Direct answer
Core controls include network segmentation, authenticated users and devices, encrypted communication, controlled updates, logging and an incident-response process.
Architecture and access
Document network zones, ports, services, identities and who may dispatch, configure or support the system.
Lifecycle security
Define vulnerability handling, software updates, support access, credential rotation and end-of-support expectations.
Data minimization
Transport systems should avoid unnecessary patient or clinical data and define retention for operational logs.