Close search

The Cyber Resilience Act: What It Means for the Rail Industry

The Cyber Resilience Act: What It Means for the Rail Industry

The European Union’s Cyber Resilience Act (CRA) marks a significant change in how cybersecurity is regulated across digital products and services – and the rail sector is no exception. While majority of the headlines have focused on consumer technologies, its impact for the rail sector are both immediate and far-reaching.

Global Railway Review recently hosted a webinar to deep dive into what this looks like in practice. Industry experts and Nomad Digital specialists examined how the CRA will reshape rail cybersecurity, supply chains, and operational resilience.

Industry Collaboration: Who was in the room

The webinar brought together voices across the industry with rail and cybersecurity expertise, highlighting the collaborative effort required to address CRA compliance.

Together, they explored practical strategies for meeting CRA requirements and shared real-world perspectives from across operators, suppliers, and academia.

 

A New Baseline for Cybersecurity

At its core, the Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements. This includes obligations around secure design, vulnerability management, incident reporting, and ongoing support – meaning manufacturers will need to build it in from day one.

For the rail industry, this is especially significant. Modern rail systems rely on a complex ecosystem of connected technologies—from onboard connectivity and passenger Wi-Fi to signalling systems and remote monitoring platforms.

The CRA establishes a new baseline: cybersecurity must be embedded from the outset, not added later.

Lifecycle Accountability: A Critical Shift

One of the most important themes discussed in the webinar is lifecycle responsibility. The CRA requires organisations to ensure that products remain secure throughout their operational life, including patching, updates, and vulnerability handling.

In rail, that’s a real challenger. Trains and infrastructure don’t get replaced ever frew years and  assets can remain in service for decades. Legacy systems must be reassessed, while new deployments must be designed with long-term resilience in mind.

As highlighted in the session, adopting a secure-by-design approach, aligned with frameworks such as IEC 62443 and ISO 27001, provides a strong foundation for meeting these requirements.

railway lines with trains passing through

Supply Chain Transparency and Risk

Rail runs on complex, layered supply chains The CRA tightens the expectations here significantly, pushing for greater visibility through things like Software Bills of Materials (SBOMs), and structured vulnerability tracking.

This means organisations must:

  • Understand what components are in their systems
  • Assess third-party risks more rigorously
  • Ensure suppliers meet consistent cybersecurity standards

For rail operators and technology providers, supply chain assurance will become a critical differentiator.

Incident Reporting and Operational Resilience

The CRA also introduces stricter requirements for incident and vulnerability reporting within defined timeframes.

In rail, cyber incidents are not just IT issues—they can directly impact operations, service availability, and safety. As discussed by the panel, this reinforces the need to integrate cybersecurity into operational processes, ensuring rapid detection, response, and recovery.

Mobile phone

What This Means for Rail Connectivity Providers

For Nomad Digital, the CRA reinforces the importance of delivering secure, resilient connectivity solutions across the rail environment.

Meeting these expectations involves:

  • Embedding security into product design and development
  • Maintaining continuous monitoring and patch management
  • Securing remote access and segmenting networks
  • Providing transparency to customers and partners

The webinar highlighted how Nomad Digital is already aligning its internal processes and frameworks to meet these evolving requirements, ensuring customers are supported throughout the full lifecycle of their systems.

 

Turning Compliance into Competitive Advantage

While the CRA introduces new regulatory obligations, it also presents an opportunity.

Organisations that proactively align with its principles can:

  • Build stronger customer trust
  • Improve system reliability
  • Reduce long-term operational risk
  • Differentiate themselves in a competitive market

As the rail sector continues its digital transformation, cyber resilience will be a foundational enabler, not just another box to tick.

Looking Ahead

The Cyber Resilience Act is a clear signal that cybersecurity expectations are evolving to match an increasingly connected world.

The insights shared during the Global Railway Review webinar reinforce a key message: rail organisations must take a proactive, lifecycle-driven approach to cyber resilience.

By acting now, the industry can not only meet regulatory demands but also build safer, more reliable, and future-ready rail networks.

Thanks to our Cyber specialists, Eddy Thésée (Alstom), David Oswald (Durham University), Callum Robinson, (Nomad Digital), Ian Wilson (Nomad Digital) and Global Railway Review for hosting this webinar.

For more information regarding the CRA contact our experts: experts@nomad-digital.com, alternatively please find our Cybersecurity product flyer and CRA Checklist below for.

Watch the webinar below or click here

Latest News

Nomad Digital to deliver onboard connectivity for Italo’s entry into the German high-speed rail market

Nomad Digital, a leading provider of transport connectivity solutions, has been selected by Italo to equip its new German high-speed fleet with its advanced 5G Internet On Board (IOB) solution and Nomad Engage portal for extended passenger infotainment.

Eve O'Neil
Read more

Bringing Low Earth Orbit (LEO) satellite connectivity to Scotland’s rail network 

Scot Rail

Nomad Digital is proud to be delivering new onboard WiFi connectivity for ScotRail as part of Alstom’s long-term services and refurbishment programme for the Class 222 fleet in partnership with Beacon Rail.

Eve O'Neil
Read more

Case Study: Nomad Digital supports Italo to realise its vision of an advanced travel experience

Nomad Digital, leading specialists in transport connectivity solutions, is working collaboratively with Italo, a leading high-speed rail operator in Italy, to bring to life its vision to provide a safe, reliable, and technologically advanced travel experience.

Eve O'Neil
Read more

The Cyber Resilience Act: What It Means for the Rail Industry

The European Union’s Cyber Resilience Act (CRA) marks a significant shift in how cybersecurity is regulated across digital products and services.

Eve O'Neil
Read more

Nomad Digital continues to achieve significant Lost Time Injury milestones

In December 2025, Nomad digital surpassed 2,000 days without a Lost Time Injury (LTI). This is a significant milestone for Nomad Digital, and builds upon the 2025 achievement of attaining over 2.5 million working hours without a LTI.

John Mills
John Mills
Read more

Nomad Digital Appoints New Managing Director

Nomad Digital, a wholly owned subsidiary of Alstom and leading specialists in transport connectivity solutions, is pleased to announce that Jean-Philippe Garbit is appointed as Managing Director, effective as of 1st January 2026.

Eve O'Neil
Read more

Nomad Digital awarded contract to upgrade Italo fleet with 5G internet on-board solution

Italo EVO Pendolino high-speed train

Nomad Digital, leading specialists in transport connectivity solutions, has been awarded a contract to upgrade the existing fleet of Italo AGV and EVO Pendolino high-speed trains with its Internet On-Board (IOB) 5G solution.

Steve Urwin
Read more

Nomad Digital Extends Operations and Maintenance Agreement with Queensland Rail

Queensland Rail. Onboard Rail Infotainment

Nomad Digital, leading specialists in transport connectivity solutions has secured an extended Operations and Maintenance agreement with Queensland Rail to support and maintain an extensive range of onboard connectivity solutions.

Faye Gibson
Read more

Celebrating 200 Years of Rail – and Looking Ahead with Nomad Digital

The Greatest Gathering

This year marks a remarkable milestone in rail history: the 200th anniversary of the modern railway, which began in the North East of England. In 1825, the Stockton and Darlington Railway carried the world’s first public passenger train, igniting a transport revolution that would shape societies, economies, and connections across the globe.

Eve O'Neil
Read more

Protecting Rail Cybersecurity in a Connected Age

Onboard tech is evolving - make sure your rail cybersecurity is too. Explore how Nomad Digital helps rail operators tackle cybersecurity threats.

Paul Vaclik
Read more
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.

View our Cookie Policy here