EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v...

71
An Agency of the European Union Your safety is our mission. NPA 2019-07 “Management of Information Security Risks” Juan Anton Cybersecurity in Aviation & Emerging Risks Section Manager 2 nd July 2019 EASA Workshop on NPA 2019-07

Transcript of EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v...

Page 1: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

An Agency of the European Union

Your safety is our mission.

NPA 2019-07 “Management of Information Security Risks”

Juan AntonCybersecurity in Aviation & Emerging Risks Section Manager

2nd July 2019EASA Workshop on NPA 2019-07

Page 2: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

2

Summary of the rulemaking activity and associated steps

Page 3: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

3

Summary of the rulemaking activity and associated steps→ Rulemaking task RMT.0720: included in the EPAS (European Plan for Aviation

Safety)→ Preliminary Impact Assessment (PIA) issued on 17 July 2017.→ Terms of Reference (ToR) published on 16 January 2019.→ NPA 2019-07 published on 27 May 2019.

→Public Consultation on the EASA website until 27 September 2019.→Comments to be submitted through the Comment-Response Tool (CRT) at:

http://hub.easa.europa.eu/crt/

→ Opinion expected by summer 2020.→ Entry into force: once adopted by the European Commission (not expected

before second half of 2021).→ Expected to include transition measures to facilitate implementation.

Page 4: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

4

Why we need to develop new rules

Page 5: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

5

Information security risks are constantly increasing

→ Information systems are becoming increasingly complex and interconnected,and a more frequent target of cyber-crime.

→ Weaknesses in one organisation, product or system can have an impact ondifferent stakeholders, largely amplifying the impact of a cyber attack.

→ These weaknesses are not always known by the operators.→ They can be combined and exploited with malicious intent:

→Different attacker profiles:→ Sponsored by certain States for political/economic reasons.→ Activists seeking publicity for their cause.→ Criminals looking for economic benefits.

→Not always necessarily targeting aviation, but producing a collateral damage.

Page 6: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

6

Current EASA rules only partially address information security risks

→ The current EASA aviation regulatory framework is mostly focused onreducing the likelihood of accidents resulting from non-intentional acts:

→ Includes different safety layers.→ Accidents would only occur when several simultaneous deficiencies/errors

randomly align themselves: very remote and fortuitous event.

→ Not enough focus on safety risks resulting from intentional acts.→ Existing flaws are exploited with malicious intent. Not a random event.→ Traditional safety layers may not be sufficient to address these risks.→ Current requirements only in the following areas:

→Technical requirements for aircraft/engine certification→Organisation requirements for ATM/ANS and Aerodromes

Page 7: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

7

Two other EU frameworks partially address information security (NIS Directive 2016/1148, Aviation Security Reg. 2015/1998)

→ They are not focused on the impact on aviation safety→ NIS Directive: focus on preventing disruption of essential systems (social

and economic impact).→ Reg. 2015/1998: focus on aviation security.

→ They do not cover all aviation domains and stakeholders→ NIS Directive: Only the essential services defined by each Member State.

→Only some aviation domains, and not all stakeholders within those domains.→Different in each Member State.

→ Reg. 2015/1998: Applies only to:→Airports or parts of airports.→Operators (including air operators) and entities that provide services or goods to

or through those airports.

Page 8: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

8

Why we do it now, without waiting to the full implementation of the NIS Directive

Page 9: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

9

Addressing aviation information security risks is an urgent matter → NIS Directive applicability:

→ 9 May 2018: Member States to adopt and publish the national laws,regulations and administrative procedures to transpose the NIS Directive.

→ 9 November 2018: Member States to identify the operators of essentialservices affected by those requirements.

→ Current state of implementation of the NIS Directive:→ Some Member States have still not transposed the NIS Directive.→ Very different speeds of implementation across the Member States.

Waiting for full implementation of the NIS Directive would mean several yearsbefore we could start this rulemaking task.

Page 10: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

10

There is a need to ensure a level playing field across Europe → Non-standardised implementation of the NIS Directive:

→ Different approaches to the definition of essential services.→ Very different levels of implementation across the Member States.

Waiting for full implementation of NIS Directive would mean starting thisrulemaking task when a fully non-standardised landscape is alreadyimplemented across the EU. Instead:→ The discussions on this rulemaking task already started in July 2017.→ This allows Member States to take into account the material being

developed in this task in order to define their policies for implementation ofthe NIS Directive for the essential services in the aviation domain.

→ This promotes standardisation and consistency of both frameworks.

Page 11: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

11

What is the objective of this task

Page 12: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

12

Objective of this rulemaking task

Efficiently contribute to the protection of the aviation system

from cyberattacks and their consequences

by ensuring that organisations and authorities involved in civil aviation activities

are able to identify, protect, detect, respond and recover

from those information security incidents that could affect safety

Page 13: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

13

How the task has been discussed and coordinated

Page 14: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

14

The European Strategic Coordination Platform (ESCP) → Members:

→ European Commission (DG-MOVE, DG-CNECT, DG-GROW and DG-HOME)→ Other EU Agencies and Organisations (EEAS, EUROPOL, EASA, ENISA, CERT-

EU, EUROCONTROL, SESAR)→ European Defence Agency→ States (ECAC plus 6 EU individual Member States: Finland, France, Poland,

Romania, Sweden, UK)→ EU relevant Aviation industry associations (ASD, A4E, ACI, CANSO, ECA, EHA,

EIMG, ERAA, ETF, GAMA, IATA)→ Observers:

→ ICAO, FAA, TCCA, AIA, AIAC, NATOThe ESCP has been meeting regularly for the last 2 years

Page 15: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

15

Key elements to achieve the objectives of this task

Page 16: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

16

Key elements agreed during the ESCP discussions: → Focus on the impact of information security threats and events on safety

(directly on the aircraft or on the European Traffic Management Network)→ Need to cover all aviation domains and interfaces (system-of systems)→ Consistency with NIS Directive and Reg. 2015/1998 (no gaps, loopholes or

duplications)→ Compliance with ICAO standards.→ Minimize the impact on existing EASA regulations.→ Proportionality to the risks incurred by the different organisations.→ High-level, performance/risk-based rules supported by AMC/GM and

industry standards.→ Make possible for organisations and authorities to integrate the Information

Security Management System (ISMS) with other management systems.

Page 17: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

17

THE PROPOSED RULE

Page 18: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

18

Objective and scope of the proposed rule

Page 19: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

19

Legal basis for introducing the proposed requirements → The Basic Regulation (EU) 2018/1139 contains requirements for authorities and

organisations regarding implementation of management systems.→Article 62, point (15)(c): For competent authorities→Annex II, points 3.1(b): For organisations involved in airworthiness→Annex IV, points 3.3(b) and 5(b): For aircrew training organisations and

Aeromedical Centres→Annex V: points 8.1(c) and 8.4(d): For air operators→Annex VII points 2.2.1, 4.2.1 and 5.2: For aerodrome operators, groundhandling

services providers and apron management services providers→Annex VIII, points 5.1(c), 5.4(b) and 6,1(b): For ATM/ANS service providers and

ATC training organisations and Aeromedical Centres.→ This NPA proposes requirements to ensure that those management systems cover

information security risks with an impact on safety.

Page 20: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

20

Objective of the proposed rule (Article 1)

Article 1

Objective

This Regulation establishes the requirements to be met by organisations andcompetent authorities involved in civil aviation activities in order to identify,protect from, detect, respond to and recover from those information securityincidents which could potentially affect aviation safety.

Page 21: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

21

Objective of the proposed rule (Article 1) → Focus on the impact on aviation safety:

→ Cyber incident directly affecting the aircraft.→ Cyber incident affecting the normal functioning of the EATMN (European

Aviation Traffic Management Network).

EATMN defined in Reg. (EC) No 552/2004. Includes systems and procedures for:→ Airspace and air traffic flow management,→ Air traffic services,→ Communications, navigation and surveillance,→ Aeronautical information services,→ Meteorological information.

Page 22: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

22

Scope of applicability (Article 2)

→ Competent authorities.

→ POA and DOA approval holders.→ Part-145 maintenance organisations.→ Part-CAMO organisations (Opinion 06/2016).→ Air operators covered by Part-ORO.→ Aircrew training organisations (ATOs) and aircrew Aeromedical Centres.→ ATCO training organisations and ATCO Aeromedical Centres.→ ATS, MET, AIS, DAT, CNS, ATFM and ASM providers and the Network Manager.→ Aerodrome operators and apron management service providers.

Page 23: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

23

Exempted organisations → Production organisations not holding POA approval→ Organisations with alternative procedures for design (no DOA approval)→ Future Part-CAO organisations (Opinion 05/2016).→ Part-147 training organisations.→ Declared training organisations.→ ATOs providing only theoretical training.→ Private operators of other than complex motor-powered aircraft.→ TCO operators (they will still be subject to national requirements resulting from point 4.9

“Measures relating to cyber threats” of ICAO Annex 17).→ Operators of UAS in the “open” and “specific” categories (in the future, for the “certified

category”, the exemption may not apply).→ POAs, DOAs, ATOs, FSTD operators and air operators, when solely dealing with ELA2 aircraft

(most aeroplanes below 2000Kg MTOM, very light rotorcraft, sailplanes, balloons andairships).

Page 24: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

24

Other exemptions (on a case-by-case) → AISS.OR.200(e):

→ The organisation can be exempted by the competent authority.→ The organisations needs to demonstrate that its activities, facilities and services do

not pose cyber risks to itself nor to other organisations.→ This shall be based on a documented safety assessment approved by the authority.→ The duration of the exemption is maximum 1 year.→ It can be extended for periods of 1 year each on the basis of new safety

assessments.

Page 25: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

25

Structure of the proposed rule

Page 26: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

26

Options considered

→ Option 1: Introduce requirements for the management of information security risks ineach of the existing implementing rules for the different aviation domains.

→ Option 2: Create a “horizontal” information security rule applicable to all aviationdomains, and introduce cross references to this ‘horizontal’ rule in the existingimplementing rules.

Page 27: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

27

Option selected

→ Option selected: Create a “horizontal” information security rule applicable to allaviation domains, and introduce cross references to this “horizontal” rule in the existingimplementing rules.

→ Reasons:→ Allows consistency of requirements across the different domains.→ Reduces the changes to the existing rules, limiting them to the introduction of some

cross-references to the “horizontal” rule.→ Prevents interference with other current or future rulemaking tasks affecting the

existing rules.→ Facilitates the future adoption process at the Commission of the proposed rules.

Page 28: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

28

Option selected → Key aspects of the “horizontal” rule:

→ The proposed requirements complement those related to management systems alreadycontained in the existing organisation implementing rules. As a consequence, they do notrequire a separate approval certificate/declaration. The organisation approvalcertificate/declaration will cover the requirements of the current approval and therequirements of the “horizontal” rule.

