Resources Categories
INDUSTRY FACT FILE · RAILWAYS, METRO & SURFACE TRANSPORT
Market Landscape and the Drivers of Cybersecurity Demand in Rail and Surface Transport
The business, technology, safety, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for railways, metros, state transport, tolling and transit technology organisations.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: CERT-In, NCIIPC, railway and metro safety regimes, RBI/NPCI and DPDP 5. Legal and statutory drivers 6. How the drivers differ by organisation type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's surface transport sector is large, public and investing heavily. Indian Railways carried 741 crore passengers and about 1,670 million tonnes of freight in 2025-26 with electrification close to complete; the operational metro network has reached roughly 1,095 km across 26 cities, with more corridors under construction under the 2017 Metro Rail Policy's Centre–state joint venture model; FASTag collects almost all national highway tolls electronically; and state transport undertakings move crores of passengers a day by bus. Ticketing has moved online—about 89 per cent of reserved rail tickets, with daily volumes above 14 lakh—while metros adopt the RuPay National Common Mobility Card.
Cybersecurity demand follows four pressures. Safety: signalling, Kavach, CBTC and control centres are being networked and are maintained by suppliers with remote access. Continuity: a supplier outage stopped Denmark's trains and ransomware has halted light rail and ticketing abroad. Compliance: transport is a critical sector for NCIIPC, CERT-In expects independent audits that include OT, listed PSUs disclose incidents and DPDP arrives in 2027. Platforms: national-scale ticketing, fare collection and tolling attract bots, fraud and payment attacks, and their outages are immediately public.
|
741 crore Passengers carried by Indian Railways in 2025-26 |
26 Indian cities with operational metro systems (2026) |
6 hours Incident reporting to CERT-In |
May 2027 Most DPDP obligations take effect |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Indian Railways zones and PSUs |
Public ownership, Railway Board direction, CII notifications, large OEM base, listed PSUs with Boards |
OT programmes for signalling and control, CII-aligned audits, platform testing, SOC |
|
Metro and RRTS corporations |
Centre–state JVs, new lines with CBTC and AFC, safety certification by CMRS |
OT and AFC assessments, communications security, NCMC payment testing |
|
State transport undertakings |
Large bus fleets, thin IT teams, state monitoring centres, electronic ticketing |
Baseline assessments, fleet and app security, backups, awareness |
|
Toll concessionaires and FASTag issuers |
Concession contracts, lender covenants, NETC settlement, roadside devices |
Payment flow controls, BEC readiness, plaza system assessment |
|
Ticketing and mobility platforms |
High-volume consumer apps, IRCTC partnerships, investor scrutiny |
API and app testing, bot defence, DPDP, SOC |
|
Transit technology and OEMs |
Supply to operators under contracts and RDSO approvals |
Secure SDLC, product security, questionnaire readiness |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Passenger safety and public trust |
Any incident affecting trains or crowds is a public and political event |
OT security, communications security, exercises |
|
Service continuity |
Stoppages are visible within minutes and cannot be hidden |
Resilience, supplier controls, degraded-mode playbooks |
|
Ticketing and toll revenue |
Peak-time outages and fraud hit revenue and reputation |
Platform testing, fraud monitoring, PCI DSS |
|
Capital programmes |
New corridors, Kavach, CBTC and AFC go-lives |
Security by design, pre-launch testing |
|
Board, audit and parliamentary scrutiny |
PSUs and corporations answer to Boards, CAG and Parliament |
Board advisory, audits, incident records |
|
Lender and concession obligations |
Concessionaires must report and protect revenue flows |
Control validation, settlement security |
|
Supplier dependence |
Operations rely on vendor-hosted apps and support |
Third-party programmes, joint exercises |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Kavach, interlocking and CBTC |
Networked safety systems with OEM access |
OT and safety-aware assessments |
|
Ticketing, AFC and NCMC |
National-scale apps, APIs and payment flows |
API testing, bot defence, PCI DSS |
|
FASTag/NETC tolling |
Roadside devices, settlement and reconciliation |
Plaza and payment flow security |
|
Driver, crew and fleet apps |
Operational dependence on supplier systems |
Supplier criticality, fallbacks |
|
Passenger information and CCTV |
Reachable from office IT; privacy exposure |
Segregation, content control, DPDP |
|
Cloud and analytics |
Passenger data and operations dashboards in the cloud |
Cloud posture, data protection |
Figure 3: The four groups of drivers behind cybersecurity spending in rail and surface transport.
