Rail Security Program Kit

View sample pages (PDF) ↗

What's inside

• 00 Master Implementation Roadmap: a 24-week plan in five phases mapped to the NIST CSF 2.0 functions, telling you which document to use when, plus a CSF 2.0 Cross-Mapping Matrix showing which documents address each of the 106 outcomes
• Start Here guide: a step-by-step roadmap to build your rail cybersecurity program from scratch, choose your starting point by role, and avoid common pitfalls
• Rail Cybersecurity Context: stakeholders, essential functions, obligations, threat landscape, risk acceptance principles and assumptions
• Rail Cybersecurity Management Plan: roles, risk management, design reviews, testing, vulnerability and supplier management, assurance and handover
• Rail Cybersecurity Policy (Tier 1): objectives, values, risk appetite and accountabilities
• Rail Cybersecurity Standard (Tier 3): technical requirements by FR 1–7, lifecycle deliverables, accounts, remote access and supplier requirements
• Rail Risk Assessment Methodology: systems under consideration, essential functions, zones, SL-T
• Rail Governance Framework: safety-security interface, security conditions of use, security assurance report, EN 50126 phases
• Rail Program Charter and First 90 Days Plan
• Rail Cyber Incident Response Playbooks: cyber-to-safety triage, roles and six rail playbooks
• Rolling Stock and Signalling Supplier Security Schedule for tenders, and network separation rules by zone (office IT, operations, trackside, onboard, safety-critical)
• Incident Response Plan: severity levels, roles, response phases, notification timelines and playbooks
• Business Continuity and Disaster Recovery Plan with a BIA and recovery workbook (MTPD, tiers, RTO/RPO gaps, test log)
• Excel workbook: railway asset inventory, essential functions, security conditions register, zones and conduits, lifecycle tracker, vulnerabilities, backups, suppliers and self-calculating KPIs
• Every document now includes real-world incidents, Auditor Red Flag callouts, small-business vs enterprise notes, worked examples, and a Control Register in the workbook that links each control ID to its owner and evidence
• Links 85 of 106 NIST CSF 2.0 outcomes to specific sections, shown in the CSF 2.0 Cross-Mapping Matrix
• Not included: training slide decks. The documents set the training requirements; deliver them with your own provider or materials

Format

Word (.docx) and Excel (.xlsx). Editable, with highlighted placeholders and guidance notes you delete before publishing.

Frameworks referenced

• CLC/TS 50701 (successor IEC 63452)
• ISA/IEC 62443
• EN 50126
• APTA SS-CCS-RP-002

Aligned with the frameworks named. Templates support your program; they don't certify compliance.

Who it's for

Small and medium organizations, security leads, consultants and MSPs who want a structured starting point instead of a blank page.

Questions

Is this a finished policy I can use as is?

No. It's a template: a guideline based on common industry practice. Review each requirement, remove what doesn't apply, set values you can meet, and have the final version reviewed by people who know your systems and obligations.

How do I receive the files?

After checkout you get an instant download link by email from our payment partner.

Can I share it with clients?

The licence covers use within your own organization. Consultants and MSPs who want to use templates with clients should contact us.

Refunds and updates

See our licence and refund policy.