HŽ Passenger Transport (HŽPP) has been certified according to the international ISO/IEC 27001:2022 standard for its Information Security Management System (ISMS).

The certificate was presented to Željko Ukić, President of the Management Board of HŽPP, on 19 October 2026 by Franjo Potak, a manager at DNV Adriatica d.o.o., an internationally accredited certification body.

HŽPP is required to implement the cybersecurity risk management requirements and measures prescribed by the Cybersecurity Act (Official Gazette No. 14/2024) and the Cybersecurity Regulation (Official Gazette No. 135/2024), which transpose and elaborate on the requirements of Directive (EU) 2022/2555 (NIS2) into the Croatian legal framework.

The establishment of an ISMS in accordance with the ISO/IEC 27001:2022 standard was selected as an internationally recognised framework for the systematic management of cybersecurity risks, implementation of appropriate organisational and technical measures, and documentation of activities related to information security.

The certificate confirms that, within the defined scope of certification, HŽPP has established and implemented an ISMS compliant with the requirements of the ISO/IEC 27001:2022 standard. The ISMS supports the provision of domestic and international passenger rail transport services.

The system covers risk assessment and treatment, protection of the confidentiality, integrity and availability of information, security incident management, and the strengthening of business continuity and information system resilience.

The established system includes security policies and procedures, risk assessments, the Statement of Applicability (SoA), records of implemented security controls, internal audits and Management Reviews. Security controls are based on the requirements of the ISO/IEC 27001:2022 and ISO/IEC 27002:2022 standards, as well as applicable regulatory requirements in the field of cybersecurity.

The certification provides a documented framework for the systematic implementation, monitoring and continuous improvement of security measures. The associated documentation also serves as an important basis for demonstrating their implementation during audits and inspections by competent authorities, as well as in the event of cybersecurity incidents. This further strengthens HŽPP's ability to manage security risks and enhances the resilience of its information systems.

DNV (Det Norske Veritas), an internationally recognised certification body, was selected to carry out the certification process.

Obtaining the ISO/IEC 27001:2022 certificate represents an important step in HŽPP's ongoing efforts to improve information security, ensure responsible cybersecurity risk management and strengthen the resilience of its information systems, while continuing to align with applicable national and European requirements.