Branche

Security in Public Transportation

We support transport operators and infrastructure providers in securing their systems and operations reliably and in full compliance – across control centers, depots, and digital passenger systems.

Whether metro, tram, bus, or multimodal transport services – public transportation is the backbone of urban mobility. Disruptions in infrastructure affect not only operations but also the trust of millions of passengers. At the same time, regulatory pressure is increasing: with NIS2, the KRITIS umbrella law, and sector-specific standards, operators and service providers face growing responsibility in security policy. We help transport companies secure their systems, sites, and operations in a structured way – legally sound, vendor-neutral, and practical for daily use.

Challenges in Public and Regional Transport

High visibility, high vulnerability

Attacks on public transport have immediate consequences – in the media, operations, and politics.

Critical infrastructure with complex dependencies

Traffic control systems, interlockings, tunnel control centers, vehicle depots, access and ticketing systems – everything is interconnected.

Growing threat landscape

Cyberattacks, targeted disruptions, sabotage, attacks on operational IT or control centers – even smaller operators are affected.

Regulatory expansion through NIS2 and umbrella law

In the future, many transport operators will be classified as “essential entities” – with new reporting, compliance, and security obligations.

Heterogeneous ownership and interface problems

Between municipal responsibility, transport associations, external service providers, and IT vendors, security gaps emerge.

Regulatorische Anforderungen

Stand 2025

Operators of transport services and infrastructure face increasing regulatory pressure – with new obligations from NIS2, the KRITIS umbrella law, and sector-specific rules.

Public transport operators and providers of municipal or regional mobility services are widely considered essential entities. Obligations include:
- Implementation of a holistic risk management system
- Incident notification for major security events (within 24 hours)
- Auditable security organization (technical & organizational)
- Management accountability and oversight duties
For companies of supraregional importance or particularly critical transport systems, the requirements for critical infrastructure additionally apply:
- Implementation of protective measures in line with the current state of the art
- Proof through external audits every two years
- Orientation toward sector-specific security standards (e.g., B3S Transport – in development)
The umbrella law introduces cross-sectoral requirements:
- Risk analysis of critical components
- Proactive assessment and documentation of security incidents
- Preparation for inspection by the Federal Office of Civil Protection and Disaster Assistance (BBK)

Lösungen

Our services for transport operators & infrastructure providers

Security strategy & protection concepts

Development of cross-site protection concepts for control centers, depots, operational facilities, vehicle systems
Securing physical infrastructure (perimeter, access, video surveillance)
Integration into IT security architecture, e.g. for interlockings or passenger systems

Risk analysis & compliance

Protection needs assessments, threat scenarios, and measure catalogues
Preparation for NIS2 compliance or § 8a audits
Building and maintaining a security management system

Emergency organization & recovery planning

Escalation structures, alert chains, and crisis communication
Business continuity management according to ISO 22301
Conducting drills and preparing for supervisory audits

Project support & technical implementation

Vendor-neutral tender support (access control, video, system integration)
Quality assurance in new construction projects or modernization of existing infrastructure
Consulting for safe passenger flows and digital ticketing systems

Aus der Praxis

Our experience in public transportation

We advise municipal and regional transport companies, metro operators, passenger information systems, and infrastructure providers in Germany, Switzerland, and Austria. Typical areas of application include:

Protection of control centers and depots against digital and physical risks

Integration of access control, video surveillance, and alarm management

NIS2 preparation and development of risk management systems

Security concepts for multimodal mobility hubs

Support for security-relevant construction projects in existing infrastructure

Security for systems used every day

We help ensure that operational and passenger security is not just a duty, but part of service quality. Our solutions combine regulatory requirements with technical feasibility – independent and on equal footing.

Prepare now for NIS2, the KRITIS umbrella law, and § 8a BSIG

We guide you from the first protection needs workshop to final documentation – clear, practical, and audit-ready.

Weiterführende Ressourcen

Fallstudie

Risikoanalyse & Sicherheitsplanung für NIS2

Ein Lebensmittelhersteller mit europaweitem Vertrieb bereitet sich auf NIS2 vor – mit standortübergreifender Risikoanalyse und strukturierter Sicherheitsarchitektur.

Whitepaper

Sicherheit in der Lebensmittelindustrie – Anforderungen, Risiken und pragmatische Lösungen

This is just placeholder text. Don’t be alarmed, this is just here to fill up space since your finalized copy isn’t ready yet. Once we have your content finalized, we’ll replace this placeholder text with your real content.