Rail Signaling, Train Control and Back Office Systems
Railroad Cybersecurity for Signaling, PTC and Dispatch
Train movement depends on radio code lines, wayside processors and back office servers built for safety and availability, not for an adversary. GDF follows the routes from the corporate network, vendor access and field gateways toward ATCS, signaling, Positive Train Control and dispatch, and shows which ones an attacker could use. Findings are ranked by their effect on train operations and organized for the TSA rail security directives.
Scope the railroad
Scope the Railroad by Train Movement, Not Network Size
A railroad security leader needs one answer first: could anything an attacker reaches stop, slow or misroute trains? We scope from the operating functions that keep trains moving, dispatch and centralized traffic control, the code line, wayside signal and crossing locations, Positive Train Control and the business systems those functions quietly depend on. Then we agree with your signal and operations departments which systems may be tested actively, which only passively and which only on a bench.
ATCS and Code Line Communications
Advanced Train Control Systems messaging between dispatch and the field, the base communication packages and radio paths that carry it, and the gateways where code line traffic meets IP networks.
Wayside, Crossing and PTC Systems
Wayside signal and crossing locations, their processors and remote monitoring, and Positive Train Control, which the current mitigation directive requires covered railroads to treat as a Critical Cyber System.
Back Office, Dispatch and Vendor Access
Dispatch servers, PTC back office servers, crew and car management applications, and the remote access routes vendors and maintainers use to reach them from outside the railroad.
Methodology
Five Stages From Rail Network Map to Retest
-
Critical Cyber Systems: Reconciling the List
We reconcile your Critical Cyber System list with what passive traffic, configuration records and field visits show, including the IT and OT interdependencies and external connections the mitigation directive asks you to list.
-
Access Routes: Corporate, Vendor and Field
We test the corporate network and vendor and maintainer remote access, and review the configuration of radio and cellular links and the gateways where they meet IP networks, the positions an outside attacker or a stolen account would hold.
-
Segmentation: IT and OT Separation
We verify that the segmentation in your Cybersecurity Implementation Plan holds in practice, so operational technology can keep running safely if the business network is compromised.
-
Track Windows: Approved Validation
Active steps against signaling, code line or PTC components run on spares, in a lab or on a test track, or inside a track and time window your operations and signal departments approve, with stop conditions written down first.
-
Directive Evidence: Findings and Retest
Each finding names the path, the operating consequence and the corrective action, organized to feed your Cybersecurity Assessment Plan results and annual report. We retest the agreed fixes.
Describe the territory and the systems in scope and we will propose the starting positions worth testing.
What the TSA Rail Directives Ask of You
Freight railroads identified in 49 CFR 1580.101, and the freight and passenger railroads TSA designates, work under Security Directive 1580/82-2022-01E, Rail Cybersecurity Mitigation Actions and Testing, effective May 3, 2026 through May 2, 2027. It requires a TSA approved Cybersecurity Implementation Plan covering segmentation, access control, continuous monitoring and patching for Critical Cyber Systems, and a Cybersecurity Assessment Plan that assesses at least one third of the plan's measures each year and all of them over any three year period, with a cybersecurity architecture design review and testing such as penetration testing and red and purple team exercises.
The reporting directives issued in January 2026, Security Directive 1580-21-01E, Enhancing Rail Cybersecurity, for freight railroads and Security Directive 1582-21-01E, Enhancing Public Transportation and Passenger Railroad Cybersecurity, for passenger railroads and rail transit, took effect January 16, 2026 and run through January 15, 2027. They require a Cybersecurity Coordinator reachable by TSA and CISA around the clock, reporting of cybersecurity incidents to CISA within 72 hours, an incident response plan and a cybersecurity vulnerability assessment.
Rail protocols deserve scrutiny of their own. CISA advisory ICSA-25-191-10, End of Train and Head of Train Remote Linking Protocol, describes how weak authentication in a radio linking protocol could let an attacker send brake commands to an end of train device, and ATCS code line messaging was designed in the 1980s, before end to end security was part of railroad communications design. We review how your implementation handles those messages and where radio traffic meets IP.
When a finding turns out to be live activity, our OT, ICS and SCADA incident response team takes over under its own authorization, and the 24/7 hotline is (800) 868-8189.
Engagements Sized to Your Directive Cycle
We recommend combining these engagements across the three year assessment cycle.
Cybersecurity Architecture Design Review
A review of network design, configuration and interconnections built from traffic captures, system logs and configuration records, matching the architecture design review the mitigation directive calls for and giving the rest of the program its baseline.
Penetration Test and Adversary Exercise
An authorized test from the corporate network, vendor access or a field location toward signaling, PTC and dispatch, run as a penetration test or as a red or purple team exercise so your monitoring team learns what it can and cannot see.
Annual Assessment Program
A scheduled program that rotates through your Cybersecurity Implementation Plan measures, so at least one third is assessed each year, with the records your annual report to TSA draws on.
Weighing an architecture review against a full penetration test this year? Scope Your Assessment
Examiners Who Document Every Step
Operating since 1992, GDF has served AmLaw 100 firms and Fortune 1000 companies, and our examiners have testified in federal and state courts, so railroad findings are documented in a way an auditor, a TSA inspector or opposing counsel can follow line by line.
Joseph Caruso, our founder, CEO and CTO, holds the CISSP and has worked in technology since 1980, across real time transaction systems, mainframe databases, cellular networks and cybersecurity incident response. Robert Knudsen, a computer forensics and cybersecurity specialist, holds the CISSP, CCE, CHFI, CompTIA Security+, Network+ and A+ and the Stellar Cyber Certified Associate credential, and spent four years supporting computer and network operations before eighteen years of forensic casework.
Frequently asked
Railroad Cybersecurity Questions From Signal and Security Leaders
Will testing interfere with train movements?
Testing is planned with your operations and signal departments. Passive collection comes first, active steps against signaling, code line or PTC components run on spares, in a lab or inside an approved track and time window, and every test has written stop conditions and a named person who can halt it.
How does the work support our TSA Cybersecurity Assessment Plan?
We map each activity to the plan's measures, so architecture reviews, penetration tests and control assessments produce results you can report in the annual Cybersecurity Assessment Plan report and count toward assessing every measure over the three year cycle.
Can you assess Positive Train Control?
Yes. We assess PTC back office servers, the communications paths to locomotives and the wayside, and the interfaces with dispatch, using passive methods and approved bench or test track validation for components that affect train control.
Do you work with passenger railroads and transit agencies?
Yes. Passenger railroads and rail transit systems covered by Security Directive 1582-21-01E carry the coordinator, reporting and vulnerability assessment requirements, and passenger railroads TSA designates also fall under the mitigation directive, so the scope follows the directives that apply to you.
What happens if testing finds an active intrusion?
We stop, preserve what we found and notify your Cybersecurity Coordinator at once, because the reporting directives require notice to CISA within 72 hours of identification. Our incident response team can take over the examination under a separate authorization.
Scope your assessment
Put Your Rail Network in Front of Senior Testers
The first call covers the directives that apply to your railroad, the territory and systems in scope, the operating windows your signal and operations teams can give us and the evidence your next TSA report needs, and ends with a proposed testing depth and schedule. There is no charge for that call.
Include the directive deadline you are working toward.
Global Digital Forensics has operated since 1992. For anything urgent, the 24/7 hotline is (800) 868-8189.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .