Avionics News September 2019 - 31

Aircrew training organizations, aircrew aero-medical
for political or economic reason; activities seeking publicity
centres and FSTD operators that are required to
for their cause; and criminals seeking financial benefits.
comply with Annex VII (Part-ORA) to Regulation
Two existing European Union regulatory frameworks
(EU) No. 1178/2011.
- Directive 2016/1448 and Regulation 2015/1998 - relate
* ATCO training organizations and ATCO aeroto information security but, in the EASA's view, are
medical centres that are required to comply with
insufficient to address the aviation domain. Efforts were
Annex III (Part ATCO.OR) to Regulation (EU)
made to ensure requirements in the NPA do not conflict
2015/340.
with these existing requirements.
* ATS, MET, AIS, DAT, CNS, ATFM and ASM
The EASA also expects the NPA to build on existing
providers and the Network
safety management system
Manager that are required to
concepts through implementation of
comply with Annex III (Partinformation security management
ATM/ANS.OR) to Regulation
systems standards.
THE
EASA
IS
(EU) 2017/373.
NPA 2019-05, Embodiment of
ACCEPTING
* Aerodrome operators and
Safety Management Requirements
COMMENTS ON
apron management service
into Part-145 and Part-21, published
providers (as per Opinion No.
in April 2019, introduces safety
NPA 2019-05 UNTIL
02/2014) that are required to
management principles for PartSEPT. 6, 2019, AND
comply with Annex III (Part21 and Part-145 organizations and
NPA 2019-07 UNTIL
ADR.OR) to Regulation (EU)
should foster an organizational
SEPT. 27 THROUGH ITS
No. 139/2014.
culture for effective safety
The EASA explained that security
maintenance and occurrence
AUTOMATED COMMENT
risks are considered to be "those that
reporting. The EASA anticipates the
RESPONSE TOOL
may compromise the confidentiality,
information security requirements of
AND ANTICIPATES
integrity and availability of
NPA 2019-07 and NPA 2019-05 to
ADOPTING
THE
RULE
information being stored, transmitted
be complementary - not duplicative
NO SOONER THAN THE
or processed through the aeronautical
- and has indicated 2019-07 will not
information systems used in civil
require a separate approval. NPA
SUMMER OF 2021.
aviation."
2019-05 includes draft acceptable
The EASA substantiates the
means of compliance and guidance
need for the NPA by stating,
material for both Part-21 and
"This combination of (current risk
Part-145. This information may be
management-related) requirements allows that even if an
applicable to NPA 2019-07 implementation.
error, mistake and/or deficiency happens, it should not
The agency believes the impact on affected organizations
create a hazardous situation that could result in an accident
will depend on how robust their current management systems
or serious incident. As a consequence, an accident or
are regarding information security risks. It also acknowledges
serious incident would only happen in the remote random
some organizations might have trouble finding qualified
event of several deficiencies happening simultaneously and,
personnel, which would increase the cost of implementation.
by chance, aligning themselves.
Some stakeholders have concerns regarding the EASA's
The concern, however, is that not enough focus may have
jurisdiction over security-related matters and whether the
been put in properly addressing the situation where existing
cybersecurity requirements would conflict with current
flaws in different areas are aligned on purpose and exploited
management system mandates and existing and proposed
by individuals with a malicious intent, no longer being a
SMS requirements. Acceptable means of compliance and
random event."
other guidance material should clarify the relationship
An EASA presentation at a July workshop identified
Continued on page 65
different attacker profiles, including those sponsored by states
avionics news

september

2019

Avionics News September 2019

Table of Contents for the Digital Edition of Avionics News September 2019