Effects of current cybersecurity guidelines on companies without a KRITIS connection

The new EU directives on cybersecurity significantly expand the requirements and areas of application for all transport companies, meaning that current non-KRITIS railway companies are also obliged to implement increased cybersecurity measures. This applies equally to railway undertakings (RUs) and railway infrastructure companies (RIUs).
The transposition of the directives into German law has already been published in the draft bill, which is presented in this article.