Aviation Cybersecurity
Aviation cybersecurity covers the protection of aircraft, maintenance systems and aviation organisations against information security threats that could affect safety. ICAO notes that aviation is highly interconnected and that cyber-attacks can affect finances, reputation, continuity of services and even the safety and security of people and facilities [1]. In Europe, the Part-IS package, Implementing Regulation (EU) 2023/203 and Delegated Regulation (EU) 2022/1645, requires organisations such as Part-145 maintenance organisations, CAMOs and air operators to manage information security risks [2][3][4]. On the aircraft side, EUROCAE ED-202B / RTCA DO-326B adds certification guidance against intentional unauthorized electronic interaction (IUEI) [5]. This page summarises the official framework and explains how Novatelia can help an MRO source the equipment and services named in its own risk assessment. It does not list products, because no single product makes an organisation compliant.
Regulatory framework
- Regulation (EU) 2023/203 applies from 22 February 2026 to Part-145 maintenance organisations, CAMOs and air operators, with exceptions for organisations solely involved in Part-ML activities [2][6].
- Delegated Regulation (EU) 2022/1645 has applied since 16 October 2025 to the organisations in its own scope [6].
- EASA publishes Acceptable Means of Compliance and Guidance Material (AMC & GM) to both regulations; ED Decisions 2025/013/R, 2025/014/R and 2025/015/R issued Amendment 1 in July 2025 [7].
- ICAO Annex 17 – Aviation Security contains Standard 4.9.1 and Recommended Practice 4.9.2 on cybersecurity, and ICAO Assembly Resolution A42-19 (2025) addresses cybersecurity in civil aviation [1].
What an organisation must have
- An information security management system (ISMS) and an Information Security Management Manual (ISMM) [2].
- For foreign Part-145 organisations overseen by EASA: nominated persons, an amended MOE covering Part-IS, an initial risk assessment and an internal Part-IS audit report [8].
- An initial risk assessment that identifies the organisation's activities, the equipment, systems, data and information supporting them, its interfaces with other organisations, and the main threat scenarios [8].
Aircraft airworthiness security
- ED-202B / DO-326B, Airworthiness Security Process Specification, adds data requirements and compliance objectives for aircraft development and certification against IUEI [5].
- ED-202B (October 2024) supersedes ED-202A / DO-326A (June 2014) [5].
- ED-203A / DO-356A gives methods and considerations, and ED-204 / DO-355 covers information security for continuing airworthiness [9].
How Novatelia can help
- We do not sell compliance, certification or audits. We source items that your own ISMS or risk assessment calls for, from manufacturers or their channels.
- Typical requests: network test and certification tools for hangar and shop networks, fibre inspection tools, and controlled data-loading or test hardware already used in your maintenance processes.
- Send your requirement list or tender; we quote item by item with the manufacturer's documentation.
Customer types
- Part-145 maintenance organisations
- CAMOs
- Air operators
- Training organisations and component shops
Relevant standards
- Regulation (EU) 2023/203 and (EU) 2022/1645 (Part-IS) [3][4].
- EUROCAE ED-202B / RTCA DO-326B [5].
- EUROCAE ED-203A / RTCA DO-356A and ED-204 / DO-355 [9].
- ICAO Annex 17, Standard 4.9.1 and Recommended Practice 4.9.2 [1].
Brands
This is a brand-neutral category: no manufacturer or product is presented as a compliance solution. Requirements come from your own risk assessment and competent authority.
Products
No product page in this category has passed source verification yet; request specific models through the RFQ below.
Oman & GCC support
For aviation cybersecurity, Novatelia handles sourcing, quotation and delivery coordination from Muscat for Oman customers and on a project basis for other GCC countries; see Aviation supply in Oman. Novatelia does not claim local OEM service centres or civil aviation authority approvals.
Frequently asked technical questions
When does Part-IS apply to a Part-145 organisation?
Regulation (EU) 2023/203 applies from 22 February 2026, except for organisations solely involved in Part-ML maintenance [2][6].
What is DO-326?
RTCA DO-326 / EUROCAE ED-202 is the Airworthiness Security Process Specification; the current issue is ED-202B / DO-326B [5].
Does Novatelia certify or audit for Part-IS?
No. We are a supplier; approvals and oversight remain with your competent authority.
Request a quote
Send part numbers, quantities, delivery location and any calibration or documentation requirements for aviation cybersecurity. Quotes depend on manufacturer channel rules, export conditions and availability.
Add to RFQ – contact Novatelia or email [email protected]
Sources
- ICAO – Aviation Cybersecurity
- EASA – Information Security (Part-IS) FAQ: applicability
- EUR-Lex – Commission Implementing Regulation (EU) 2023/203
- EUR-Lex – Commission Delegated Regulation (EU) 2022/1645
- EUROCAE – ED-202B Airworthiness Security Process Specification
- EASA FAQ – Applicability dates of Regulations (EU) 2022/1645 and 2023/203
- EASA – Cybersecurity domain (AMC & GM to Part-IS, ED Decisions)
- EASA – Work Instruction: Foreign Part-145 Part-IS implementation plan
- EUROCAE – ED-203A Airworthiness Security Methods and Considerations