Aviation Cybersecurity Guide: Part-IS, TSA, CAP 1753

Aviation depends on tightly coupled IT, OT and aircraft systems run by many different organisations, so a single compromised supplier or network can ground flights across several countries. Airports, airlines, air navigation service providers (ANSPs), maintenance organisations and manufacturers now sit under specific cyber rules: EASA Part-IS in the EU, the CAA's CAP 1753 process in the UK, TSA requirements in the US and ICAO Annex 17 worldwide. This guide explains the aviation attack surface, what those regimes ask for, how airworthiness security differs from enterprise security, and how to segment, monitor and measure an aviation environment. It is written for security leads, OT engineers and compliance owners at aviation organisations and their suppliers. For general OT practice, it links to the OT Security Guide and IEC 62443 Guide rather than repeating them.

Key takeaways

Safety is the test that matters. Part-IS and the airworthiness standards ask whether an information security weakness could create a safety impact, not only whether data could be lost.
Part-IS now applies to most EU aviation organisations. Delegated Regulation (EU) 2022/1645 has applied since 16 October 2025 and Implementing Regulation (EU) 2023/203 since 22 February 2026, with a 72-hour reporting limit to the competent authority.
Shared platforms are a concentration risk. The September 2025 ransomware incident at Collins Aerospace's MUSE passenger processing system disrupted Berlin, Brussels and Heathrow at once.
Aircraft security is a certification discipline. EASA AMC 20-42 and the ED-202A/DO-326A family require a product information security risk assessment for new types, changes and supplemental type certificates.
Segmentation and access control carry most of the weight. Every regime, from ICAO Annex 17 to the TSA's 2023 amendment, names network separation, limited remote access and monitoring of critical systems.

The aviation attack surface

An aviation organisation rarely owns all the systems its operation relies on. Airports host common-use systems that airlines share, ground handlers run their own platforms, and manufacturers and ANSPs connect to aircraft and to each other. The table groups the main domains by who typically operates them and how they fail.

Domain	Typical systems	Operated by	Main exposure
Passenger processing	Common-use check-in and boarding, kiosks, bag drop, departure control systems	Airport, airline or a shared service provider	One supplier platform serving many airlines and airports; shared workstations
Airport operations	Airport operational database, flight information displays, baggage handling, building management, access control	Airport operator and integrators	Flat networks linking IT and OT; long-lived integrator remote access
Airline operations	Flight planning, crew scheduling, operations control, electronic flight bags	Airline and SaaS providers	Cloud and SaaS dependencies; mobile devices carried onto aircraft
Maintenance and engineering	Maintenance records, loadable software parts, data loaders, engineering laptops	Maintenance and CAMO organisations, manufacturers	Integrity of software and data loaded onto aircraft; contractor access
Air navigation	Air traffic management, surveillance, communications, navigation including GNSS	ANSPs	Safety-critical availability; radio frequency interference
Aircraft systems	Avionics, cabin and passenger connectivity, aircraft-to-ground data links	Manufacturers in design, operators in service	Unauthorised electronic interaction across aircraft network domains

The regulatory picture

Aviation cyber rules come from aviation safety and security law, not only from general cyber law, and several can apply to the same organisation. Dates and status below are as the official sources stated when checked in October 2026.

Regime	Who it covers	What it requires	Status
ICAO Annex 17, Standard 4.9.1 and Recommended Practice 4.9.2	States, which apply it to operators and entities	Identify critical information and communication systems and data, and protect them on the basis of a risk assessment; 4.9.2 suggests security by design, supply chain security, network separation and limited remote access	In force; supported by the ICAO Aviation Cybersecurity Strategy and Cybersecurity Action Plan
EASA Part-IS: Delegated Regulation (EU) 2022/1645	Aerodrome operators, design and production organisations, apron management service providers	Information security management system (ISMS) with safety-focused risk assessment, incident handling and reporting	Applies from 16 October 2025
EASA Part-IS: Implementing Regulation (EU) 2023/203	Air operators, maintenance and CAMO organisations, training organisations, simulator operators, ANSPs, ATCO training, competent authorities	Same ISMS model, set out in points IS.I.OR.100 to IS.I.OR.260	Applies from 22 February 2026 (1 January 2026 for the EGNOS service provider)
NIS2 Directive	Essential and important entities, including air transport	Risk management measures and staged incident reporting	National transposition; Part-IS compliance does not remove NIS2 duties. See the NIS2 Directive Guide.
UK CAA CAP 1753	Organisations the CAA notifies as in scope across airworthiness, flight operations, aerodromes, airspace and aviation security	Eight-stage oversight: key roles, scoping, self-assessment, verification audit, corrective action plan, Certificate of Compliance, ongoing oversight	Operating; audits by an ASSURE Cyber Supplier or the CAA Cyber Oversight Team
US TSA aviation cybersecurity amendment (March 2023)	TSA-regulated airport and aircraft operators	Implementation plan, network segmentation, access control, continuous monitoring and detection, risk-based patching	Issued 7 March 2023 as an emergency amendment; check TSA for the current version

