For rail

Your suppliers reach the operational railway.

Signalling, depot and telemetry systems, ticketing, passenger information — rail’s vendor stack runs from corporate IT straight into operational technology. And the supplier base is shared across the industry, so the exposure is shared too.

What does third-party risk management involve in rail?

Rail depends on suppliers across two estates at once. Alongside the corporate systems every sector has sit signalling and interlockings, depot and maintenance systems, operational technology and the SCADA telemetry that gathers it from sites spread across a network. A supplier holding maintenance access to an operational system is a different proposition from one holding a marketing list: change windows are longer, the testing burden is heavier, and taking a system offline to remediate is a service decision rather than an IT one.

The regulatory picture follows the same shape. In the UK, rail operators are operators of essential services under the 2018 NIS Regulations, and the Cyber Security and Resilience Bill is the domestic successor, extending duties into the supply chain. In the EU, NIS2 names transport among its essential sectors, and Article 21(2)(d) reaches suppliers contractually through their customers’ own obligations. In the US, rail operators work to TSA security directives requiring IT/OT segmentation, continuous monitoring, multi-factor authentication for remote access and incident reporting to CISA within 12 hours.

What makes rail distinctive is concentration. Operators, infrastructure owners and rolling stock companies draw on a common supplier base — the same signalling vendors, the same maintenance contractors, the same hosting behind them. Assessing a supplier in isolation understates the exposure, because the question is not only what this supplier can reach at your organisation, but how many others depend on the same one. That shared picture is the subject of our UK rail supplier risk programme.

The reality

The numbers your team already knows.

Rail third-party risk has to cover an operational estate as well as a corporate one, under duties that are tightening on both sides of the Channel, across a supplier base the whole industry shares.

IT + OT

Two estates every rail supplier assessment has to cover

Signalling, depot and telemetry alongside corporate systems

Shared

One supplier base across operators, infrastructure owners and rolling stock

12 hrs

Incident reporting window for US rail operators

TSA security directives

The agents that matter most for rail

REX, ARIA, TARA — across both estates.

Three of The Agency’s leads keep the supplier picture current without asking the supplier first, hold assurance evidence ready for the regulator who asks, and route a finding to the person who can actually schedule the work.

REX

Risk & Breach Intelligence

Every supplier scored, whether or not they answer. REX scans each supplier from the outside before anyone is asked for anything, rescans weekly and checks the score nightly for material change — then maps the fourth-party hops behind them, which in rail is where the shared dependencies actually sit.

What you get

Outside-in scoring with no supplier sign-up required
Fourth-party discovery — the hosting and subcontractors behind your suppliers
Breach and dark-web signal correlated to the supplier, not just the sector

ARIA

Assessment & Evidence Intelligence

Assurance evidence that is current when it is asked for. ARIA reads supplier certifications, policies and prior responses, structures them against the 157 Universal Controls, and pre-fills questionnaires — so the evidence behind a safety case or a regulator’s request is assembled, not reconstructed.

What you get

Pre-fill 70%+ of questionnaire answers from evidence already on file
One current record per supplier, ready when the regulator or the board asks
Framework crosswalks kept live as the UK and EU regimes move

TARA

Tiering & Remediation

Operational access tiered first. TARA ranks suppliers by what they can actually reach — operational systems above corporate ones — and drives remediation to a deadline, with the long change windows an operational estate imposes built into the plan rather than discovered halfway through it.

What you get

Tiering weighted by operational reach, not contract value
SLA-bound remediation routed to the owner who can schedule the work
Concentration visible across the portfolio, not one supplier at a time

What changes for rail

From an annual assurance exercise to a standing picture.

Supplier risk stops being something reconstructed for an audit and starts being something that is simply known, on the day anyone asks.

The operational estate stops being a blind spot

Suppliers with access to signalling, depot and telemetry systems are tiered above the corporate stack, and watched on the same cadence as everything else.

Concentration becomes visible

When a large share of the supplier list terminates at the same hosting provider or maintenance contractor, that shows up as a portfolio fact rather than a coincidence nobody spotted.

Evidence is ready, not reconstructed

Reports are built from live data, so a regulator, an auditor or a board paper is a review rather than a three-week assembly job.

Findings arrive with the time to act on them

A posture drop surfaces at the next nightly check rather than the next review cycle, which is what makes a long change window workable instead of impossible.

We were assessing the same suppliers as everyone else in the industry, separately, once a year. Now we see them continuously, and we can see who else depends on them.

Head of Security

Rail operator

Common questions

What rail teams ask us first.

Two estates, shared suppliers, and duties that are tightening.

Which regulations place supply chain duties on rail operators?

In the UK, rail operators are operators of essential services under the 2018 NIS Regulations, and the Cyber Security and Resilience Bill is the domestic successor, extending duties into the supply chain. In the EU, NIS2 names transport among its essential sectors; a supplier to an EU essential entity inherits obligations contractually through Article 21(2)(d) even where it is not in scope itself. In the US, TSA security directives require IT/OT segmentation, continuous monitoring, multi-factor authentication for remote access, risk-based patching and incident reporting to CISA within 12 hours.

How do you assess a supplier with access to operational technology?

The assessment is the same; the consequences of a finding are not. An operational system cannot usually be patched on the finding’s timetable, so tiering has to reflect what a supplier can reach rather than what it costs, and remediation planning has to assume a change window measured in weeks. That is an argument for finding things earlier rather than for assessing less — OT security covers the estate side of it.

Our suppliers are shared across the industry. Does that change the approach?

It changes what a score means. A supplier assessed in isolation tells you your own exposure; the same supplier seen across an industry tells you the concentration risk — and a dependency that looks minor on one contract can be systemic across a network. RiskXchange already runs this shared view for a UK rail industry body and more than 40 member companies: see the UK rail supplier risk programme.

How do you assess a supplier that will not complete a questionnaire?

From the outside, and without their participation. Every supplier is scanned for its exposed estate — domains, subdomains, services and certificates — and scored 0 to 900 before anyone is asked for anything. A questionnaire adds what cannot be seen from outside; it is not the starting point, and it is not a condition of a supplier being visible to you. See security ratings.

See it on your vendors.

Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.