→ In this NPA, this “horizontal” rule applies to all aviation domains. However, in the finaldeliverable of this RMT (i.e. Opinion), EASA will divide this “horizontal” rule in threeseparate rules (for legal reasons since they follow different adoption processes):→ one for organisations for which the rules will be adopted by means of delegated acts;→ one for organisations for which the rules will be adopted by means of implementing acts;→ one for the competent authorities since, according to Article 62(15)(c) of the Basic

Regulation, the detailed rules for their management systems are adopted by means ofimplementing acts.

NOTE: In any case, it is envisaged that both rules applicable to organisations are identical.

Page 29: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

29

The “horizontal” rule within the EASA regulatory framework

Regulation (EU) 2018/1139 (Basic Regulation)

Regulation (EU) No 748/2012(Initial Airworthiness)

Regulation (EU) No 1321/2014 (Continuing Airworthiness)

Regulation (EU) 2017/373 (ATM/ANS)

Regulation (EU) 2015/340(ATCO Training Orgs, AeMC)

Regulation (EU) No 965/2012 (Air Operations)

Regulation (EU) No 1178/2011(ATO, AeMC, FSTD)

Regulation (EU) No 139/2014 (Aerodromes)

Regulation (EU) 202X/XXXX (Information Security)

Page 30: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

30

Structure of the “horizontal” rule

→ Separate regulation with similar structure as other Implementing Rules:→ Cover Regulation, including:

→Objectives, scope, definitions, competent authority and entry into force.

→ Annex I “Part-AISS.AR — Authority Requirements”→ Annex II “Part-AISS.OR — Organisation Requirements”

Page 31: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

31

Structure of the “horizontal” rule COMMISSION REGULATION (EU) 202X/XXXX

of XX Month 202X

on the introduction of organisation requirements for the management of information security risks related to aeronautical information systems used in

civil aviation

(Text with EEA relevance)

Article 1

Objective

……………………………..

Article 2

Scope

……………………………..

Article 3

Definitions

……………………………..

Article 4

Competent authority

……………………………..

Article 5

Entry into force

……………………………..

Page 32: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

32

Structure of the “horizontal” rule ANNEX I

AERONAUTICAL INFORMATION SYSTEM SECURITY — AUTHORITY REQUIREMENTS

[PART-AISS.AR]

AISS.AR.005 Objective

AISS.AR.100 Personnel requirements

AISS.AR.200 Information security management system (ISMS)

AISS.AR.400 Allocation of tasks to qualified entities

AISS.AR.500 Record keeping

AISS.AR.600 Oversight

AISS.AR.610 Oversight programme

AISS.AR.620 Information to the Agency

AISS.AR.630 Immediate reaction to an information security problem with safety impact

AISS.AR.800 Assessment of changes to organisations

AISS.AR.900 Findings and corrective actions

Page 33: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

33

Structure of the “horizontal” rule ANNEX II

AERONAUTICAL INFORMATION SYSTEM SECURITY — ORGANISATION REQUIREMENTS

[PART-AISS.OR]

AISS.OR.005 Scope

AISS.OR.100 Personnel requirements

AISS.OR.200 Information security management system (ISMS)

AISS.OR.300 Information security internal reporting scheme

AISS.OR.310 Information security external reporting scheme

AISS.OR.400 Contracted activities

AISS.OR.500 Record keeping

AISS.OR.700 Information security management manual (ISMM)

AISS.OR.800 Changes to the organisation

AISS.OR.900 Findings

Page 34: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

34

Cross-references in the existing Implementing Rules → Regulation (EU) No 748/2012 (Initial Airworthiness):

→ In Part-21, Section A, Subpart G “Production Organisation Approval”:→New point 21.A.146 “Information Security”: The production organisation shall

comply with Regulation (EU) 202X/XXXX.→ In Part-21, Section B, Subpart H “Design Organisation Approval”:

→New point 21.A.246 “Information Security”: The design organisation shallcomply with Regulation (EU) 202X/XXXX.

→ In Part-21, Section B:→Point 21.B.5 “Scope” amended to read:

This Section, together with the requirements contained in Annex I (Part-AISS.AR) to Regulation (EU) 202X/XXXX, establish the administrative andmanagement system requirements to be followed by the competent authoritythat is in charge of the implementation and enforcement of Section A of thisAnnex.

Page 35: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

35

Cross-references in the existing Implementing Rules → Regulation (EU) No 1321/2014 (Continuing Airworthiness):

→ In Part-145, Section A:→New point 145.A.72 “Information Security”: The maintenance organisation shall

comply with Regulation (EU) 202X/XXXX.→ In Part-145, Section B:

→Point 145.B.01 “Scope” amended to read:This Section, together with the requirements contained in Annex I (Part-AISS.AR) to Regulation (EU) 202X/XXXX, establish the administrative andmanagement system requirements to be followed by the competent authoritythat is in charge of the implementation and enforcement of Section A of thisAnnex.

Page 36: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

36

Cross-references in the existing Implementing Rules → Regulation (EU) No 1321/2014 (Continuing Airworthiness):

→ In Part-CAMO, Section A:→New point CAMO.A.330 “Information Security”: The continuing airworthiness

management organisation shall comply with Regulation (EU) 202X/XXXX.→ In Part-145, Section B:

→Point CAMO.B.005 “Scope” amended to read:This Section, together with the requirements contained in Annex I (Part-AISS.AR) to Regulation (EU) 202X/XXXX, establish the administrative andmanagement system requirements to be followed by the competent authoritythat is in charge of the implementation and enforcement of Section A of thisAnnex.

