CLC/TS 50701 (Railway Cybersecurity)
CLC/TS 50701 is the CENELEC technical specification “Railway applications – Cybersecurity”, adopted in Germany as DIN CLC/TS 50701. It describes how cybersecurity in railway systems is planned, implemented and demonstrated across the entire lifecycle: from signalling and rolling stock to fixed installations such as interlockings and power supply. Methodologically it builds on IEC 62443 and transfers its concepts to the specifics of the railway sector.
Who does CLC/TS 50701 apply to?
The specification addresses all roles involved in a railway system: the operator responsible for infrastructure or rolling stock fleets, the system integrator building a complete system from components, and the manufacturer supplying components and software. For each role it describes which cybersecurity activities fall into which lifecycle phase and which evidence has to be handed over. As a technical specification it is not a law, but it is referenced in tenders and approval procedures as the state of the art.
Zones, conduits and security levels
Like IEC 62443, TS 50701 works with segmentation: assets with similar protection needs form zones, and communication between zones runs through controlled conduits. For each zone and conduit, a security level is derived from the risk analysis, describing the required protection against attackers of varying strength. The railway sector adds its own constraints: systems often remain in service for decades, software updates are subject to approval, and many components date from a time when connectivity played no role.
Alignment with RAMS and functional safety
The key difference from IEC 62443 is the close coupling to the RAMS lifecycle of EN 50126 and the safety standards EN 50128 and EN 50129. Cybersecurity activities are assigned to the phases of this lifecycle so that security and safety evidence are produced together. To this end, the TS describes a sequence of system definition, initial and detailed risk assessment, derivation of cybersecurity requirements, verification of implementation, and handover to operation and maintenance. A central principle is that security measures must not impair safety functions.
Risk assessment at the core of the specification
TS 50701 requires a documented threat and risk assessment for the system under consideration. It identifies threats per zone and conduit, evaluates likelihood and impact, and derives the security levels and concrete requirements from them. Whenever the system changes, for example through new interfaces, a software update or a newly discovered vulnerability, the assessment has to be updated. This is where the effort lies in practice: railway systems are large, long-lived and spread across many stakeholders.
CLC/TS 50701 in practice
Manufacturers and integrators supplying both railway and industrial components face TS 50701 and IEC 62443 at the same time; for products with digital elements, the EU Cyber Resilience Act comes on top. Since the methodological basis is shared, it pays to set up the risk assessment once as a model and derive the evidence for all standards from it, rather than maintaining separate documentation. Tools such as itemis SECURE support this approach: the threat analysis for zones and conduits is maintained as a model, changes to the system become directly visible in the risk assessment, and reports can be adapted to the evidence structure of the respective standard.