The ICAO strategy rests on seven pillars: international cooperation; governance; effective legislation and regulations; cybersecurity policy; information sharing; incident management and emergency planning; and capacity building, training and cybersecurity culture. Its action plan breaks those into 32 priority actions and 51 tasks. ICAO policy guidance also asks each State to designate an appropriate authority for aviation cybersecurity, which is why national arrangements differ.

EASA Part-IS in practice

Part-IS asks for an ISMS, but it is not a copy of ISO/IEC 27001. The scope is information security risks that could have an impact on aviation safety, and the ISMS is expected to work alongside the existing safety management system. The organisation requirements in Annex II of Regulation 2023/203 are set out as numbered points.

Point	Title	What auditors will look for
IS.I.OR.200	Information security management system	Policy, accountable manager, scope covering safety-relevant systems
IS.I.OR.205 and .210	Risk assessment and risk treatment	Assets and interfaces mapped, including suppliers; risks rated for safety impact; treatment decisions recorded
IS.I.OR.215	Internal reporting scheme	Staff can report events and weaknesses; reports are analysed
IS.I.OR.220	Incidents: detection, response and recovery	Detection capability, response procedures, recovery tested
IS.I.OR.225	Response to findings from the competent authority	Root cause and corrective actions within agreed periods
IS.I.OR.230	External reporting scheme	Reporting route to the authority and, where relevant, to the design approval holder
IS.I.OR.235	Contracting of information security management activities	Contracted parties meet the same requirements; organisation stays responsible
IS.I.OR.240 and .245	Personnel requirements and record-keeping	Competent, trained staff; records kept for the required period
IS.I.OR.250, .255 and .260	Information security management manual, changes, continuous improvement	Manual kept current; changes managed; effectiveness reviewed

Reporting clock: under IS.I.OR.230 the organisation notifies as soon as it becomes aware of a reportable condition, submits a report as soon as possible and not later than 72 hours from that point unless exceptional circumstances prevent it, and sends a follow-up once recovery and preventive actions are known. Align this with NIS2 reporting, which has its own early warning, notification and final report stages.
Maturity, not a cliff edge: industry summaries of the EASA approach describe a "present, suitable, operational, effective" (PSOE) path, with present and suitable expected at the applicability date and up to 18 further months to reach operational and effective. Confirm the expectation with your competent authority.
Contractors count: outsourced security operations, managed IT and cloud providers fall under IS.I.OR.235, so contracts need audit rights and reporting obligations that let you meet the 72-hour limit.

Airworthiness security for aircraft and equipment

Aircraft security is handled in type certification, separately from the organisational ISMS. EASA AMC 20-42 gives an acceptable means of compliance for assessing information security risks to products and parts. Its core method is the product information security risk assessment (PISRA), which asks whether intentional unauthorised electronic interaction (IUEI) could cause an unsafe condition.

When it applies: new type certificates for aircraft, engines and propellers, supplemental type certificates, changes to products, and ETSO approvals for new or changed equipment.
Process standard: EUROCAE ED-202A, equivalent to RTCA DO-326A, defines the airworthiness security process.
Methods: ED-203A (RTCA DO-356A) covers methods and considerations, such as threat conditions, security measures and assurance.
Continuing airworthiness: ED-204 (RTCA DO-355) covers information security guidance for operating and maintaining aircraft, which is where the operator's ISMS and the manufacturer's security instructions meet.
Operator duties: follow the manufacturer's security instructions for continued airworthiness, control loadable software parts and data loaders, and protect the maintenance laptops and portable devices that connect to aircraft.

The practical lesson for operators is that an aircraft's security case assumes ground processes work. If a maintenance laptop is shared, unpatched and used for email, the assumptions in the type design no longer hold.

Segmentation and zone design

ICAO Recommended Practice 4.9.2 and the TSA amendment both name network separation, and the TSA wording is specific: operational technology should keep running if IT systems are compromised. That requires deliberate zones rather than one airport network.

Inventory first: list every system that supports flight operations, passenger processing, baggage, airside access and navigation, with its owner, supplier and connections. See the OT Asset Visibility Guide.
Define zones by safety and operational impact: for example airside OT (baggage, airfield lighting, fuel), passenger processing, airline tenant networks, building management and corporate IT, each with an owner.
Control conduits: allow only documented flows between zones, inspect them and log them. Treat airline tenant connections and supplier links as separate conduits, not part of the airport LAN.
Plan for IT loss: document how airside OT and critical passenger processes operate in a degraded mode, including manual check-in and boarding procedures, and test them.

For the zone and conduit method itself, see the IEC 62443 Guide and the Network Segmentation Guide.

Where identity fits

Identity is a genuine weak point in aviation because many systems are shared, run by third parties or reached remotely.

Common-use workstations: check-in and gate positions are used by many airlines and handlers. Require individual sign-in to the application even where the device session is shared, and time out idle sessions.
Supplier remote access: baggage, building and passenger processing integrators often hold permanent access. Broker it, require MFA, limit it in time and record sessions. See the OT Remote Access Guide.
Service accounts and API keys: airline, airport and handler systems exchange flight and passenger data through interfaces with long-lived credentials. Inventory them, scope them and rotate them.
Maintenance credentials: data loader and engineering accounts should be individual, not shared crew room logins.

See the OT and ICS Identity and Access Guide and the Transportation Identity and OT Access Guide.

GNSS interference and radio frequency threats

Not every aviation cyber threat arrives over IP. EASA's Safety Information Bulletin 2022-02, now at revision R4 (issued 3 July 2026), addresses GNSS jamming and spoofing, which EASA says has grown in severity and sophistication since February 2022, especially near conflict zones. The bulletin is addressed to competent authorities, ANSPs, air operators and manufacturers. Security teams should make sure GNSS interference reports from crews feed into the same risk register and threat intelligence as network events, because Part-IS treats safety-relevant information security risks as one problem.

How to implement

Confirm applicability: map each approval or certificate you hold to Part-IS, NIS2, CAP 1753, TSA programmes or other national rules, and name one accountable owner per regime.
Scope and inventory: build the system and interface inventory above, including supplier platforms and cloud services, and mark which ones have a safety impact.
Risk assessment: rate risks by safety and operational impact using the ISMS method; record treatment decisions under IS.I.OR.210.
Quick wins: MFA on all remote and privileged access, removal of dormant accounts, segmentation of airside OT from corporate IT, and risk-based patching that prioritises the CISA Known Exploited Vulnerabilities catalogue.
Reporting drill: run a tabletop that starts with a supplier ransomware event and tests the 72-hour Part-IS report, the NIS2 early warning and airline or airport partner notifications at the same time.
Degraded operations test: rehearse manual processing for a defined period. Roll back any segmentation change that blocks an undocumented but essential flow, document the flow, then reapply the rule with that flow permitted.
Monitor and improve: deploy OT-aware network monitoring on key conduits, then review the ISMS through IS.I.OR.260 continuous improvement.

Decision guidance

Single ISMS or separate: organisations holding several approvals (for example an airline with its own maintenance organisation) usually do better with one ISMS and one manual covering all approvals, provided each competent authority's scope is clear.
Build or buy monitoring: large hubs and ANSPs usually justify an in-house OT security operations capability; regional airports and small operators often rely on a managed service, which then falls under IS.I.OR.235 contracting rules.
Shared platform risk: where a single supplier runs passenger processing for many airlines, the airport should require that supplier's incident reporting times, recovery objectives and segmentation evidence in contract, and keep a fallback process that does not depend on that supplier.
Small organisations: Part-IS is proportionate to size and risk. A small training organisation still needs a risk assessment, reporting route and incident procedure, but not a large security team.