Page 37: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

37

Cross-references in the existing Implementing Rules → Regulation (EU) No 965/2012 (Air Operations):

→ In Part-ORO:→New point ORO.SEC.110 “Information Security”: Air operators listed under point

ORO.GEN.005 shall comply with Regulation (EU) 202X/XXXX.→ In Part-ARO:

→Point ARO.GEN.005 “Scope” amended to read:This Annex, together with the requirements contained in Annex I (Part-AISS.AR) to Regulation (EU) 202X/XXXX, establish the requirements for theadministration and management system to be fulfilled by the Agency and theMember States for the implementation and enforcement of Regulation (EU)2018/1139 and its Implementing and Delegated Rules regarding civil aviationair operations.

Page 38: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

38

Cross-references in the existing Implementing Rules → Regulation (EU) No 1178/2011 (Aircrew):

→ In Part-ORA:→New point ORA.GEN.225 “Information Security”: The organisation shall comply

with Regulation (EU) 202X/XXXX.→ In Part-ARA:

→New point ARA.GEN.110 “Information Security” “Scope”:This Annex, together with the requirements contained in Annex I (Part-AISS.AR) to Regulation (EU) 202X/XXXX, establish the requirements for theadministration and management system to be fulfilled by the Agency and theMember States for the implementation and enforcement of Regulation (EU)2018/1139 and its Implementing and Delegated Rules regarding aircrew.

Page 39: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

39

Cross-references in the existing Implementing Rules → Regulation (EU) 2015/340 (ATCO):

→ In Part-ATCO.OR:→New point ATCO.OR.C.030 “Information Security”: Training organisations shall

comply with Regulation (EU) 202X/XXXX.→Point ATCO.OR.E.001 “Aero-medical centres” amended to add:

…In addition, they shall comply with Regulation (EU) 202X/XXXX.→ In Part-ATCO.AR:

→Point ATCO.AR.A.001 “Scope” amended to read:This Part, set out in this Annex, together with the requirements contained inAnnex I (Part-AISS.AR) to Regulation (EU) 202X/XXXX, establish theadministrative requirements applicable to the competent authorities withresponsibility for the issue, maintenance, suspension or revocation oflicences, ratings, endorsements and medical certificates for air trafficcontrollers and certification and oversight of training organisations and aero-medical centres.

Page 40: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

40

Cross-references in the existing Implementing Rules → Regulation (EU) 2017/373 (ATM/ANS):

→ In Part-ATM/ANS.OR:→New point ATM/ANS.OR.B.040 “Information Security”: Service providers shall

comply with Regulation (EU) 202X/XXXX.→ In Part-ATM/ANS.AR:

→Point ATM/ANS.AR.A.001 “Scope” amended to read:This Annex, together with the requirements contained in Annex I (Part-AISS.AR) to Regulation (EU) 202X/XXXX, establishes the requirements for theadministration and management systems of the competent authoritiesresponsible for certification, oversight and enforcement in respect of theapplication of the requirements set out in Annexes III to XIII by the serviceproviders in accordance with Article 6.

Page 41: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

41

Cross-references in the existing Implementing Rules ATM/ANS.OR.D.010 Security management

(a) Air navigation services and air traffic flow management providers and the Network Manager shall, as an integral part of their management system as required in point ATM/ANS.OR.B.005, establish a security management system to ensure the security of their facilities and personnel so as to prevent unlawful interference with the provision of services.

(1) the security of their facilities and personnel so as to prevent unlawful interference with the provision of services;

(2) the security of operational data they receive, or produce, or otherwise employ, so that access to it is restricted only to those authorised.

(b) The security management system shall define:

(1) the procedures relating to security risk assessment and mitigation, security monitoring and improvement, security reviews and lesson dissemination;

(2) the means designed to detect security breaches and to alert personnel withappropriate security warnings;

(3) the means of controlling the effects of security breaches and to identify recovery action and mitigation procedures to prevent re-occurrence.

(c) Air navigation services and air traffic flow management providers and the Network Manager shall ensure the security clearance of their personnel, if appropriate, and coordinate with the relevant civil and military authorities to ensure the security of their facilities, personnel and data.

(d) Air navigation services and air traffic flow management providers and the Network Manager shall take the necessary measures to protect their systems, constituents in use and data and prevent compromising the network against information and cyber security threats which may have an unlawful interference with the provision of their service.

(d) The aspects related to information security, and in particular those related toaeronautical data and aeronautical information, shall be managed in accordance with point ATM/ANS.OR.B.040.

Page 42: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

42

Cross-references in the existing Implementing Rules → Regulation (EU) No 139/2014 (Aerodromes):

→ In Part-ADR.OR:→New point ADR.OR.D.035 “Information Security”: The aerodrome operator shall

comply with Regulation (EU) 202X/XXXX.→ In Part-ADR.AR:

→Point ADR.AR.A.001 “Scope” amended to read:This Annex, together with the requirements contained in Annex I (Part-AISS.AR) to Regulation (EU) 202X/XXXX, establishes the requirements for theCompetent Authorities involved in the certification and oversight ofaerodromes, aerodrome operators and apron management service providers.

Page 43: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

43

Cross-references in the existing Implementing Rules ADR.OR.D.007 Management of aeronautical data and aeronautical information

(a) As part of its management system, the aerodrome operator shall implement and maintain a quality management system covering the following activities:

(1) its aeronautical data activities; and

(2) its aeronautical information provision activities.

(b) The aerodrome operator shall, as part of its management system, establish a security management system to ensure the security of operational data it receives, or produces, or otherwise employs, so that access to that operational data is restricted only to those authorised.

