In force
CERT-In Directions: Six-hour incident reporting
Listed cyber incidents reported to CERT-In within six hours; ICT logs retained and clocks synchronised.
Transport & Infrastructure
Fleet, terminal and passenger data that keeps services running.
What we would build for logistics firms, port terminal operators, metro rail companies and bus transport undertakings: integration across asset, operations and passenger systems, data platforms for maintenance and passenger information, knowledge for field and control room staff, and IT/OT security ready for six-hour reporting to CERT-In.
For logistics firms, port terminal operators, metro rail companies and State transport undertakings, and for Indian firms with transport operations in Europe.
28 April 2022
Six-hour reporting to CERT-In
Listed cyber incidents are reported within six hours of being noticed, with ICT logs retained and clocks synchronised.
SourceCERT-In Directions under s. 70B(6) IT Act (opens external site)
May 2027
DPDP duties for passenger data
Notice, safeguards and breach intimation for the personal data of passengers and customers held digitally.
2 December 2027
EU AI Act and road traffic
In the EU, AI used as a safety component in road traffic management becomes high-risk under the 2026 amendment.
What is changing for Indian operators and logistics firms
Passenger data comes under the DPDP Act
Smart cards, ticketing apps and camera analytics bring passengers’ personal data into transport systems. With Data Fiduciary duties applying from May 2027, operators need notice, purpose limits, safeguards and breach intimation designed in rather than bolted on.
SourceG.S.R. 846(E)
Control systems sit inside incident law
CERT-In’s Directions require listed cyber incidents to be reported within six hours, and a signalling network or terminal operating system is part of the estate an attack can reach. IEC 62443 gives engineers a shared approach to zones, conduits and security levels.
European corridors bring data duties
Indian logistics firms with operations in the EU meet its data-sharing rules: the revised ITS Directive requires defined road and travel data in standard formats through National Access Points, and EU authorities must accept electronic freight information from July 2027.
SourceDirective (EU) 2022/2555
Ageing assets, retiring experts
Bridges, depots, terminals and rolling stock need more inspection and better decisions as they age, while the engineers who know their history retire. Condition data, inspection reports and drawings belong in one searchable place.
Problems we are asked to solve
- The problem
Design models, GIS, maintenance systems and spreadsheets each hold a different version of one asset.
What we would doIntegration over an event backbone on open standards such as IFC 4.3 and railML gives design, construction and maintenance a single asset register, where every change is captured once.
- The problem
Inspection reports, photos and defect notes pile up faster than engineers can read them.
What we would doEach inspection or survey report is read, every finding linked to its asset, and a draft maintenance notification prepared with the source page attached; an engineer confirms it.
- The problem
Passengers expect accurate information across metro, bus and feeder services.
What we would doA data platform that combines timetables, live vehicle positions and disruptions, publishes feeds in GTFS or comparable open formats to journey planners, and monitors their completeness and delay.
- The problem
Each new feed from signalling, terminal or traffic control systems opens another path for attackers.
What we would doIT/OT architecture with zones and conduits per IEC 62443 and, for rail, CLC/TS 50701, one-way transfer where the risk warrants it, central identity and the logs a six-hour report to CERT-In relies on.
- The problem
Field crews and control room staff search procedures, drawings and work history across several systems.
What we would doA knowledge assistant over procedures, asset records, inspection reports and past work orders, naming document and revision. It advises only; route setting, movement authorities and traffic settings are never its to change.
- The problem
Call centres are swamped whenever there are disruptions, engineering works or new timetables.
What we would doService assistance that answers disruption, journey and refund questions from source systems and passes complaints and special cases to staff, in English and in the other languages configured for your passengers.
Transport IT/OT reference design
Control levels stay intact. Above the zone boundary, an integration layer built on events and open standards gives asset, analytics, knowledge and open data services the operational data they need.
Illustrative example
Operational data leaves the control zone at one point, the integration layer, and every service above draws on it.
Read the diagram as text
Top to bottom: the enterprise layer with ERP, asset, ticketing and customer systems; operations with traffic management, timetable and capacity planning and terminal operations; supervisory control with interlocking and tunnel and road traffic SCADA; field equipment such as signals, point machines, axle counters, sensors and message signs; and the physical network of track, roads, bridges, tunnels and quays.
IEC 62443 and CLC/TS 50701 define the zone boundary that sits between the enterprise layer and the levels under it.
Data from levels 1 to 4 passes into an integration layer of events and open standards. That layer supplies a platform for asset, traffic and passenger data, which in turn serves analytics on condition, capacity and punctuality, a knowledge assistant for field and control room staff, and open data feeds with regulatory reporting.
Operations stay in command
Analytics and assistants only read. Route setting, movement authorities and traffic control remain with the signalling system, the interlocking and the controller on duty.
Segmented networks
Segmentation per IEC 62443 and, for rail, CLC/TS 50701, with documented conduits and one-way transfer out of the control zone where the risk calls for it.
A single asset register
With IFC 4.3 and railML, designers, builders and maintainers use one vocabulary, so each change to the network is captured a single time.
