prEN IEC 63452:2025

This document provides a consistent approach to manage cybersecurity of railway applications in a railway system. It is applicable across all domains within the scope of IEC TC 9, which includes railway networks (including highspeed lines, mainlines, and freight-lines), urban
transport networks (including metros, tramways, trolleybuses, and fully automated transport systems), and magnetic levitated transport systems. It includes rolling stock, fixed installations, operational management systems (including supervision, information, communication,
signalling, and processing systems) for railway operation.
This document refers and adapts the relevant part of the IEC 62443 series of standards to the railway domain, detailing the cybersecurity management, zoning, risk management, supply chain management, cybersecurity requirements, cybersecurity assurance, as well as operational, maintenance, and decommissioning requirements. It outlines the cybersecurity activities and cybersecurity deliverables needed to identify, monitor, and manage cybersecurity risks within a railway application life cycle and in its operational environment (railway system) to a level tolerable by the railway duty holder. It also provides guidance on how to secure legacy system.
Furthermore, this document provides guidance on coordinating and synchronising the cybersecurity activities with the generic reliability, availability, maintainability, and safety (RAMS) life cycle defined in IEC FDIS 62278-1:2024, and provides criteria for application to
other life cycles.
Lastly, while this document does not provide safety requirements or constraints on the safety case for railway applications, it does offer guidance on the relationship between cybersecurity and safety.