The Challenge
V/Line needed to improve cyber resilience across its Operational Control System network by restricting unnecessary access to critical OCS/TCS assets and establishing a centralised Identity and Access Management (IAM) system with AAA and 802.1x support. Without a structured IAM framework, the risk of unauthorised access to safety-critical rail infrastructure remained unacceptably high and increasingly difficult to audit.
The Solution
L2iQ adopted a structured design approach aligned with V/Line’s standards, its own CP-13 Design Management Process and ISO15288:2023. This included detailed requirements workshops with V/Line’s cyber security, network engineering and maintenance teams; IEC 62443-aligned risk assessments; and IAM architecture design with a scalable structure enabling future integration of advanced capabilities including IGA, PAM and MFA.
What L2iQ Delivered
- IAM Security Zone design and supporting compute infrastructure specification
- Central Identity Repository design (e.g., Microsoft Active Directory)
- AAA/NAC solution design (e.g., Aruba ClearPass, Cisco ISE)
- IEC 62443-aligned cyber security risk assessments for OCS/TCS user access threats
- Concept Design (CD) and Preliminary Design (PD) packages under NIPR-2695
- Decision registers, RAMS reports and test strategies across design stages
- Future-proofed architecture enabling progressive expansion to PAM, MFA and IGA
The Outcome
L2iQ delivered a clear IAM implementation roadmap aligned to IEC 62443 and V/Line’s standards. Foundational IAM controls were designed for OCS/TCS network assets, addressing immediate cyber risks. The future-proofed architecture enables V/Line to progressively expand IAM coverage to additional asset classes and advanced capabilities, significantly improving the security posture of the operational technology environment.