What is the purpose of properly selecting recipients when the competent authority disseminates information about security incidents or vulnerabilities?

To prevent the content of a report from being exploited to the detriment of aviation safety, for example by revealing uncorrected vulnerabilities.

According to AMC1 ADR.AR.A.030A, what should the competent authority do to avoid that a report on an information security vulnerability is misused?

The competent authority should properly select the appropriate recipient(s) when disseminating the information, to prevent the content from being exploited to the detriment of aviation safety, such as by revealing uncorrected vulnerabilities.

AMC1 ADR.AR.A.030A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

Q: What should the competent authority implement to ensure confidentiality when collecting and analysing information about information security incidents and vulnerabilities that could affect aviation safety?

The competent authority should implement means that ensure the necessary confidentiality.

Navigate / EASA

Ask question Discover more Add to collection

AMC1 ADR.AR.A.030A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

ED Decision 2023/010/R

(a) To appropriately collect and analyse information related to information security incidents and vulnerabilities with a potential impact on aviation safety, the competent authority should implement means that ensure the necessary confidentiality.

(b) When disseminating information related to information security incidents and vulnerabilities with a potential impact on aviation safety, the competent authority should properly select the appropriate recipient(s) to prevent the content of a report from being exploited to the detriment of aviation safety, by revealing, for instance, uncorrected vulnerabilities.

Details

Source-Title: AMC1 ADR.AR.A.030A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety View latest amendments

Erulesid: ERULES-1963177438-22850 Compare versions

Domain: Aerodromes

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-ADR.AR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: ADR.AR.A.030A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

Origin: EASA

Category: EAR