Expert guidance on the implementation of the Cyber Resilience Act (CRA) in mainline and urban railways

The present guidance is the result of a major effort involving cybersecurity experts from both the rail supply industry and the rail operating community over the past year and a half in the context of a sector-wide collaboration. Legal reviews have ensured its consistency with the legal text and the upcoming official guidance material from the European Commission to the full extent of current knowledge. The 70-page long guidance is divided into two parts: the first offers explanations of the key concepts of the CRA, its requirements and the obligations it brings about, while the second puts forward recommendations on how to apply this horizontal law to the specific context of the rail sector. Three annexes showcase graphical illustrations and use-cases. A separate annex, developed by the UNIFE Vehicle Authorisation Mirror Group and approved by UNIFE, CER and UITP, details the expected relationship between the CRA and the vehicle authorisation process.