Detection and measurement

Log and monitor sign-ins to remote access and supplier portals, traffic across zone conduits, changes to airport operational and passenger processing systems, use of data loaders and loadable software parts, and crew reports of GNSS interference. Useful metrics:

Percentage of safety-relevant systems in the inventory with a named owner and a completed risk assessment.
Percentage of supplier and remote access paths that are brokered, use MFA and are time-limited.
Median time from awareness of a reportable condition to submission of the Part-IS report (target well inside 72 hours).
Known exploited vulnerabilities open on critical systems beyond the agreed remediation time.
Time to restore critical passenger processing in degraded-mode exercises, against the target.
Number of undocumented flows found crossing zone boundaries per quarter, trending down.

Framework mapping

Aviation requirement	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ATT&CK technique addressed
Identify critical systems and data (Annex 17 4.9.1, IS.I.OR.205)	ID.AM	CM-8, RA-3	T0883 Internet Accessible Device
Network separation (RP 4.9.2, TSA amendment)	PR.IR	SC-7	T0866 Exploitation of Remote Services
Access control and limited remote access	PR.AA	AC-17, IA-2	T1133 External Remote Services, T0859 Valid Accounts
Supplier and contracted activities (IS.I.OR.235)	GV.SC	SR-3	T1195.002 Compromise Software Supply Chain
Detection, response and recovery (IS.I.OR.220)	DE.CM, RS.MA	SI-4	T1486 Data Encrypted for Impact, T0826 Loss of Availability
External reporting (IS.I.OR.230)	RS.MA	IR-6	Not applicable

Common failure patterns

Treating Part-IS as an IT project: the ISMS covers corporate IT but leaves out baggage, airfield and maintenance systems that actually carry the safety risk.
Dormant remote access: integrator and former supplier accounts stay active without MFA. The Colonial Pipeline ransomware attack began with an unused VPN account that had no MFA, and the operational shutdown followed from the IT compromise.
No fallback for shared platforms: airports and airlines assume the passenger processing supplier will recover quickly and have no rehearsed manual process.
Reporting routes that cannot meet the clock: contracts with managed service providers do not require them to tell the organisation in time to report within 72 hours.
Uncontrolled maintenance devices: shared, internet-connected laptops are used to load software onto aircraft, undermining the airworthiness security assumptions.
Separate silos for RF and cyber: GNSS interference is handled only by flight operations and never reaches the security risk register.

Lessons from incidents

In September 2025 a ransomware incident at Collins Aerospace, affecting its MUSE passenger processing software, disrupted check-in at airports including Berlin, Brussels and London Heathrow from 19 September. ENISA described it as a third-party ransomware incident. The lesson is concentration: one supplier compromise reached several airports and many airlines at once, so supplier risk, fallback procedures and coordinated reporting need to be planned across organisations, not only inside each one. See the OT Incident Response Guide and the Third-Party Risk Management Guide.

Practitioner checklist

Map every approval you hold to Part-IS, NIS2, CAP 1753, TSA or other national cyber obligations.
Build an inventory of safety-relevant systems, interfaces and suppliers, with owners.
Run and record a safety-focused information security risk assessment and treatment plan.
Separate airside OT, passenger processing, tenant networks and corporate IT into zones with controlled conduits.
Broker, time-limit and record all supplier remote access, with MFA.
Test the 72-hour Part-IS report alongside NIS2 and partner notifications.
Rehearse degraded and manual operations for passenger processing and baggage.
Control maintenance laptops, data loaders and loadable software parts.
Feed GNSS interference reports into the security risk register.
Review metrics quarterly and record improvements in the ISMS.

Standards and references

Related NHI Mgmt Group resources: OT Security Guide · IEC 62443 Guide · OT and ICS Identity and Access Guide · NIS2 Directive Guide. This guide summarises aviation cyber security regulations and is not legal advice.

Aviation Cybersecurity Guide: Airports, Airlines and Aircraft Systems