DO-326A

What DO-326A Covers in Aviation Security

DO-326A is not a product-specific checklist, but a structured aviation security standard. It gives designers, developers, verifiers, and operators a common way to identify threats, assess security risk, and define controls so intentional interference does not affect aircraft systems or the support processes around them.

Its value is that it treats aircraft security as a lifecycle problem. Security decisions made early in design, or left vague during integration and verification, can become embedded in avionics, maintenance workflows, and continued airworthiness activities long after the system enters service.

Why DO-326A Matters for Safety-Critical Systems

In aviation, security failures are not just data-loss events. If an attacker, supplier issue, or procedural gap can influence flight-critical behaviour, the consequence can be operational disruption, unsafe state transitions, or loss of trust in the system’s integrity. That is why a standard like DO-326A is centred on intentional interference rather than generic IT hygiene.

It also matters because aircraft environments combine long lifecycles, tightly controlled change, and many dependent support processes. A weakness in design assumptions, software updates, maintenance access, or verification evidence can persist for years if it is not addressed as part of a formal security case.

How DO-326A Is Applied Across the Lifecycle

DO-326A is meant to be used across design, development, verification, and continued airworthiness, not only during certification. Practically, that means security requirements are traced into architecture decisions, test activity, change control, and the evidence used to support ongoing safe operation.

It also encourages teams to think in terms of aircraft-specific attack surfaces, including onboard systems, connected support tooling, update paths, and maintenance processes. The standard’s strength is that it forces security to be considered as part of the engineering system, rather than as an afterthought added once integration is complete.

That lifecycle view is closely aligned with broader control thinking in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where organisations need disciplined access, integrity, audit, and configuration management around high-assurance systems.

What Good Security Evidence Looks Like Under DO-326A

A useful DO-326A implementation is evidence-driven. Teams should be able to show how threats were identified, how risk decisions were made, what controls were selected, and how those controls were verified before release and monitored afterward.

That evidence usually spans requirements, architecture, test results, configuration records, and operational procedures. The goal is not to generate paperwork for its own sake, but to prove that security assumptions still hold when the aircraft, its tooling, or its support environment changes.

Where organisations need a broader management view of control objectives and recurring assurance, NIST Cybersecurity Framework 2.0 can provide a useful high-level structure for govern, identify, protect, detect, respond, and recover activities.

Risk and Threat Considerations

DO-326A exists because aviation systems can be harmed by deliberate interference at multiple points, including development, supply, maintenance, update handling, and operational use. The risk is not only direct compromise of onboard functions, but also the erosion of the assumptions that keep safety-critical systems trustworthy over time.

Failure mechanism: Weak threat analysis, incomplete verification, or uncontrolled change can allow unauthorised modification, malicious logic insertion, or unsafe dependency behaviour to survive into operation or reappear after maintenance.

Impact: The result can be loss of integrity in flight-critical functions, compromised continued airworthiness, operational disruption, and in the worst case a safety event that affects aircraft availability or safe operation.

Practitioner Guidance

Why practitioners should care: DO-326A is most effective when treated as an engineering process, not a certification document. Aviation teams should use it to keep threat analysis, security requirements, and verification evidence connected as the system evolves.

What to watch for: The highest-risk gaps are usually in interfaces, updates, supplier dependencies, and maintenance tooling, where trust assumptions can silently change. If those areas are not explicitly covered in the security case, the standard’s intent is only partially met.

Practitioner takeaway: The standard is strongest when every security decision can be traced from threat to control to evidence, and then kept current through continued airworthiness activities.