Specialisation
Cybersecurity in transport
We work mainly with railway undertakings. We build cybersecurity into the safety management system the undertaking already runs, instead of creating a second set of procedures next to it.
What sets this sector apart
- Systems without which a train does not leave. Train planning, dispatching, rolling stock maintenance, data exchange with the infrastructure manager.
- Rolling stock and remote service access. Also when locomotives belong to a lessor and are maintained by another entity.
- Corporate groups. A small company in a large group can formally become an essential entity.
- The SMS already exists. Risk assessment, change management and occurrence investigation can also handle cybersecurity.
How we help
Status and register entry
Size calculated with and without group data, and a check of the entry on the KSC register.
Integration with the SMS
Cyber risks in the hazard register, incidents in the occurrence reporting process.
Suppliers and remote access
A list of systems critical to operations and their suppliers, including remote access to rolling stock.
Incidents
A procedure with reporting deadlines, rehearsed on a scenario in which train planning is down.
Training
Training for management and teams.
Ongoing support
Keeping the system running after implementation.
See the readiness review, implementation and ongoing support.
Results
A railway undertaking faced new obligations under the national cybersecurity system and a short deadline. The requirements were implemented before the statutory deadline, and the incident management procedures were tested in an exercise with the team.
Cooperation in the sector
In the railway sector we cooperate with TOR Audytor on audits and run training in cooperation with ZDG TOR.
Regulations
A medium-sized railway undertaking is an important entity, a large one an essential entity. The obligations must be in place by 3 April 2027. See our page on regulatory compliance.
Frequently asked questions
No. The same mechanisms can handle cybersecurity. A separate set of documents means double work.
Yes. A company registered in Poland is subject to the Polish act, even if its systems are provided by headquarters.
Rail is our specialisation in transport. We work with other modes of transport and logistics on the same principles, starting with a readiness review.
We do not carry out a statutory audit of an organisation where we implemented the requirements. On audits we cooperate with TOR Audytor.
Let us talk about the security of your organisation
You do not need to be ready for a large project. A conversation about where you are and what the law requires of you is enough. We will help you plan realistic, workable steps.
- contact@isconsulting.pl
- Address
- ul. Żelazna 51/53, 00-841 Warszawa, Poland