.png)
Guide · Rail & Metro · Built in India
EN IEC 63452 is the emerging European and international railway cybersecurity standard path. At international level, IEC 63452:2026, Railway applications - Cybersecurity, is published by IEC Technical Committee 9 as a Final Draft International Standard (pre-release) with a voting window from 30 October 2026 to 11 December 2026. In Europe, FprEN IEC 63452:2026 is under parallel CENELEC development and is intended to take over from CLC/TS 50701:2023, the published Technical Specification that many programmes still name today. The document adapts industrial cybersecurity concepts from the IEC 62443 series to railway systems and is designed to sit beside the railway RAMS lifecycle rather than replace functional safety standards.
The short answer
IEC 63452 / EN IEC 63452 applies across the railway and urban-rail domains covered by IEC TC 9: high-speed, mainline and freight networks, metros, tramways, trolleybuses, fully automated transport systems and magnetic levitated systems. It includes rolling stock, fixed installations and operational management systems such as supervision, information, communication, signalling and processing systems used for railway operation. Public briefings describe cybersecurity management, zoning, risk management, supply chain management, cybersecurity requirements and assurance, plus operational, maintenance and decommissioning activities, with guidance on legacy systems and on coordinating cybersecurity work with the generic RAMS lifecycle. Product and device capability requirements remain outside its product scope; those continue to be handled under IEC 62443-4-1 / 4-2 or an equivalent product standard named in the contract.
Why it matters
Passenger information, IP CCTV, remote diagnostics and other onboard or station electronics increasingly share networks with systems that carry safety-related or operationally critical traffic. Buyers and integrators therefore need a common language for zones, conduits, risk acceptance and supplier evidence that sits next to EN 50126 RAMS work and, where Category 3 transmission systems are used, next to EN 50159's cybersecurity interface. CLC/TS 50701:2023 is still the published European TS many tenders cite; EN IEC 63452 is the path that is expected to replace it once the European Norm is adopted. This guide does not claim that Envision TechWorks products are certified to IEC 63452, TS 50701 or IEC 62443 — cybersecurity for those products is typically set by the system integrator's architecture and by the contract.
Key requirements
A buyer-facing summary of themes that public catalogues and the IEC PT 63452 briefing associate with IEC 63452 / EN IEC 63452. Always confirm the edition and national status named in your tender — CLC/TS 50701:2023 may still apply until EN IEC 63452 is adopted.
Like the IEC 62443 approach that underpins CLC/TS 50701, IEC 63452 is described as supporting railway system modelling with security zones and conduits so that trust boundaries, shared services and interfaces are explicit. That framing helps asset owners, integrators and suppliers agree where firewalls, data diodes or other conduit controls sit relative to onboard networks that also carry passenger information or diagnostics traffic.
Public sources describe IEC 63452 as adapting IEC 62443 risk-assessment and Security Level concepts to the railway sector, together with risk-acceptance ideas familiar from CSM-RA. Programmes still need a documented cyber risk assessment, residual-risk acceptance by the duty holder, and clear Security Level targets for zones — not a datasheet claim alone.
IEC 63452 is presented as covering the full application life cycle: development through operation, maintenance and decommissioning, with supply-chain expectations between asset owners, system integrators, maintenance providers and product suppliers. Briefings also highlight operational and disposal requirements, legacy-system guidance and cloud-for-OT considerations that sit outside a pure design-time checklist.
IEC 63452 is built from CLC/TS 50701 experience and the IEC 62443 series rather than inventing a separate industrial cybersecurity model. PT 63452 notes that products and devices remain out of IEC 63452's product scope because IEC 62443-4-1 / 4-2 (or an equivalent) still apply at component level. Buyers should therefore keep system-level railway cybersecurity requirements and product SDL / component requirements as related but distinct lines of evidence.
Related standards
CLC/TS 50701:2023 remains the published European Technical Specification for railway cybersecurity until EN IEC 63452 is formally adopted; programmes should treat EN IEC 63452 as the emerging successor path, not as a silent replacement of every existing TS 50701 citation. EN 50159 Category 3 transmission systems already point to cybersecurity standards including CLC/TS 50701 and EN IEC 63452 for intentional message-based attacks. EN 50126 defines the RAMS process that IEC 63452 is intended to coordinate with; EN 50129 and EN 50716 cover safety-related electronics and railway software; EN 50155 covers onboard electronic equipment environmental and power conditions. Cybersecurity acceptance and safety approval remain related but separate.
Working from CLC/TS 50701 today while EN IEC 63452 is still emerging? Read: What is CLC/TS 50701?
