Global Rail Cybersecurity Regulations

Rail-specific regulations and critical infrastructure frameworks applicable to rail operators

Click a country to expand details

Australia

regulations

Security of Critical Infrastructure Act 2018 (SOCI Act)

Active

Applies to 11 sectors including transport. Requires Register of Critical Infrastructure Assets, mandatory cyber incident reporting, and ownership notifications.

SOCI Act Part 2A + CIRMP Rules

Active

Applies to critical freight infrastructure & services. Requires a written Critical Infrastructure Risk Management Program (CIRMP) for cyber/physical hazards and an Annual Report to Home Affairs.

Austria

regulations

NISG 2026 (NIS2 Implementation)

Active

Published Dec 23, 2025; enters into force Oct 1, 2026. Covers ~4,000 entities. Mandates risk management duties for management boards and 24h reporting. Fines up to €10M or 2% turnover.

Belgium

regulations

NIS2 Law (Law of 26 April 2024)

Active

Effective Oct 18, 2024. Applies to essential/important entities including rail operators. Registration deadline is March 18, 2025. Fines up to €10M or 2% turnover.

Canada

regulations

Passenger Rail Transportation Security Regulations

Active

Registered Oct 2020. Applies to federally regulated passenger rail. Requires a Security Coordinator, risk assessments, security plan, and security incident reporting.

Railway Safety Administrative Monetary Penalties

Active

In force July 2024. Enforcement framework for passenger rail security violations. Penalties up to $250,000 per violation for corporations.

Bill C-8 (Critical Cyber Systems Protection Act)

Pending

Re-introduced June 2025 (formerly Bill C-26). Applies to federally regulated transport. Mandates cyber programs and reporting. Penalties up to $15M/day for non-compliance.

Chile

regulations

Law 21.663 (Cybersecurity Framework)

Active

In force Jan 1, 2025; critical operator duties effective March 2025. Establishes ANCI. Mandates 3-hour alerts and 72-hour full reports for Operators of Vital Importance.

National Cybersecurity Policy 2023–2028

Active

Published Dec 2023. Strategic framework guiding the sector. Focuses on resilient infrastructure, rights protection, and cybersecurity culture across public/private industries.

Denmark

regulations

Act on Cybersecurity (NIS2)

Active

Effective July 1, 2025. Applies to transport and critical sectors. Mandates entity registration, executive accountability, and incident reporting. Fines up to €10M or 2% turnover.

European Union

regulations

NIS2 Directive (EU 2022/2555)

Active

Transposition deadline was Oct 2024. Designates rail as a sector of High Criticality. Mandates 24h early warning / 72h incident reporting and supply chain security.

CER Directive (EU 2022/2557)

Active

Transposition deadline was Oct 2024. Focuses on physical resilience of critical entities. Member States must identify critical entities by July 2026.

Cyber Resilience Act (EU 2024/2847)

Active

In force Dec 2024; applies Dec 2027. Regulates hardware/software products with digital elements (including rail OT). Mandates security by design and vulnerability handling.

Finland

regulations

Kyberturvallisuuslaki (124/2025)

Active

Effective April 8, 2025. Implements NIS2 for transport. Traficom is the supervisory authority. Requires registration by May 2025 and risk management implementation by July 2025.

France

regulations

Loi Résilience (NIS2)

Pending

Draft passed committee Sep 2025; final adoption expected Q1 2026. Transposes NIS2, CER, and DORA. Designates ANSSI as the national authority for transport cyber audits.

Germany

regulations

NIS-2-Umsetzungsgesetz (NIS2 Implementation Act)

Active

In force Dec 6, 2025. Replaces BSIG. Registration portal open Jan 6, 2026. Applies to ~29,000 entities including transport. Fines up to €10M or 2% turnover.

Luxembourg

regulations

Projet de loi 8364 (NIS2)

Pending

NIS2 transposition bill. In committee since March 2024. Final vote expected Q1 2026. Designates ILR as supervisor for transport. Establishes risk management duties.

Netherlands

regulations

Cyberbeveiligingswet (NIS2)

Pending

Draft NIS2 implementation. Delayed; entry into force expected Q2 2026. Covers ~8,000 entities. Mandates duty of care, reporting, and registration.

Norway

regulations

Digitalsikkerhetsloven

Active

Effective Oct 1, 2025. Implements NIS1 framework with NIS2 elements. Applies to transport. Full NIS2 alignment expected in 2026.

Poland

regulations

Ustawa o krajowym systemie cyberbezpieczeństwa (National Cybersecurity System Act)

Active

In force since Aug 28, 2018. Transposes NIS1. Designates rail as Operators of Essential Services. Requires risk assessments, security measures, and incident reporting to CSIRT. Fines up to PLN 200,000.

KSC Amendment (NIS2 Transposition)

Active

Signed into law Feb 19, 2026. Amends the National Cybersecurity System Act to transpose NIS2. Expands scope to 18 sectors including transport. Imposes board-level liability, 24h/72h incident reporting, and fines up to €10M or 2% turnover.

Singapore

regulations

Cybersecurity Act 2018

Active

Establishes framework for Critical Information Infrastructure (CII). Empowers Commissioner to designate CII owners and issue Codes of Practice.

CII Code of Practice (Ed. 2, Rev 1)

Active

Effective July 2022. Applies to designated rail CII. Mandates governance, identification, protection, detection, and response measures. Compliance audits required every 2 years.

Spain

regulations

Esquema Nacional de Seguridad (ENS)

Active

Royal Decree 311/2022. Mandatory security framework for public sector and suppliers. Serves as the baseline for NIS2 compliance.

Sweden

regulations

Cybersäkerhetslag (Cybersecurity Act)

Active

Effective Jan 15, 2026. Implements NIS2. Applies to transport. Mandates incident reporting and risk management. Fines up to €10M or 2% turnover.

Switzerland

regulations

CySec Rail Directive

Active

Effective July 1, 2024. BAV directive for rail. Requires asset inventory, IDS for OT systems, and continuous monitoring. Aligns with ISO 27001 / NIST.

United Kingdom

regulations

NIS Regulations 2018

Active

Current framework for Operators of Essential Services (OES). DfT regulates rail. Requires appropriate technical/organizational measures and 72-hour reporting.

Cyber Security and Resilience Bill

Pending

Introduced Nov 2025. Updates UK framework to match/exceed EU NIS2. Expands scope and introduces two-stage incident reporting (24h / 72h).

DfT Guidance on Rail Rolling Stock Procurement Specifications - Cyber-Security

Active

Published March 2026 by the UK Department for Transport. Applies to passenger rolling stock procurements in Great Britain; intended to be incorporated into Invitations to Tender. Sets out baseline cybersecurity requirements across the procurement lifecycle.

United States

regulations

TSA SD 1580/82-2022-01D

Active

Effective May 3, 2025 – May 2, 2026. Performance-based requirements for critical rail systems (e.g., PTC). Requires Annual Cybersecurity Plan and Assessment.

TSA SD 1580-21-01D

Active

Effective Oct 25, 2025 – Oct 24, 2026. Prescriptive requirements for freight rail. Mandates Cybersecurity Coordinator and 24h incident reporting.

TSA SD 1582-21-01D

Active

Effective Oct 25, 2025 – Oct 24, 2026. Prescriptive requirements for passenger rail/transit. Mandates Cybersecurity Coordinator and 24h incident reporting.

TSA NPRM: Surface Cyber Risk

Proposed

Published Nov 2024. Proposed permanent rule to codify the Security Directives. Will require comprehensive Cyber Risk Management Programs (CRMP).

Need help with regulatory compliance?

Regions with rail cybersecurity regulations