transport undertakings, toll concessionaires and FASTag issuers, ticketing businesses and transit technology companies. Primary service proposition: ticketing and API testing, communications and OT assessments, SOC and incident exercises. Aviation, maritime, logistics and smart cities have separate fact files. |
1. Why transport cybersecurity matters now
Indian Railways carried a record 741 crore passengers in 2025-26 and moved about 1,670 million tonnes of freight over a network of roughly 69,000 route kilometres and more than 7,300 stations. Around it sits a family of public-sector undertakings—IRCTC for ticketing and catering, CRIS for the passenger reservation, unreserved ticketing and freight systems, RailTel for telecom, DFCCIL for the freight corridors and RVNL for construction. India's operational metro network has grown from about 248 km in five cities in 2014 to roughly 1,095 km across 26 cities in 2026, with Delhi Metro alone handling 235.8 crore passenger journeys in 2025. State transport undertakings run tens of thousands of buses, and national highway tolling has been electronic through FASTag since all toll lanes became FASTag lanes in February 2021.
|
741 crore Passengers carried by Indian Railways in 2025-26 |
~1,095 km Operational metro network across 26 cities (2026) |
89% Share of reserved rail tickets booked online (2025) |
6 hours To report cyber incidents to CERT-In |
These are safety-critical operations run on software. Electronic interlocking, the indigenous Kavach automatic train protection system, communications-based train control in metros, operations control centres and traction SCADA keep trains apart and moving; crew, driver and fleet apps carry operational information; and passenger information, public address and CCTV systems manage crowds. Above them sit some of the largest consumer platforms in the country—about 89 per cent of reserved rail tickets are now booked online, averaging 14.5 lakh tickets a day on IRCTC channels in 2025-26—plus automatic fare collection, the RuPay-based National Common Mobility Card and the NETC FASTag network. Much of this estate is built and supported by OEMs, integrators and app vendors who hold remote access.
Incidents abroad show what is at stake. On 29 October 2022 trains across Denmark stopped for hours when DSB's supplier Supeo took its servers offline after an attack and the drivers' information app stopped working. In July 2021 hackers posted false delay and cancellation notices on Iranian station displays. In August 2023 unauthorised radio-stop signals halted trains in Poland. In 2016 ransomware locked around 2,000 systems at San Francisco's Muni and the agency opened its gates for free travel; in December 2024 ransomware disrupted Pittsburgh's light rail for a day. Transport for London's 2024 intrusion, attributed to Scattered Spider-linked attackers, cost about £29 million and forced 28,000 staff to reset passwords in person. In India, the Ministry of Electronics and IT told Parliament that a December 2022 data leak at the RailYatri ticketing platform led to its booking facility being suspended and a penalty imposed until security measures were in place.
The obligations are layered. Transport is a notified critical sector for NCIIPC, and Indian Railways has publicly identified systems such as the passenger reservation system, the freight operations system, traffic management, Kavach and SCADA as critical information infrastructure. CERT-In's Directions require six-hour incident reporting and 180-day logs, and its 2025 audit guidelines expect independent audits that include OT. The Commission of Railway Safety and the Commissioner of Metro Railway Safety certify lines whose safety depends on trustworthy signalling and control. RBI card tokenisation and NPCI scheme rules govern ticketing and toll payments; listed railway PSUs disclose cyber incidents quarterly under SEBI's LODR; and the DPDP Act and Rules will govern passenger, commuter and employee data from May 2027.
|
Key takeaway In transport, cybersecurity is passenger safety, service continuity and public trust in one. Signalling and control systems, the suppliers who reach them and the ticketing, fare and toll platforms that fund the network must be protected together. |
2. The ecosystem at a glance
Figure 1: India's railways, metro and surface transport ecosystem.
3. Categories of rail, metro and surface transport organisations
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Indian Railways zones and divisions |
Train operations, stations, signalling, traction, workshops |
Ministry of Railways (Railway Board) |
Railways Act 1989; CRS; NCIIPC for notified systems; CERT-In |
|
Railway PSUs and agencies |
IRCTC, CRIS, RailTel, DFCCIL, RVNL, NHSRCL, production units |
Government-owned; several listed |
Companies Act; SEBI LODR (listed); CERT-In; NCIIPC where notified |
|
Metro and RRTS corporations |
Urban metro and regional rapid transit operations and construction |
Centre–state joint ventures, state companies, some PPP |
Metro Railways Act 2002; CMRS; MoHUA policy; CERT-In; NPCI (NCMC) |
|
State transport undertakings |
Inter-city and city bus services, depots, ticketing |
State governments and corporations |
Motor Vehicles Act; AIS 140 tracking; CERT-In; DPDP |
|
Toll concessionaires and FASTag issuers |
Highway tolling, NETC acquiring and issuing |
Private concessionaires, NHAI/IHMCL, banks |
NH Fee Rules; NPCI NETC rules; RBI; CERT-In |
|
Ticketing and mobility platforms |
Online rail and bus booking, aggregators, MaaS apps |
Private companies, IRCTC-authorised partners |
IRCTC partner terms; RBI tokenisation; DPDP; CERT-In |
|
Transit technology providers |
AFC, intelligent transport systems, telematics, passenger apps |
Private vendors, global OEMs |
Customer contracts; CERT-In; DPDP as processors |
|
Signalling and rolling stock OEMs |
