Why the Right Question Is Better Than a Thousand Review Comments

Parasyn has served as Owner's Engineer and Principal's Support Engineer on a major Australian passenger rail systems replacement program, supporting the operator through detailed design, review and testing of a new traction power supervisory and control system. As part of that role, Parasyn has spent more than two years reviewing the design contractor's cyber security documentation, developed to meet TS 50701, the international standard for cyber security in the design and integration of railway control and signalling systems.

The design contractor was new to TS 50701 and worked through it under significant staff turnover across the life of the program. The result was a familiar pattern: a large and constantly revised set of cyber security artefacts, a threat log, a detailed risk assessment, a zones and conduits report, a cyber security requirements matrix and verification matrix, and a cyber security testing plan, each individually detailed, but not always connected to one another. A risk could be identified in one document without a clear, traceable path to the control that addressed it, or the test case that proved it worked. More documentation was not the answer. What was missing was a demonstrable line of sight from risk, to requirement, to verified test result.

The stakes in getting this right are not abstract. ASD's Annual Cyber Threat Report 2024-25 put the average self-reported cost of a single cyber security incident for a large Australian business at $202,700 in the most recent reporting year, up 219% on the year before. That figure does not account for the cost of a compromised signalling or traction power system on a live passenger rail network, which is why the operator engaged Parasyn to hold the line on design assurance rather than simply track documentation through to sign-off.

Parasyn's role was not to produce the cyber security design, it was to review it on the operator's behalf and advise the operator on how to manage a design contractor working through an unfamiliar standard:

1. Structured review cycles
   Each cyber security artefact was worked through a formal review comment sheet process, in step with the contractor's design and testing milestones rather than as a one-off audit.
2. Traceability as the standing question
   Every review came back to the same test: could a given risk or requirement be traced through to a specific, verifiable test case, not just described in prose.
3. Escalation when comments weren't enough
   Where successive rounds of written review comments weren't closing the gap, Parasyn called dedicated workshops with the operator and the design contractor to work through the documents line by line.
4. Guidance back to the client
   Beyond marking up individual documents, Parasyn advised the operator directly on how to manage the design contractor's delivery of this material, including where quality was falling short of what the program needed.

The review programme covered the core suite of TS 50701 aligned cyber security artefacts produced for the project:

The review programme is ongoing as the design contractor's documentation continues to mature, but the discipline Parasyn has applied has consistently reset the bar on what counts as design assurance evidence for the operator:

This engagement is a reminder that document review is not a paperwork exercise. A design contractor working through an unfamiliar standard, under staff turnover, will tend to produce volume rather than clarity. Parasyn's value here was not in the number of comments raised across two years of review, it was in the discipline of asking, every time, whether a given risk could actually be traced to a test result that proved it was addressed. The right question, asked consistently, closes more gaps than a thousand review comments ever will.