What is CLC/TS 50701? Railway cybersecurity explained →Connecting Category 3 transmission systems to the cybersecurity interface? Read: What is EN 50159?
What is EN 50159? Railway communication explained →Checklist
Use these points when writing a specification or comparing suppliers. Ask for documented evidence for the exact system version, zones and application rather than relying on a datasheet statement.
Edition named in the tender: does the specification cite CLC/TS 50701:2023, IEC 63452 / EN IEC 63452, or both, and how will the transition be handled before national adoption of the EN is complete?
Zones and conduits: which assets sit in which security zones, which conduits cross trust boundaries, and who owns the residual risk acceptance for shared onboard or station networks?
Security levels and risk assessment: what Security Level targets apply, which risk-acceptance principle is used, and what deliverables (threat log, cybersecurity case, SecRACs or equivalents) are required?
Roles across the supply chain: which requirements sit with the asset owner, system integrator, product supplier and maintenance provider, and how is evidence exchanged at each interface?
Safety interface: how are cybersecurity activities coordinated with EN 50126 RAMS phases, and how is separation from the EN 50129 safety case documented when Category 3 communication applies?
Product vs system scope: which product requirements remain under IEC 62443-4-1 / 4-2 (or equivalent), and which system-level controls are required under TS 50701 / EN IEC 63452?
Evidence and sourcing: what cybersecurity evidence will be reviewed at FAT/SAT and in service, and does your programme favour Built in India / Make in India manufacturing for the connected electronics?
Envision TechWorks
Envision TechWorks makes onboard and station electronics, including passenger information, IP CCTV, remote diagnostics and industrial control products, rather than signalling systems or certified cybersecurity stacks. Products are designed, manufactured and tested in an ISO 9001:2015 facility in India: production-ready and Built in India for Make in India programmes. PAPIS onboard passenger announcement and information hardware is built to EN 50155, and production includes in-circuit and functional test, AOI and X-ray inspection, and thermal cycling. Where your project needs displays, CCTV, diagnostics units or control panels that share a network covered by a TS 50701 or EN IEC 63452 architecture, share the zone, conduit and evidence requirements named in your tender, and the team can discuss your requirements. This page does not claim product certification to IEC 63452, TS 50701 or IEC 62443.
Related
Railway cybersecurity under the published CLC/TS 50701:2023 Technical Specification, IEC 62443 alignment and buyer checks.
Read the TS 50701 guide →Passenger announcement and information system for metro trainsets, with hardware built to EN 50155.
See PAPIS product details →Onboard and station IP surveillance with centralised video management and vandal-resistant cameras for rolling stock and stations.
See IP CCTV product details →Safety-related railway communication: Categories 1–3, defences and the EN 50159 Category 3 cybersecurity interface.
Read the EN 50159 guide →Railway software under EN 50716:2023, the standard that superseded EN 50128 and EN 50657, with integrity levels and lifecycle checks.
Read the EN 50716 guide →IoT remote diagnostics for locomotive and rolling stock fleets — edge data acquisition, cloud analytics and predictive maintenance alerts, Built in India.
See RDPMS product details →FAQ
EN IEC 63452 is the emerging European Norm path for railway cybersecurity, developed in parallel with IEC 63452:2026 and intended to take over from CLC/TS 50701:2023. It adapts IEC 62443 concepts to railway systems across rolling stock, fixed installations and operational management domains.
CLC/TS 50701:2023 is the published CENELEC Technical Specification many tenders still cite. FprEN IEC 63452:2026 / IEC 63452:2026 is the emerging full standard path built from that TS and from IEC 62443; catalogues describe it as replacing the TS once the EN is adopted. Until then, check which document your tender names.
No. Public briefings state that products and devices are outside IEC 63452's product scope; product development and component requirements continue under IEC 62443-4-1 / 4-2 or an equivalent named in the contract. Whether a passenger-information or CCTV unit must meet system-level controls is decided by the architecture and the tender, not by this guide.
EN 50159 Category 3 already interfaces to cybersecurity standards including CLC/TS 50701 and EN IEC 63452 for intentional attacks on safety-related communication. EN 50126 defines the RAMS lifecycle that IEC 63452 is intended to coordinate with. Cybersecurity acceptance and safety approval remain related but separate processes.
Envision TechWorks makes onboard and station electronics, not signalling systems or certified cybersecurity stacks, in an ISO 9001:2015 facility in India. Where your project needs displays, CCTV, diagnostics units or control panels inside a TS 50701 or EN IEC 63452 architecture, share the zone, conduit and evidence requirements named in your tender and the team can discuss them, Built in India.
Share the standards, editions, zones, conduits and evidence requirements named in your tender, and the team will discuss your requirements, Built in India.