Open feeds from the same source
Passenger information feeds are drawn from the platform used for internal reporting and checked for gaps and delay before release.
Indian and European dates for transport systems
Indian incident, data protection and invoicing rules next to the EU accessibility, data-sharing and resilience rules that apply to operations in Europe. Sector legislation adds dates of its own.
In force
DPDP Act: Data protection law published
Passengers’ and customers’ personal data held digitally comes under one national law.
In force
NIS2: Member State NIS2 laws take effect
Air, rail, water and road transport in the EU come within scope, with national differences.
In force
GST e-invoicing: 30-day reporting window on the IRP
Larger taxpayers can no longer report invoices older than 30 days to the Invoice Registration Portal.
In force
European Accessibility Act: Accessibility rules for passenger services
Websites, apps, e-tickets and real-time travel information of passenger services in the EU.
In force
EMSWe: EU maritime single window environment applies
Port-call reporting in EU ports through harmonised national single windows.
In force
ITS Directive: First EU road data deadlines
Traffic regulations, road works and safety-related events on the TEN-T core network go to the National Access Point; more data follows until 2028.
In force
CER Directive: Critical entities named in the EU
Named entities then assess their risks and take resilience measures.
Position on 6 November 2026
Ahead
eFTI: EU authorities accept electronic freight information
Regulatory freight information made available through certified eFTI platforms must be accepted.
Ahead
AI Act: High-risk duties take effect
Covers AI used as a safety component in road traffic management in the EU, under the 2026 amendment.
Ahead
EU rail capacity regulation: Digital capacity and traffic management tools
Information exchange for traffic management and digital capacity tools apply in the EU; the new capacity process starts with the 2031 working timetable.
EU transport rules, and when they reach Indian firms
These EU instruments bind operators in Europe. They reach Indian logistics firms, terminal operators and technology suppliers that work there, and they offer a point of comparison for Indian practice.
Planning orientation only, not legal or regulatory advice; sector legislation adds requirements of its own. Indian rules as they stood on 6 November 2026; EU dates checked on 15 October 2026.
- NIS2 for transportScopeEU instrument
In the EU, transport counts as highly critical in every mode: rail infrastructure managers and railway undertakings, airlines, airports and air traffic control, shipping companies, ports and vessel traffic services, and road authorities and ITS operators. Duties cover risk management, incident reporting and supplier security.
How it affects youAt home, CERT-In’s six-hour reporting already applies to listed incidents. We build access control, logging and incident data into platforms and integrations from the first release, so the evidence exists before an auditor asks.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- ITS Directive and National Access PointsScopeEU instrument
The EU framework for intelligent transport systems is Directive 2010/40/EU as revised by Directive (EU) 2023/2661. Delegated regulations under it oblige road authorities and operators to offer specified road, traffic and travel data, in standard formats, through each Member State’s National Access Point, with the coverage growing in steps.
How it affects youRelevant to Indian firms running road or logistics services in the EU. Data once shared on request must now be current and machine-readable; we build the pipelines, format conversion and quality checks behind it.
SourceDirective (EU) 2023/2661, EUR-Lex (opens external site)
- Multimodal travel informationScopeEU instrument
Delegated Regulation (EU) 2017/1926, as amended in 2024 by Delegated Regulation (EU) 2024/490, specifies which timetable, network and real-time data EU operators publish through the National Access Point, in NeTEx and SIRI. Real-time status and disruption data for the comprehensive TEN-T network are expected from 1 December 2025; for the remaining network, from 1 December 2028.
How it affects youThe same discipline helps an Indian metro or bus operator that publishes open data: timetables, stops, accessibility details and live data drawn from one consistent source and checked before release.
SourceDelegated Regulation (EU) 2017/1926, EUR-Lex (opens external site)
- European Accessibility Act for passenger transportScopeEU instrument
From 28 June 2025, national laws in the EU require the websites, apps, electronic tickets, ticket sales and live travel information of passenger services by air, bus, rail and water to be accessible, and that holds when the provider is an Indian company.
How it affects youIn India, IS 17802 is aligned with WCAG 2.1 and EN 301 549, and GIGW 3.0 covers government sites. We design and test journey planners, ticketing and disruption messages to WCAG 2.2 AA.
SourceDirective (EU) 2019/882, EUR-Lex (opens external site)
- Rail passenger rightsScopeEU instrument
Since 7 June 2023, Regulation (EU) 2021/782 obliges railway undertakings and ticket sellers in the EU to keep passengers informed before and during travel, using live data where they can, and to deal with assistance, rerouting and compensation within set time limits, drawing on running data from infrastructure managers.
How it affects youDisruption information and refund claims are data processes everywhere. We connect operations, ticketing and customer service so that passengers get one answer and claims are settled on time.
SourceRegulation (EU) 2021/782, EUR-Lex (opens external site)
- Rail telematics and capacityScopeEU instrument
In the EU, Implementing Regulation (EU) 2026/253 merges the passenger and freight telematics TSIs into one, applied in stages. Regulation (EU) 2026/1184 then adds digital capacity planning and the exchange of traffic management information from late 2027.