(c) The security management system shall define the following elements:

(1) the procedures relating to data security risk assessment and mitigation, security monitoring and improvement, security reviews and lesson dissemination;

(2) the means designed to detect security breaches and to alert personnel with appropriate security warnings;

(3) the means of controlling the effects of security breaches and of identifying recovery action and mitigation procedures to prevent reoccurrence.

(d) The aerodrome operator shall ensure the security clearance of its personnel with respect to aeronautical data security.

(e) The aerodrome operator shall take the necessary measures to protect its aeronautical data against cyber security threats.

(d) The aspects related to information security, and in particular those related toaeronautical data and aeronautical information, shall be managed in accordance with point ADR.OR.D.035.

Page 44: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

44

Competent Authority responsible for the implementation and oversight of the proposed

requirements

Page 45: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

45

Options considered → When EASA is the authority for the current approval of the organisation:

→ EASA would be also the competent authority for the elements of the proposed rule.→ Special case: For Pan-European organisations such as EGNOS, coordination

measures between EASA and the SAB (Security Accreditation Board) will need to bedefined.

→ When a competent authority of a Member State is currently responsible for theoversight of the organisation:

→ Option 1: Leave to the Member State the decision of who will be the competentauthority for the proposed rule (could be different from the one already responsiblefor the current EASA safety approval (or declaration) of the organization).

→ Option 2: The authority for the proposed rule would be the same as the oneresponsible for the current EASA safety approval (or declaration) of theorganization.

Page 46: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

46

Option selected

→ Option selected: The authority for the proposed rule would be the same as the oneresponsible for the current EASA safety approval (or declaration) of the organization.

→ Reasons:→ Prevents disputes between 2 authorities responsible for the approval of the

organisation, and avoids the need to create 2 approval certificates for theorganisation.

→ Permits a consistent oversight approach for all aspects related to aviation safety(including cyber), in particular for the management systems held by theorganisation.

→ Permits EASA to perform its audit activities on the competent authority (may not bepossible if a national cybersecurity agency is responsible, because of informationaccess restrictions)

Page 47: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

47

Delegation of oversight activities

→ AISS.AR.400 “Qualified entities”: This allows the competent authority to delegate tasks,for example, to a national cybersecurity agency (possibly responsible for theimplementation of the NIS Directive).

→ This facilitates the access by the competent authority to additional informationsecurity expertise

→ This provides flexibility to the State in order to create a national safety and securityorganisational structure that fits their needs.

NOTE: The responsibility remains on the competent authority. Especially to ensure thatthe audits performed by the qualified entity take due account of the safety aspects.

Page 48: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

48

EASA standardisation activities

→ EASA will perform its oversight activities on the competent authority. This oversightwill include also the elements related to information security.

→ If the competent authority has delegated certain tasks on, for example, a nationalcybersecurity agency, EASA will check how they coordinate. EASA will not audit thenational cybersecurity agency.

Page 49: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

49

Consistency with the NIS Directive (EU) 2016/1148

Page 50: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

50

Consistency with NIS Directive (for essential services) → NIS Directive, Article 14:

→ Point 1: “Member States shall ensure that operators of essential services take……technical andorganisational measures to manage the risks posed to the security of network and informationsystems…..”

→ Point 2: “Member States shall ensure that operators of essential services take appropriatemeasures to prevent and minimise the impact of incidents affecting the security of networkand information systems…..with a view to ensuring the continuity of those services.”

→ Point 3: “Member States shall ensure that operators of essential services notify, without unduedelay, the competent authority or the CSIRT of incidents having a significant impact on thecontinuity of the essential services they provide…..”

→ NIS Directive, Article 1:→ Point 7: This point allows to replace the requirements contained in the NIS Directive by those

of a sector-specific Union legal act if such requirements are at least equivalent to those in theNIS Directive.

Page 51: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

51

Options considered → Option of requiring the essential services to comply both with the NIS Directive and the

requirements proposed in this NPA:→ This would have meant a duplication of requirements, sometimes not fully compatible, as well

as duplication of authorities and oversight activities.

→ Option of replacing the requirements of Article 14 of the NIS Directive by the futurerequirements proposed in this NPA:

→ This would not happen until the proposed rules are adopted (not before 2021).→ Would mean a change of regulatory framework for essential services who may have been

already applying the NIS Directive since 2018.

→ Option of considering that meeting the requirements of Article 14 of the NIS Directive would beacceptable instead of complying with the requirements proposed in this NPA:

→ This was the option selected.

Page 52: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

52

Option selected → Option selected: Meeting the requirements of Article 14 of the NIS Directive would be

acceptable for essential services, instead of complying with the requirements proposed inthis NPA. With one condition:

→ The competent authority responsible for the safety approval (EASA rules) and thecompetent authority for the NIS Directive shall establish an agreement to coordinate theaspects impacting aviation safety.

→ Benefits:→ Prevents duplication of requirements and permits essential services to continue with

their established practices related to information security.→ Ensures coordination between authorities.→ Prevents interference on how the Member States implement the NIS Directive across the

different sectors (energy, banking, transport, etc) and define their authority structures.

Page 53: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

53

Option selected → Drawback:

→ Possible lack of standardisation across the EU: The requirements imposed on essentialservices as a result of the NIS Directive currently vary across the different Member States.

→ Envisaged solution:→ For the upcoming Acceptable Means of Compliance (AMC) and Guidance Material (GM)

associated to this rule, EASA and the ESCP will review existing policies used by thoseMember States which are more advanced in the implementation of the NIS Directive.

→ This will allow to use that material across all the EU Member States and for allstakeholders (not only for essential services)

→ Since many Member States are still defining detailed requirements and policies for theiroperators of aviation essential services, they could benefit from aligning them with theAMC/GM material (and associated Industry Standards) being developed in this rulemakingtask.