4. Regulatory drivers: CERT-In, NCIIPC, railway and metro safety regimes, RBI/NPCI and DPDP
|
Instrument |
Key requirements |
|
CERT-In Directions (2022) and audit guidelines (2025) |
Six-hour incident reporting; 180-day ICT logs; risk-based independent audits covering IT and OT/ICS |
|
NCIIPC (IT Act Section 70A) |
Transport is a notified critical sector; protected systems carry protection and CISO reporting duties under the 2018 Protected System Rules |
|
Railways Act 1989; Metro Railways (Operation and Maintenance) Act 2002 |
Safety certification by CRS and CMRS; operational duties that depend on trustworthy signalling and control |
|
Motor Vehicles Act; MoRTH vehicle tracking mandate (AIS 140) |
Tracking devices and emergency buttons in public service vehicles with state monitoring centres |
|
RBI tokenisation; NPCI NETC and NCMC rules; PCI DSS |
Card data handling, scheme security and payment environment standards for ticketing, fares and tolls |
|
SEBI LODR; DPDP Act 2023 and Rules 2025 |
Quarterly cyber incident disclosure for listed PSUs; passenger and employee data safeguards from May 2027 |
|
Confirm applicability Obligations depend on ownership, the services operated, systems notified as CII, payment roles and listing status. Confirm against the official instruments and your contracts. |
Figure 4: Regulatory and standards timeline shaping rail and surface transport cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
IT Act, 2000 and CERT-In Directions |
Incident reporting, logging and protected systems |
SOC, logging, audits and incident response |
|
Railways Act, 1989 and Commission of Railway Safety |
Safe operation and certification of railway lines |
Signalling and OT security, cyber in safety management |
|
Metro Railways (Operation and Maintenance) Act, 2002 |
Metro operations and CMRS certification |
CBTC, OCC and AFC security reviews |
|
Motor Vehicles Act, 1988 and tracking rules |
Public service vehicle tracking and emergency response |
Fleet IoT and monitoring centre security |
|
Payment and Settlement Systems Act, 2007; RBI and NPCI rules |
Card tokenisation, NETC and NCMC participation |
Payment flow testing, PCI DSS readiness |
|
Companies Act, 2013 and SEBI LODR |
Board risk responsibility; disclosure for listed PSUs |
Board reporting, incident records |
|
DPDP Act, 2023 and Rules, 2025; contracts |
Passenger, commuter and employee data; supplier clauses |
Privacy programmes; independent testing and evidence |
6. How the drivers differ by organisation type
|
Organisation type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Indian Railways and PSUs |
Safety, continuity, parliamentary scrutiny |
Kavach, interlocking, PRS/UTS, FOIS |
NCIIPC, CERT-In, CRS, SEBI LODR (listed) |
|
Metro and RRTS |
Safety, ridership, new line go-lives |
CBTC, OCC, AFC, NCMC |
Metro Railways Act, CMRS, CERT-In, NPCI |
|
State transport |
Continuity, revenue, passenger safety |
Ticketing machines, tracking, depot systems |
Motor Vehicles Act, AIS 140, CERT-In, DPDP |
|
Tolling |
Settlement integrity, concession reporting |
Plaza systems, NETC acquiring |
NH Fee Rules, NPCI, RBI, CERT-In |
|
Ticketing and transit tech |
Growth, operator contracts, trust |
Apps, APIs, cloud, payments |
RBI tokenisation, DPDP, CERT-In, contracts |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“Could an outsider reach our signalling or control centre?” |
OT architecture assessment and OEM access review |
Annual OT reviews and access recertification |
|
“Will our ticketing survive launch day?” |
Platform, API and bot-resistance testing |
Pre-release and quarterly testing |
|
“Which suppliers could stop our trains?” |
Supplier criticality mapping and third-party programme |
Annual reassessment and joint exercises |
|
“Could someone hijack our displays or PA?” |
Communications and station network review |
Periodic reviews and monitoring |
|
“Are we ready for DPDP across apps, cards and CCTV?” |
DPDP gap assessment and programme |
DPO support and annual reviews |
|
“We need 24x7 monitoring that includes stations and OT.” |
IT/OT SOC |
Continuous monitoring |
|
“We need an independent cyber audit for NCIIPC or CERT-In.” |
CERT-In-aligned IT/OT audit |
Annual audits |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. Obligations differ by ownership, listing status, systems notified as critical information infrastructure, payment roles and contracts; confirm them against the official CERT-In, MeitY, NCIIPC, Ministry of Railways, MoHUA, MoRTH, RBI, NPCI and SEBI instruments and your contracts.