AMC2 Article 15(1)(b) Conditions for obtaining a certificate

INFORMATION SECURITY ASSURANCE

In conjunction with point B of Annex III to Regulation (EU) 2021/664, the applicant should ensure a level of security consistent with the intended UAS operations by evaluating and mitigating the risks induced by potential intentional unauthorised electronic interaction (IUEI) on the components of the functional systems (e.g. including the hardware and software, interfaces with the other U-space airspace stakeholders, e-conspicuity, or Network R-ID receivers).

The applicant should follow a continued risk-based approach as regards the following:

(a)     To assess the provision of services against any potential information security threat and vulnerability that could affect the confidentiality, availability and integrity of the provision of services.

(b)     The result of this assessment, following the identification of any necessary mitigation means, should be that the provision of services entails no identifiable vulnerabilities, or if any, they cannot be exploited to create a hazard or generate a failure that would have an effect that is considered unacceptable, in particular when they may result in an unsafe condition.

(c)      When a risk needs to be mitigated, the applicant should provide evidence that the mitigation means provide sufficient grounds for evaluating that the residual risk is acceptable. Accordingly, the effectiveness and robustness of the mitigation means should be demonstrated through (a potential combination of) security-oriented robustness testing, inspection/analysis, refutation/penetration testing, etc., as agreed with the competent authority.

(d)     Once the overall residual risk is considered acceptable, the applicant should develop instructions, for example physical and operational security procedures, auditing and monitoring of the security effectiveness, to ensure a continued and effective protection of the provision of services.

(e)     When the mitigation means rely on operational security measures to be fulfilled by a third party (e.g. UAS operator, USSP), they should be properly documented and shared with the relevant stakeholder.

(f)      The applicant should dynamically reassess the potential for new vulnerabilities and the level of threat that were not foreseen during previous security risk assessments of the functional systems. If the continued assessment identifies an unacceptable threat condition, the applicant should notify the relevant stakeholders and the competent authority in a timely manner of the need and the means to mitigate the new risk.

This risk assessment is referred to as ‘security risk assessment’.