→ This would promote standardisation of requirements and policies across the EU forthe implementation of the NIS Directive, aligning them with the ones beingdeveloped in this task for the full aviation sector.

Page 54: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

54

Consistency with Regulation (EU) 2015/1998

Page 55: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

55

Regulation (EU) 2015/1998 → Focuses on aviation security.→ Applies only to:

→ Airports or parts of airports.→ Operators (including air operators) and entities that provide services or goods to or

through those airports.→ It is in the process of being amended to align with Amendment 16 to ICAO Annex 17:

→ Point 4.9.1 of ICAO Annex 17 on measures relating to cyber-threats, has become a“standard” applicable since November 2018:

“Each Contracting State shall ensure that operators or entities as defined in the nationalcivil aviation security programme or other relevant national documentation identifytheir critical information and communications technology systems and data used forcivil aviation purposes and, in accordance with a risk assessment, develop andimplement, as appropriate, measures to protect them from unlawful interference.”

→ Appropriate coordination has been performed to ensure consistency between the rulesproposed in the NPA and Regulation (EU) 2015/1998.

Page 56: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

56

Performance- and risk-based approach

Page 57: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

57

Performance- and risk-based approach

→ Objective:→ Ensure the flexibility of the rules.→ Ensure that they don’t need frequent amendments in view of the fast evolution of

cybersecurity risks.

→ The role of Acceptable Means of Compliance (AMC), Guidance Material (GM) andIndustry Standards:

→ The rule contains high-level, performance-and risk-based requirements.→ It will be supplemented by detailed AMC and GM material, which will contain

references to certain Industry Standards.

Page 58: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

58

AMC’s and GMs → For their development, use will be made of:

→ Material contained in existing standards and best practices, such as:→ ISO 27000 Series on ‘information security management systems (ISMS)’ standards;→ ISO 31000 Series on ‘risk management’ standards;→ CEN — EN 16495 on standards for ‘Air Traffic Management — Information security for

organisations supporting civil aviation operations’;→ ECAC Document 30 ‘Recommendations on cyber security and supporting Guidance

Material’.

→ Material available in the Member States for the implementation of the NIS Directive, if foundappropriate for the wider aviation sector (not just for essential services).

→ References may be introduced to certain Industry Standards, such as:→ EUROCAE ED-201 and EUROCAE ED-205

Page 59: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

59

AMC’s and GMs

→ Development calendar:→ The detailed discussions in the ESCP started at the end of May 2019.

→ The AMC/GM should be ready at the beginning of 2021, so they can considered bythe Commission and Member States before adopting the future rule.

→ Any amendments to the existing Industry Standards and any new Industry Standardsneed to be ready when the future rule is adopted by the Commission, so thedifferent stakeholders can use them in the implementation of the future rule.

Page 60: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

60

Integration with other management systems

Page 61: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

61

Options considered → Option 1 (discarded): merge the ISMS requirements proposed in this NPA with the management

systems currently existing in other EASA Implementing Rules.Drawbacks:

→ Only some aviation domains currently have requirements for management systems (Airoperations, aircrew, ATCOs, ATM/ANS and aerodromes)

→ For other domains they are still under development:→ Design and Production Organisations (NPA 2019-05)→ Part-145 maintenance organisations (NPA 2019-05)→ Continuing Airworthiness Management Organisations (Opinion 06/2015)

→ Those management system requirements are not identical across the different ImplementingRules (neither in terms of content nor structure).

→ Merging would mean:→ Only possible for some aviation domains.→ Interference with ongoing and future rulemaking activities affecting those rules.→ Abandon the idea of having aligned cyber requirements across all the aviation domains.

Page 62: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

62

Options considered → Option 2 (selected):

→ Create an “horizontal” rule, with cross-reference in the domain-specific implementing rules→ Make the structure and content of the “horizontal” rule as close as possible to the existing

management system requirements in the other rules.→ Introduce in AISS.OR.200(d) and AISS.AR.200(e) the possibility for organisations and

authorities to integrate the different management systems.

Benefits:→ Ensures consistency across all domains.→ Minimises the impact on existing rules and current and future rulemaking activities.→ Facilitates the integration of management systems by authorities and organisations.

Page 63: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

63

Entry into force and transition measures

Page 64: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

64

Entry into Force and transition measures

→ NPA 2019-07 published on 27 May 2019.→Public Consultation on the EASA website until 27 September 2019.→Comments to be submitted through the Comment-Response Tool (CRT) at:

http://hub.easa.europa.eu/crt/

→ Opinion expected by summer 2020.→ Entry into force: once adopted by the European Commission (not expected before

second half of 2021).→ Expected to include transition measures to facilitate implementation. A phased

approach could be followed depending on the different timing where authoritiesand organisations could be ready to apply the different requirements.

STAKEHOLDERS REQUESTED TO PROVIDE FEEDBACK

Page 65: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

65

Impact Assessment

Page 66: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

66

Impact Assessment

→ Safety impact: HIGHTLY POSITIVE due to:

→ Organisations and authorities will have a robust management system to addresscyber risks.

→ Reporting systems will facilitate information sharing.

→ Improved coordination between safety and security authorities within the MemberStates.

Page 67: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

67

Impact Assessment

→ Social impact: HIGHTLY POSITIVE due to:

→ Increases the public trust in travelling by air.

→ Generates employment opportunities and better conditions for qualified personnelavailable in the market.

→ Generates increased opportunities for educational institutions and organisations.

