From initial risk assessment to implementation, verification and regulatory compliance, we combine specialist expertise in railway systems, operational technology, physical security and emerging technologies. Our services can support an entire project lifecycle or address a specific technical, regulatory or organisational challenge.

---

How We Support Your Mission

Security in critical infrastructure requires more than isolated technical measures. It requires a clear understanding of the system, its operational context, applicable regulations and the interaction between people, processes and technology.

We provide vendor-independent consulting, engineering, assessment and training services tailored to complex and safety-critical environments.

Cybersecurity Management

We establish and coordinate cybersecurity activities throughout the system and product lifecycle.

Our cybersecurity management services create the governance, responsibilities and evidence needed to integrate cybersecurity into engineering, procurement, delivery and operation.

• Cybersecurity management plans
• Governance and lifecycle coordination
• Requirements and evidence management
• Supplier and interface coordination
• Security assurance and acceptance support

Cybersecurity Risk Assessment

We identify and evaluate cybersecurity risks based on the system architecture, operational environment, threat exposure and potential consequences.

Our assessments translate complex technical and operational conditions into a structured and prioritised risk treatment programme.

• Asset, threat and vulnerability analysis
• Risk evaluation and prioritisation
• Zoning and conduits
• Risk treatment planning
• Residual-risk assessment

Security Architecture and Engineering

We translate cybersecurity risks and regulatory requirements into practical and technically feasible security solutions. Our specialists work alongside system engineers, architects and suppliers to embed cybersecurity into the overall system design.

• Security requirements engineering
• Network segmentation
• Secure communication and remote access
• Identity and access management
• System hardening
• Logging, monitoring, backup and recovery

Verification, Validation and Security Testing

We provide independent and evidence-based evaluation of cybersecurity requirements, designs, implementations and processes.

• Independent design reviews
• Requirements traceability
• Verification and validation
• Vulnerability assessments
• Penetration testing
• Security acceptance support

Regulatory Compliance

We help organisations translate regulatory and standards-based requirements into practical measures, processes and verifiable evidence.

• TS 50701 and IEC 63452
• IEC 62443
• ISO/IEC 27001
• Cyber Resilience Act
• NIS2
• Conformity assessment preparation

Physical and Integrated Security

We develop integrated security concepts for depots, stations, control centres, freight facilities and other critical operational sites. Our approach considers physical threats, cyber risks, operational processes and technical interfaces together.

Secure Artificial Intelligence

We help organisations evaluate and introduce artificial intelligence securely and responsibly, with a focus on governance, risk assessment, data protection and the secure use of third-party AI services.