The Challenge
City Rail Link is a new 3.5km dual-bore tunnel under Auckland connecting into existing brownfield operating areas of the Kiwi Rail network — one of New Zealand’s largest rail infrastructure projects. The project was being delivered primarily through an alliance model, with separate operating and signalling networks run by Auckland Transport and KiwiRail respectively. While the delivery alliance had completed basic sub-system cyber assessments for Signalling and the ICS/BMS, these assessments were siloed and did not address cyber security as an integrated system — particularly in the context of greenfield systems being connected into legacy brownfield operations. City Rail Link needed an independent, credible baseline of the project’s cyber risk position, along with a pragmatic path to close identified gaps.
The Solution
L2iQ was engaged by CRL to independently review and assess the cyber security work completed to date by the Delivery Alliance, and to extrapolate that work out to full system-level and brownfield-integration cyber security. L2iQ brought its track record of similar baseline reviews for other transport operators and owners to the engagement, providing a pragmatic, standards-based approach to assessing a complex, multi-operator rail environment.
L2iQ’s engagement covered a review of work executed by the Alliance against known and applicable cyber security standards, a gap analysis and risk assessment extending beyond the project’s own battery limits, and a set of practical recommendations to address shortfalls — culminating in a closeout presentation to project leadership.
What L2iQ Delivered
| Independent Review | Risk & Gap Assessment | Advisory & Close-out |
| Reviewed and assessed Alliance cyber work to date Benchmarked assessments against known applicable standards Evaluated greenfield-to-brownfield integration risk Engaged directly with Alliance sub-contractors | System-level cyber security gap analysis Risk assessment extending beyond project battery limits Assessment of legacy network and comms integration risk | Practical recommendations to address identified shortfalls Guidance on external actions needed to improve cyber profile Closeout presentation to project leadership |
The Outcome
L2iQ’s engagement gave City Rail Link an independent, credible view of its cyber security position — moving beyond individual sub-system assessments to a system-wide understanding of the risk created by integrating the greenfield tunnel and stations into an operating brownfield rail network. The engagement equipped the project with a pragmatic set of recommendations to lift its cyber security profile, both within the project and in coordination with its external network operators, ahead of the tunnel’s connection into live rail operations.