Page 68: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

68

Impact Assessment

→ Proportionality impact: NO IMPACT expected due to:

→ General Aviation organisations and other organisations with lower risks have beenexcluded from the rule.

→ Possibility for the organization to get a temporary exemption (which can beextended) if it demonstrates to the NAA, with a documented assessment, that itsactivities do not pose information security risks.

Page 69: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

69

Impact Assessment → Economic impact:

→ Negative impact compared to doing nothing: MEDIUM

→ There will be an economic cost of implementation that will depend on the currentmaturity of the organisation (and how they are currently managing cyber risks).

→ Organisations may have difficulties finding qualified personnel (will depend on the marketavailability).

→ Positive impact compared to doing nothing: VERY HIGH

→ A more robust management system, better information sharing and better coordinationbetween safety and security authorities will significantly reduce the risk and impact ofsuffering cyber attacks and the huge associated costs (operational and reputational).

→ Increased staff skills and competences should improve the overall productivity andefficiency of the organization.

→ Possible decrease in insurance costs.

Page 70: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

70

Your comments are welcome

Please submit them by 27 September 2019 through the Comment-Response Tool (CRT) at:

http://hub.easa.europa.eu/crt/

Page 71: EW î ì í õ r ì ó ^D v P u v } ( / v ( } u ] } v ^ µ ] Ç Z ] l...WK Z h P v ] v K P v ] ] } v ~ ^ U hZKWK> U ^ U E/^ U Zd r h U hZK KEdZK> U^ ^ Z W µ } v ( v P v Ç W^

An Agency of the European Union

Your safety is our mission.easa.europa.eu/connect

EASA Workshop on NPA 2019-07


E À l À l } P v Z µ v ] } v v } Z l } u o ] v ( } u ] } v ... · PDF file_d ] o o P v P o ] P Z v P l } P v µ v ] l u v P u v v ] l } l v v l } P v } Z ( ] o o P

E À l À l } P v Z µ v ] } v v } Z l } u o ] v ( } u ] } v ... · PDF file_d ] o o P v P o ] P Z v P l } P v µ v ] l u v P u v v ] l } l v v l } P v } Z ( ] o o P

µ ] v ] P W u ] µ ] v K v o ] v ] · 2020-04-10 · } ( Ç } v À Ç u o Z ] U } Z v P u U µ Z Z v P } } o o u } µ v U ] v ] } v } µ v U X

µ ] v ] P W u ] µ ] v K v o ] v ] · 2020-04-10 · } ( Ç } v À Ç u o Z ] U } Z v P u U µ Z Z v P } } o o u } µ v U ] v ] } v } µ v U X

h v v ] v P ( Ç P P r } P v o P v Z v u l À o ] ( ] i l v u v U Z µ ( ( u X ( o X Z ' •W } i l u i u >K r, } À v } u l ] v P ] v ( µ l

h v v ] v P ( Ç P P r } P v o P v Z v u l À o ] ( ] i l v u v U Z µ ( ( u X ( o X Z ' •W } i l u i u >K r, } À v } u l ] v P ] v ( µ l

FINAL for Public Release - Oranga Tangata Oranga Whanau ... · K v P d v P U K v P t Z v µ í K v P d v P U K v P t Z v µ K v P d v P U K v P t Z v µ î Æ µ ] À ^ µ u u Ç

FINAL for Public Release - Oranga Tangata Oranga Whanau ... · K v P d v P U K v P t Z v µ í K v P d v P U K v P t Z v µ K v P d v P U K v P t Z v µ î Æ µ ] À ^ µ u u Ç

d Á < u U ï î À P ] v P v } ] Z v o ] v P À v W/vku3crgx98g8.pdfP v Ì ] i v X µ P P v µ u À v Ì l Z ] U u Z ] v µ µ o ] i l v ] u v v ...

d Á < u U ï î À P ] v P v } ] Z v o ] v P À v W/vku3crgx98g8.pdfP v Ì ] i v X µ P P v µ u À v Ì l Z ] U u Z ] v µ µ o ] i l v ] u v v ...

} o u } v µ u v o o Z P ] v D µ ] o } u ] v Ì } o ] P o ... · o o } P } o } } o D } v µ u v o Ç ^ ] v P µ o o Z P ] v D µ ] U } ...

} o u } v µ u v o o Z P ] v D µ ] o } u ] v Ì } o ] P o ... · o o } P } o } } o D } v µ u v o Ç ^ ] v P µ o o Z P ] v D µ ] U } ...

t r s€¦ · E Z u o P º Z W ï U ì ì ¦ µ P ^ v µ u u v W u Z v v P X õ W ï ì h Z u ] o t µ v P W ] < o v r µ v ' u Á µ v P ( } o P v Z ] ] } v ] v

t r s€¦ · E Z u o P º Z W ï U ì ì ¦ µ P ^ v µ u u v W u Z v v P X õ W ï ì h Z u ] o t µ v P W ] < o v r µ v ' u Á µ v P ( } o P v Z ] ] } v ] v

^ u v À ] v P W } µ ] u v P u v€¦ · ^ u v À ] v P W } µ ] u v P u v ... w ] ] ] ] % 4

^ u v À ] v P W } µ ] u v P u v€¦ · ^ u v À ] v P W } µ ] u v P u v ... w ] ] ] ] % 4

] P v u v o ] ] } v P u v ( } ^ o } ( ^ ] } v

] P v u v o ] ] } v P u v ( } ^ o } ( ^ ] } v

µ µ u v î ì î ì K ] v P ^ Ç u } u } v v v ^ µ µ...W } P u l } } l } E } Z } P u ] } o o Ç ] À i µ Ç } v ] l Z v } ] v µ ] } v } µ v } ] v ] v v } ( } P u ] v P Æ µ

