The concept of "Smart Cities" revolves around the interconnection of different operators from domains of activity such as public transport, energy... These operators rely on Information and Communication Technology (ICT) systems to retrieve, process, and exchange data in order to improve their services and the quality of life of citizens. In this context, public transport operators have an important role to enable this smartness. They contribute to the life of the city, to the economy and ensure the resilience of the Smart City. The integration of several ICT systems enables "Intelligent Public Transport" (IPT), where cyber-physical devices, communication networks and central servers optimise the transport service up to a certain degree of automation. While this fusion of cyber technology, physical infrastructures and mass transport vehicles creates new opportunities for improving services and functionality, it also has the effect of introducing cyber security risks into transport networks that have not historically been susceptible to such risks. Moreover, IPT becomes a natural target for emerging cyber threats that will have an impact not only on the operations of the transport service but also on the whole economy and potentially on the health and safety of citizens. For that reason, it is important to consider security for Intelligent Public Transport to protect the operators, the economy and the life and safety of citizens. However, IPT faces several challenges in this direction: there is currently no EU policy on cyber security for transport, the awareness level is low and it is difficult for operators to dedicate budget to this specific objective of cyber security (see picture on the right). This study proposes a pragmatic approach that will highlight the critical assets of Intelligent Public Transport systems. It gives an overview of the existing security measures (good practices) that could be deployed to protect these critical assets and ensure security of the IPT system, based on a survey and interviews of experts from the sector, municipalities, operators, manufacturers and policy makers. The good practices propose a first step toward actionable security and a better protection of the transport ecosystem. Good practices go beyond technical security measures; they also integrate policies, standards, operational and organisational measures. For example, transport operators can use this study in support of their risk assessment in order to understand which critical assets to protect, and how. In spite of the fact that security becomes a concern for all actors of Intelligent Public Transport, additional efforts are still needed to improve the current situation. Following that direction, the study proposes recommendations to three stakeholders groups that need to enhance the status of cyber security for IPT
