Cybersecurity Standards Across Industries: A Critical Analysis of Current Practices and Future Directions in the Railway Sector

The increasing digitalization of railway systems has significantly expanded their cyber-physical attack surface, raising critical concerns about the adequacy of current cybersecurity governance, particularly in safety-critical environments. Although cybersecurity standards provide structured approaches to risk management, their integration into railway-specific system lifecycles remains fragmented, and their practical implementation is still underexplored in both academic and industrial domains. This paper presents a comprehensive and methodologically grounded study addressing these limitations through two main contributions. First, it provides a detailed analysis of the primary cybersecurity standards applicable to the railway domain, with a particular focus on the risk assessment frameworks defined in CENELEC TS 50701 and IEC 62443. Second, it offers a comparative analysis of selected standards, identifying complementarities and opportunities for cross-domain synergies with other safety-critical sectors, supported by illustrative examples of practical applications. Additionally, the paper delivers a critical review of existing literature on railway cybersecurity, revealing persistent gaps in lifecycle integration, interdisciplinary alignment, and the contextual adaptation of cybersecurity measures to the specific operational and safety constraints of the railway sector. By synthesizing these findings, the study contributes a coherent foundation for aligning cybersecurity governance with the unique demands of railway systems, offering actionable insights for researchers, practitioners, and regulatory bodies working to secure next-generation railway infrastructures.