Hamburg, August 2026 – With the integration of the “Railway Cybersecurity” Directive (RL CySec-Rail), CRISAM® is expanding its multi-compliance support for operators of critical infrastructure. Railway companies can now assess the regulatory requirements of the Swiss Federal Office of Transport in a structured manner, map them to existing security standards, and document their implementation in a transparent and traceable way.

RL CySec-Rail has been in force since 1 July 2024. It specifies the requirements for information security management systems in the Swiss railway sector and also serves as a basis for the supervisory activities of the Federal Office of Transport. It applies to railway infrastructure managers and railway undertakings. Its scope covers the processes, information systems, and data networks in use – from traditional IT and Operational Technology to ICT systems in railway vehicles.

Seven ISMS Requirements and 29 Basic Measures

At the heart of the directive is a risk-based information security management system. The seven overarching minimum requirements cover:

• Information security strategy
• Roles and responsibilities
• Policies and organisation
• Regular reviews and audits
• Continuous improvement
• Documentation
• Risk assessment and risk treatment

These requirements are complemented by 29 organisational and technical controls. They address areas including asset and supplier management, information security in projects, cloud usage, security monitoring, incident management, business continuity, access management, vulnerability management, and network segmentation.

Particular attention is given to requirements for Operational Technology and railway vehicles. In these areas, security measures must be closely aligned with safety management. This reflects the specific operating conditions of the railway sector: high availability requirements, long system life cycles, limited opportunities for updates, and the close relationship between cybersecurity and functional safety.

Audit-Ready for Management and Regulatory Oversight

With CRISAM®, the level of compliance with RL CySec-Rail can be systematically assessed. Deviations can be evaluated, measures assigned, and their implementation tracked. The corresponding evidence is centrally available for internal audits, management reporting, and regulatory reviews.

The binding implementation timeline required by the directive can also be managed transparently. This turns regulatory requirements into a traceable improvement process – from the initial gap analysis and risk treatment through to regular reviews of effectiveness.