scope:

The AISS guidance in this document may be used to address relevant aviation areas including:

• Aircraft design and production and aircraft components,

• Aircraft operations, maintenance repair and overhaul operations (MRO) and airports,

• Air Traffic Management (ATM) which includes but is not limited to the assets, resources that are used in the operations and delivery of Performance Based Navigation (PBN) and Performance Based Communication and Surveillance (PBCS) and Aviation Service Providers (ASP),

• Unmanned Aerial Systems (UAS) and Unmanned Aircraft System Traffic Management (UTM) operations and organizations that provide or exchange information that have an impact to ATM (Air Traffic Management) automation systems or human resources and the decision making processes for ATM or aircraft operations (such as NOTAMS (Notices to Airmen), weather, obstacles, routes & restrictions, manuals & charts, etc.),

• This guidance extends as appropriate to the supply chains of all the above, which use or are involved in the delivery of hardware, software and information exchange; and

• Where appropriate, requirements relating to military aviation might also be in the scope of this document.

The military and its special role and position in the aviation system, its motivations, constraints and capabilities are fundamentally different when compared with the economic and safety focused approach of civil aviation because the primary objective for military aviation is to ensure security and defense of national airspace. Aside from this objective, the military conducts several operations alongside civil aviation, e.g. transportation of goods and equipment in peacetime for disaster relief support, movement of troops across countries and continents, etc.

Considering these mission profiles, the military is often flying under International Civil Aviation Organization (ICAO) GAT - General Air Traffic rules where it has to comply with civil aviation regulatory requirements. In addition, dual use equipment and commercial derivative aircraft like for AAR - Air to Air refueling, might share a number of common challenges in regard to information security between the civil and military version of an aircraft.

However, the approach to certification of military aircraft is very different between the US and EU, whereas in the latter, the certification is primarily done per state through a dedicated MAA - Military Aviation Authority. The military tends to prioritize confidentiality and integrity whereas civil aviation is generally more concerned with integrity and availability of data and avionics systems.

The consideration of the military in this document should therefore be understood in the sense of supplementary information by highlighting that civil aviation stakeholders are facing similar challenges in their ambition to improve information security and ensure compliance to civil aviation regulations. The military could identify the described approaches within the EUROCAE WG-72/RTCA SC-216 document series on Aeronautical Information Systems Security as being of added value for interested stakeholders from the work conducted. Based on that, the military could initiate further discussions, analysis and potentially even activities where certain elements of the included standards might find their adoption and application by military stakeholders.

Foremost, the consideration of the military should not be understood that the objective is to extend the scope of theses civil aviation standards towards military aviation but rather to create an opportunity for interested military stakeholders to benefit from the work conducted.

Use of this guidance will occur over time and the extent to which the guidance and concepts are applicable will vary across the aeronautical domains and stakeholders.

The fundamental organizational process being put forward in this guidance has two aspects:

1. Address security relevant processes internal to an organization.

2. Address security relevant process external to the same organization.

This document describes a framework for civil Aeronautical Information System Security¹, based on certain underlying principles:

• that information security exists to minimize occurrences and impacts of intentional unauthorized electronic interaction with information and communication systems;

• that the security objectives are derived from both safety objectives and from the need to minimize disruption to the air traffic system;

• that the International Civil Aviation Organization (ICAO) has already established that "measures… to protect information and communication technology ... from interference" are required (ICAO Convention (Doc 7300) Annex 17, 10th edition, Section 4.9), and that the ICAO Member States have agreed to this;

• that States can require the organizations comprising civil aviation in their own territory to meet these requirements;

• that civil aviation depends on co-operation and collaboration between all regulators, suppliers, manufacturers, operators, airport operations and service providers, and that this applies strongly to security;

• that co-operative and collaborative information security is required in addition to individual information security to be more effective.

¹ The terms information security and cyber security are sometimes used interchangeable but cyber security may also be limited to embedded systems. Information security is the term for the discipline and is more encompassing for all domains securing electronic systems - including enterprise information technology, operational technology and embedded systems. Information security is the established term for aviation as used by EASA AMC 20-42 and Opinion 03/2021. For this reason, only the term information security will be used except where cybersecurity is part of a document title.