Cyber and Aviation Security
For many years, aviation security and cybersecurity were treated separately. One focuses on screenings, access control, and insider threats, while the other was left to IT departments, measured in uptime and patch cycles. That so-called “clear distinction” no longer reflects how airports work, or how they fail, because daily processes like check-in, baggage reconciliation, boarding, access badges and screening equipment all run on a shared digital infrastructure. Thus, a compromise of that infrastructure is no longer just an IT incident, but it is an attack on the aviation system itself.
A clear example was in September 2025. A ransomware attack on Collins Aerospace’s MUSE passenger processing platform disrupted Heathrow, Brussels, Berlin Brandenburg, Dublin and Cork at the same time [1]. MUSE allows numerous airlines to share check-in desks and boarding gates, so a single supplier compromise affects entities around the continent. As a result, some airports had to process passengers by hand for days, with crowded terminals, degraded passenger reconciliation and improvised manual procedures, showcasing how a cybersecurity attack is an aviation security attack.
Regulators have recognized this change. On a global scale, ICAO places its cyber obligations not in a technical annex but in Annex 17, the Aviation Security annex, through Standard 4.9.1 and Recommended Practice 4.9.2[4]. How to implement them is clear in Chapter 18 of Aviation Security Manual, a restricted security document, and not in an IT policy [5]. Successive ICAL Assembly resolutions, the most recent one being A42-19 in 2025, reaffirmed that aviation cybersecurity is connected to safety, security, and efficiency. For the EU side, Regulation 2019/1583 wrote cybersecurity into the EU’s aviation security rules, and it was adopted under the same framework that governs screening and access control [7]. One provision illustrates this well, since anyone with administrator rights or unrestricted access to critical aviation security IT systems now falls under the same background check regime as staff with airside access, treating a system administrator as a potential insider threat.
The challenge here is that Europe now regulates aviation cyber through three parallel regimes: aviation security which is overseen by national security authorities, aviation safety through EASA’s Part-IS which needs organizations to manage information security risks, and horizontal cyberlaw, through NIS2 Directive that classifies air carriers, airport managing bodies and air traffic control operators as essential entities. Such regimes have not fully joined up. The Commission concluded that Part-IS does not count as a sector specific act that can replace NIS2, yet, which leaves the interplay to be settled nationally [12]. Hence, an airport may face aviation security inspectors, aviation safety auditors and national cyber authorities, all examining overlapping controls under different logics. In the Collins case, it confirmed the nature of the attack, while national authorities in Belgium, Germany and the UK led the response [13].
Harmonization is advanced where industry standards do the work. To be more precise, for aircraft, the American DO-326 and European ED-202 standards were developed in tandem and became the only accepted way of compliance for both the FAA and EASA in 2019 [14]. For organizations, Part-IS relates to ISO/IEC 27001 with some aviation related additions [15]. At the international level, IATA used the 2025 ICAO Assembly to call for mutual recognition arrangements between States to reduce duplicative compliance for airlines operating across jurisdictions [16]. Here, for airports there is more of an organizational priority before a technical one: with cyber and security functions needing to share risk assessments, incident procedures, and exercises, and contingency plans must assume the loss of shared platforms. For the authorities and Member States, the priority is to make the three regimes work together: with joint inspections, a single incident reporting channel, and clear rules on what authority leads when an IT incident turns to a security event. Lastly, for suppliers, the Collins incident made the supply chain security into a main issue. NIS2 needs essential entities to assess the cybersecurity practices of their direct suppliers [17].
Cyber is no longer a support function of aviation security; it is a part of it. The gap that remains is not an awareness of one, but a co-ordinational one between communities, regulators and rulebooks that treat the two separately. LAM LHA is a capable partner in bridging technological constraints, regulatory frameworks and operational realities, helping airports, authorities, and suppliers to align their cyber and aviation security to one coherent approach.
Get in touch...
Sources:
[1] Cyber Management Alliance, 'Cyber Insights on the Heathrow and European Airports Attack' https://www.cm-alliance.com/cyber-insights-on-the-heathrow-and-european-airports-attack accessed 1 October 2026.
[2] Zack Whittaker, 'EU cyber agency confirms ransomware attack causing airport disruptions' TechCrunch (22 September2025) https://techcrunch.com/2025/09/22/eu-cyber-agency-confirms-ransomware-attack-causing-airport-disruptions/ accessed 1 October 2026.
[3] Black Fog, 'Ransomware on Collins Aerospace Halts Check-In at Major Airports' (29 September 2025) https://www.blackfog.com/ransomware-on-collins-aerospace/ accessed 1 October 2026.
[4] ICAO, 'Aviation Cybersecurity' https://www.icao.int/aviation-cybersecurity accessed 1 October 2026.
[5] ICAO, 'Aviation Cybersecurity Guidance Material' https://www.icao.int/aviation-cybersecurity/guidance-material accessed 1 October 2026.
[6] ICAO (n 4).
[7] Commission Implementing Regulation (EU) 2019/1583 of 25 September 2019 amending Implementing Regulation (EU) 2015/1998 as regards cybersecurity measures [2019] OJ L246/15 https://eur-lex.europa.eu/eli/reg_impl/2019/1583/oj accessed 1 October 2026.
[8] ibid, point 11.1.2 https://www.legislation.gov.uk/eur/2019/1583/data.xht?view=snippet&wrap=true accessed 1 October 2026.
[9] EASA, 'Part-IS regulation published, completing regulatory framework for cyber-resilient aviation' https://www.easa.europa.eu/en/newsroom-and-events/news/part-regulation-published-completing-regulatory-framework-cyber-resilient accessed 1 October 2026.
[10] EASA, 'EASA publishes FAQs on Information Security' (14 February 2024) https://www.easa.europa.eu/en/newsroom-and-events/news/easa-publishes-faqs-information-security accessed 1 October 2026.
[11] ENISA, 'Transport' https://www.enisa.europa.eu/topics/cybersecurity-of-critical-sectors/transport accessed 1 October 2026.
[12] EASA Community, 'NIS2guidelines on sector specific Union legal acts & Part-IS' (29 September2023) https://www.easa.europa.eu/community/topics/nis2-guidelines-sector-specific-union-legal-acts-part accessed 1 October 2026.
[13] Rodrigo Pérez-Alonso, 'Lessons From the European Airports Ransomware Attack' Lawfare (21 November 2025) https://www.lawfaremedia.org/article/lessons-from-the-european-airports-ransomware-attack accessed 1 October 2026.
[14] LDRA, 'DO-326B/ED-202AAerospace Cybersecurity Framework Guide' https://ldra.com/aerospace-security-framework/ accessed 1 October 2026.
[15] EASA, 'FAQs –Information Security (Part-IS)' https://www.easa.europa.eu/en/the-agency/faqs/information-security-part accessed 1 October 2026.
[16] IATA, 'Fact Sheet - Aviation Cybersecurity' (June 2026) https://www.iata.org/en/iata-repository/pressroom/fact-sheets/fact-sheet-cyber-security/ accessed 1 October 2026.
[17] Egis, 'What does NIS2mean for the aviation industry?' https://www.egis-group.com/all-insights/what-does-nis2-mean-for-the-aviation-industry accessed 1 October 2026.