How it affects youRelevant to Indian suppliers of rail software to European operators. We connect planning, operations and customer systems to common message formats without touching the systems that run the trains.
SourceImplementing Regulation (EU) 2026/253, EUR-Lex (opens external site)
- Critical Entities Resilience DirectiveScopeEU instrument
Deals with the physical and organisational resilience of entities that are critical in the EU, transport among them. Each Member State designates them by 17 July 2026, after which they assess their own risks and put technical, security and organisational measures in place.
How it affects youResilience planning has to cover physical and cyber events together. We deliver systems with their dependencies mapped and their recovery tested.
SourceDirective (EU) 2022/2557, EUR-Lex (opens external site)
- AI Act and transportScopeEU instrument
AI meant as a safety component in managing and operating road traffic is high-risk under Annex III, with duties from 2 December 2027 under the 2026 amendment. For rail, marine equipment, vehicles and drones, the requirements arrive through the sector legislation in Annex I, Section B. An Indian provider is covered where its system’s output is used in the EU.
How it affects youEach use case is classified at the outset. Tools that advise staff are documented apart from systems that act on traffic, and the latter stay out of scope unless the high-risk route is planned.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
Illustrative use cases
Illustrative exampleBridge and viaduct inspections to work orders
Reports on bridges, viaducts and track are read, each finding tied to its asset and turned into a proposed maintenance notification that an engineer approves.
Procedures and history for metro maintenance crews
Crews receive the procedure, the asset history and the right drawings with sources; operational decisions remain with the operations control centre.
Disruption questions at peak hours
Passengers get the current status, alternatives and refund options from source systems; staff handle complaints and special assistance.
Freight and terminal documents
Bills of lading, delivery orders, permits and certificates are read and checked; a planner looks only at what is incomplete.
Ageing planning systems behind APIs
An older timetable, depot or maintenance planning system is placed behind documented APIs and replaced piece by piece while operations continue.
Platforms in transport and logistics
SAP
Gold PartnerSAP S/4HANA asset management, linear assets such as track, roads and pipelines included, with maintenance planning, procurement, finance and GST e-invoicing in one system.
Salesforce
Summit PartnerCustomer service, freight and passenger accounts and field service for logistics firms and transport operators, linked to ticketing, operations and asset systems.
Odoo
Gold PartnerProjects, field service, warehousing and invoicing for contractors, terminal service providers and smaller logistics firms.
Partner tiers shown are FromNine’s own. Product names belong to their respective owners.
India
Indian operations, European reference points
Indian transport operators and logistics firms report listed cyber incidents to CERT-In within six hours and, from May 2027, carry the Data Fiduciary duties of the DPDP Rules for passenger and customer data held digitally.
Indian firms running logistics or transport services in the EU meet its rules directly: NIS2 through national laws, the European Accessibility Act for passenger services, National Access Points for travel data and electronic freight information. We build on open standards such as IFC, railML, NeTEx, SIRI and GTFS, with national profiles in their own adapters, so one architecture serves both settings.
- CERT-In Directions 2022CERT-In Directions of 28 April 2022 under s. 70B(6) of the IT Act: reporting of listed cyber incidents within 6 hours, log retention, time synchronisation (opens external site)
- DPDP Act 2023Digital Personal Data Protection Act, 2023, also covering processing outside India connected with offering goods or services to Data Principals in India (opens external site)
- DPDP Rules 2025Digital Personal Data Protection Rules, 2025, brought into force in three steps over eighteen months (opens external site)
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- European Accessibility ActEuropean Accessibility Act, Directive (EU) 2019/882 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
Frequently asked questions
Could your software ever control trains, traffic or vessels?
No. Our analytics and assistants read operational data and nothing more, unless you decide otherwise. Signalling, route setting, movement authorities and traffic control remain with the certified systems and the controllers responsible for them, under your change control.
Do you build safety-certified signalling or control software?
No. Software that needs certification under the CENELEC railway safety standards, or any comparable regime, is outside what we build. We link to those systems through documented interfaces, normally read-only, and our components stay outside their safety case.
Which data standards do you use?
For infrastructure and assets, IFC 4.3 and railML; for timetables and live information, NeTEx, SIRI or GTFS; for road traffic data in Europe, DATEX II. Where a system uses its own format, the integration layer maps it to one of these.
Can you run the publication of our open data feeds?
We build and run the pipelines, the format conversion and the quality checks behind each feed. The decision on what is published, and accountability for it, stays with you.
How do you support incident reporting as a supplier to a transport operator?
Our information security management system is ISO/IEC 27001 certified. Security requirements and incident notification are agreed in the contract so that you can report to CERT-In within six hours; access to your environments is least-privilege and logged; and our components are documented for your supplier risk assessment. For European operators, the same evidence supports NIS2.
Must we replace our asset or planning systems?
No. Integration comes first and modernisation follows in stages: APIs around the current system, then one function at a time where the case is clear, with reconciliation until the old route is retired.
Discuss your transport or logistics programme
Connecting asset and inspection data, improving passenger information or securing IT/OT data flows? Begin with one line, one terminal or one data flow.