Interlocking, Kavach, CBTC, trains, depots, maintenance |
Global and Indian manufacturers, integrators |
RDSO approvals; safety cases; customer contracts; CERT-In |
4. The safety, sector and cyber framework at a glance
|
Instrument or expectation |
What it means for transport organisations |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications |
|
NCIIPC and protected systems (IT Act Section 70A) |
Transport is a notified critical sector; systems notified as protected systems carry specific protection and CISO reporting duties; Indian Railways has identified PRS, FOIS, traffic management, Kavach and SCADA as CII |
|
Railways Act 1989; Metro Railways (Operation and Maintenance) Act 2002 |
Statutory basis for operations and safety certification by the Commission of Railway Safety and the Commissioner of Metro Railway Safety, which depends on trustworthy signalling, control and rolling stock systems |
|
Motor Vehicles Act and MoRTH vehicle tracking mandate (AIS 140) |
Vehicle location tracking devices and emergency buttons for public service vehicles, with state monitoring centres—connected fleets that must be secured |
|
RBI card tokenisation; NPCI NETC and NCMC scheme rules; PCI DSS |
No storage of card data by merchants since October 2022; scheme security rules for FASTag and transit card acceptance; PCI DSS for payment environments |
|
SEBI LODR Regulations (listed PSUs) |
Cyber incidents and data loss disclosed in the quarterly corporate governance report |
|
DPDP Act 2023 and DPDP Rules 2025 |
Safeguards and breach intimation for passenger, commuter, employee and contractor data; most obligations from May 2027 |
|
How these apply Safety and sector obligations depend on ownership, the lines and services operated and the systems notified as critical information infrastructure; cyber obligations are cross-sector and depend on listing status and payment roles. Confirm against the official instruments and your contracts. |
5. Government, public-sector and private participants
- The Ministry of Railways and the Railway Board run Indian Railways and its PSUs; RDSO sets standards and approves signalling and Kavach equipment; the Commission of Railway Safety certifies lines.
- The Ministry of Housing and Urban Affairs sets metro policy and houses the Commissioner of Metro Railway Safety; state governments own metro joint ventures and transport undertakings.
- MoRTH, NHAI and IHMCL run national highways and tolling; NPCI operates NETC FASTag and the RuPay NCMC; RBI regulates payments.
- CERT-In and NCIIPC handle incident response and critical infrastructure; SEBI governs listed-company disclosure; MeitY administers DPDP.
- IRCTC, CRIS and RailTel anchor ticketing, core systems and telecom; DMRC, BMRCL, CMRL, NCRTC and other corporations run urban rail.
- Signalling, rolling stock, AFC and telecom OEMs, integrators, app vendors and toll concessionaires build, support and operate much of the estate.
6. Who buys cybersecurity inside a transport organisation
|
Stakeholder |
What they care about |
What they buy |
|
Board, chairman, MD and general managers |
Safety, service continuity, public trust, disclosure |
Board advisory, resilience programmes, crisis exercises |
|
CISO, CIO and IT heads |
IT and OT security, audits, NCIIPC and CERT-In obligations |
Audits, assessments, SOC, GRC programmes |
|
Signalling, telecom and electrical heads |
Interlocking, Kavach, CBTC, radio, traction SCADA |
OT assessments, segmentation, OEM access controls |
|
Operations and station management |
Passenger information, crowd safety, degraded modes |
Communications security, playbooks, exercises |
|
Commercial, ticketing and fare teams |
Ticketing uptime, fraud, bots, payments |
Platform and API testing, fraud monitoring, PCI DSS |
|
Finance and toll operations |
Settlement integrity, BEC, concession reporting |
Payment flow controls, BEC simulation |
|
Procurement and contracts |
Vendor, OEM and contractor risk |
Third-party access programmes |
|
Legal, privacy and company secretarial |
DPDP, SEBI disclosure, regulator engagement |
Privacy programmes, incident records |
7. Why each type of operator needs a different approach
|
Organisation type |
Highest-consequence risk |
Starting point for assurance |
|
Indian Railways unit |
Signalling or control intrusion; ransomware across stations and divisions |
OT architecture review, segmentation, CII-aligned controls, OT SOC |
|
Railway PSU |
Ticketing platform abuse, data breach, disclosure failure |
Platform and API testing, DPDP, SEBI-ready incident records |
|
Metro or RRTS corporation |
CBTC/OCC intrusion; AFC and NCMC payment attacks |
OT assessment, AFC and payment testing, communications security |
|
State transport undertaking |
Ransomware on depot, ticketing and telematics systems |
Baseline assessment, backups, app and fleet security |
|
Toll concessionaire or FASTag issuer |
Settlement diversion, plaza system outages |
Payment flow controls, BEC readiness, SOC |
|
Ticketing or transit technology company |
Being the weak link for operators; data exposure |
Secure SDLC, API testing, questionnaire readiness |
8. How Codec Networks works with transport organisations
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For transport organisations we deliver ticketing, fare and toll platform and API testing, signalling and OT assessments using safety-aware methods, communications and station network reviews, supplier access programmes, 24x7 IT/OT SOC, DPDP programmes for passenger data and incident exercises with operations, suppliers and leadership—connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. Obligations differ by ownership, listing status, systems notified as critical information infrastructure, payment roles and contracts; confirm them against the official CERT-In, MeitY, NCIIPC, Ministry of Railways, MoHUA, MoRTH, RBI, NPCI and SEBI instruments and your contracts.