µ µ u v î ì î ì K ] v P ^ Ç u } u } v v v ^ µ µ...W } P u l } } l } E } Z } P u ] } o o Ç ] À i µ Ç } v ] l Z v } ] v µ ] } v } µ v } ] v ] v v } ( } P u ] v P Æ µ

v } / v À ] P ] v ] v ( ] Ç µ ] v ^ µ ] } v v U i o ] ( } v ]...< Ç Á } W ^ ] o } Z v U z } µ v P [ Æ ] u v U o ] P Z ] v P U v Z v l ] v P U } µ o r r P } v ( ] P µ ] }

v } / v À ] P ] v ] v ( ] Ç µ ] v ^ µ ] } v v U i o ] ( } v ]...< Ç Á } W ^ ] o } Z v U z } µ v P [ Æ ] u v U o ] P Z ] v P U v Z v l ] v P U } µ o r r P } v ( ] P µ ] }

DOSSIER DE PRENSA DEF - ICIAM2019 - Home] v v } v P } o ] U v ] µ y } o r P } Ì U ] o } U ^ v ] P } } u } o U } µ y U o ] v U D o P U ^ À ] o o U ' v U s o v ] U D ] U o } v Ç

DOSSIER DE PRENSA DEF - ICIAM2019 - Home] v v } v P } o ] U v ] µ y } o r P } Ì U ] o } U ^ v ] P } } u } o U } µ y U o ] v U D o P U ^ À ] o o U ' v U s o v ] U D ] U o } v Ç

u ^ u P l^ } v v P U v í í X l í î X E } À u î ì í ó Á v í ... · c/ Z u Z u ] Z P v ] u W ( ] v P P ] v U Á ] o ] Z Ì µ s µ v P < } u u µ v ] l ] } v l µ µ Z

u ^ u P l^ } v v P U v í í X l í î X E } À u î ì í ó Á v í ... · c/ Z u Z u ] Z P v ] u W ( ] v P P ] v U Á ] o ] Z Ì µ s µ v P < } u u µ v ] l ] } v l µ µ Z

E Á ( o µ } ] v r í ô P ] v P W d ] u P ] v P Ç ] } } Z } P } v …] Z Ç } Æ Ç } Z v } v u ] Æ ~ í ì u P l u> ] v Á l } v ] ] o U ñ ì W ñ ì U À l À } v ] v ] v P

E Á ( o µ } ] v r í ô P ] v P W d ] u P ] v P Ç ] } } Z } P } v …] Z Ç } Æ Ç } Z v } v u ] Æ ~ í ì u P l u> ] v Á l } v ] ] o U ñ ì W ñ ì U À l À } v ] v ] v P

} µ K P v ] ] } v } u u µ v µ ' v r µ Z > µ Æ u } µ P · } µ K P v ] ] } v } u u µ v µ ' v r µ Z > µ Æ u } µ P ... ¦ x

} µ K P v ] ] } v } u u µ v µ ' v r µ Z > µ Æ u } µ P · } µ K P v ] ] } v } u u µ v µ ' v r µ Z > µ Æ u } µ P ... ¦ x

W µ o ] ^ À ] } u u ] ] } v U t v P opscwbapplication.in/pdf20/QUALIFIED_ROLL_NO_WISE_LIST.pdf · W µ o ] ^ À ] } u u ] ] } v U t v P o. W µ o ] ^ À ] } u u ] ] } v U t v P

W µ o ] ^ À ] } u u ] ] } v U t v P opscwbapplication.in/pdf20/QUALIFIED_ROLL_NO_WISE_LIST.pdf · W µ o ] ^ À ] } u u ] ] } v U t v P o. W µ o ] ^ À ] } u u ] ] } v U t v P

À v D } P P < v } Á o P...xd Z u } P P Ç u v v ] v G } v Z P xD } P P U Z } u } Á v Z ] v Æ ^ P u v d Á } W h v v ] v P Z v Z

À v D } P P < v } Á o P...xd Z u } P P Ç u v v ] v G } v Z P xD } P P U Z } u } Á v Z ] v Æ ^ P u v d Á } W h v v ] v P Z v Z

Z & o µ P o Ì v v v Á ] º l v E EEhE' Ì µ u ...€¦ · v P v X / Z l v v U µ Z ] u E u v î X & Z U ] º l ] ] P v d ] o v Z u ] v P µ v P v ] v À } o o u h u ( v P v X

Z & o µ P o Ì v v v Á ] º l v E EEhE' Ì µ u ...€¦ · v P v X / Z l v v U µ Z ] u E u v î X & Z U ] º l ] ] P v d ] o v Z u ] v P µ v P v ] v À } o o u h u ( v P v X

Æ v u v } ( Z } ] o ] u } ( Z P µ ] } v } ( v P o Z ( } u Z P } Ç ......^ ] } ( Z } u u ] ( } À o } u v W } o ] Ç U h v ] E ] } v u v ( } } v } u ] v ^ } ] o ( ( ] U í U î ì

Æ v u v } ( Z } ] o ] u } ( Z P µ ] } v } ( v P o Z ( } u Z P } Ç ......^ ] } ( Z } u u ] ( } À o } u v W } o ] Ç U h v ] E ] } v u v ( } } v } u ] v ^ } ] o ( ( ] U í U î ì

v î ì í î U Á P v u v P ] v P } o o ] } v } ( } µ ] u ...

v î ì í î U Á P v u v P ] v P } o o ] } v } ( } µ ] u ...