Compare and highlight differences

Compare / EASA/ Incorporated Amendments/ Compare & Highlight Differences

Appendix III -- Examples of aviation services and interfaces

Available versions for ERULES-1963177438-21670

ED Decision 2023/009/R found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)
ED Decision 2025/014/R found in: Information Security (2023/203 and 2022/1645) Part-IS (Dec 2025)

From

Show details Hide details

Appendix
III — Examples of
aviation services

ED
Decision 2023/009/R

The
following is a non-exhaustive and non-complete list of aviation services that
can be used as a basis to identify the scope of risk assessment for the
organisation.

<table border="0" cellpadding="0" cellspacing="0" width="557">
<tr>
<td valign="top" width="557">
aerodrome
 ATM-MET services provider
</td>
</tr>
<tr>
<td valign="top" width="557">
aeronautical
 digital map service
</td>
</tr>
<tr>
<td valign="top" width="557">
AIM
 (external)
</td>
</tr>
<tr>
<td valign="top" width="557">
airport
</td>
</tr>
<tr>
<td valign="top" width="557">
APP
 ACC
</td>
</tr>
<tr>
<td valign="top" width="557">
ATC
 (external)
</td>
</tr>
<tr>
<td valign="top" width="557">
ATC superior
</td>
</tr>
<tr>
<td valign="top" width="557">
ATM 
</td>
</tr>
<tr>
<td valign="top" width="557">
ATM-MET
 services provider
</td>
</tr>
<tr>
<td valign="top" width="557">
civil
 AU operations centre
</td>
</tr>
<tr>
<td valign="top" width="557">
communication
 infrastructure
</td>
</tr>
<tr>
<td valign="top" width="557">
ER
 ACC
</td>
</tr>
<tr>
<td valign="top" width="557">
FIS/TIS
 data integrator
</td>
</tr>
<tr>
<td valign="top" width="557">
national
 AIM
</td>
</tr>
<tr>
<td valign="top" width="557">
navigation
 infrastructure — ground-based
</td>
</tr>
<tr>
<td valign="top" width="557">
navigation
 Infrastructure — satellite-based
</td>
</tr>
<tr>
<td valign="top" width="557">
non-ATM-MET
 services provider 
</td>
</tr>
<tr>
<td valign="top" width="557">
non-aviation
 users (external)
</td>
</tr>
<tr>
<td valign="top" width="557">
regional
 AIM
</td>
</tr>
<tr>
<td valign="top" width="557">
regional
 ASM
</td>
</tr>
<tr>
<td valign="top" width="557">
regional
 ATFCM
</td>
</tr>
<tr>
<td valign="top" width="557">
state
 AU operations centre
</td>
</tr>
<tr>
<td valign="top" width="557">
static
 aeronautical data service
</td>
</tr>
<tr>
<td valign="top" width="557">
sub-regional
 DCB common service provision
</td>
</tr>
<tr>
<td valign="top" width="557">
sub-regional/local
 ATFCM
</td>
</tr>
<tr>
<td valign="top" width="557">
sub-regional/national
 ASM
</td>
</tr>
<tr>
<td valign="top" width="557">
surveillance
 infrastructure airport
</td>
</tr>
<tr>
<td valign="top" width="557">
surveillance
 infrastructure en-route
</td>
</tr>
<tr>
<td valign="top" width="557">
surveillance
 infrastructure TMA
</td>
</tr>
<tr>
<td valign="top" width="557">
time
 reference (external)
</td>
</tr>
<tr>
<td valign="top" width="557">
tower
 (TWR)
</td>
</tr>
</table>

---

[[1]](#_ftnref1)      The published date represents the date when the consolidated version of
the document was generated.

[[2]](#_ftnref2)      Euro-Lex, Important Legal Notice: <http://eur-lex.europa.eu/content/legal-notice/legal-notice.html>.

[[3]](#_ftnref3)      *This is the main date of application
(i.e. the date from which an act or a provision in an act produces its full
legal effects) as defined in the relevant cover regulation article. Some
provisions of the regulations though may be applicable at a later date
(deferred applicability). Besides, there may be some opt-outs (derogations from
certain provisions) notified by the Member States.*

[[4]](#_ftnref4)      ‘As regards the case of the EGNOS air
navigation service provider subject to Implementing Regulation (EU) 2017/373 it
shall apply from 1 January 2026.’.

[[5]](#_ftnref5)             [OJ
L 212, 22.8.2018, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2018:212:TOC).

[[6]](#_ftnref6)
Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying
down detailed measures for the implementation of the common basic standards on
aviation security ([OJ L 299, 14.11.2015, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2015:299:TOC)).

[[7]](#_ftnref7)
Directive (EU) 2016/1148 of the European Parliament and of the Council of 6
July 2016 concerning measures for a high common level of security of network
and information systems across the Union ([OJ L 194, 19.7.2016, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2016:194:TOC)).

[[8]](#_ftnref8)
Regulation (EU) 2021/696 of the European Parliament and of the Council of 28
April 2021 establishing the Union Space Programme and the European Union Agency
for the Space Programme and repealing Regulations (EU) No 912/2010, (EU) No
1285/2013 and (EU) No 377/2014 and Decision No 541/2014/EU

[[9]](#_ftnref9)
Commission Implementing
Regulation (EU) 2017/373 of 1 March 2017 laying down common requirements
for providers of air traffic management/air navigation services and other air
traffic management network functions and their oversight, repealing Regulation
(EC) No 482/2008, Implementing Regulations (EU) No 1034/2011, (EU)
No 1035/2011 and (EU) 2016/1377 and amending Regulation (EU)
No 677/2011, (OJ L 062 8.3.2017, p. 1)

[[10]](#_ftnref10)
<https://www.easa.europa.eu/document-library/opinions>

[[11]](#_ftnref11)
Commission Regulation (EU) No 1321/2014 of 26 November 2014 on the continuing
airworthiness of aircraft and aeronautical products, parts and appliances, and
on the approval of organisations and personnel involved in these tasks ([OJ L 362, 17.12.2014, p. 1](http://publications.europa.eu/resource/oj/JOL_2014_362_R_TOC)).

[[12]](#_ftnref12)
Commission Regulation (EU) No 965/2012 of 5 October 2012 laying down technical
requirements and administrative procedures related to air operations pursuant
to Regulation (EC) No 216/2008 of the European Parliament and of the Council ([OJ L 296, 25.10.2012, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2012:296:TOC))

[[13]](#_ftnref13)
Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down
implementing rules for the airworthiness and environmental certification of
aircraft and related products, parts and appliances, as well as for the
certification of design and production organisations ([OJ
L 224, 21.8.2012, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2012:224:TOC)).

[[14]](#_ftnref14)
Commission Regulation (EU) No 1178/2011 of 3 November 2011 laying down
technical requirements and administrative procedures related to civil aviation
aircrew pursuant to Regulation (EC) No 216/2008 of the European Parliament and
of the Council ([OJ L 311, 25.11.2011, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2011:311:TOC)).

[[15]](#_ftnref15)
Commission Regulation (EU) 2015/340 of 20 February 2015 laying down technical
requirements and administrative procedures relating to air traffic controllers'
licences and certificates pursuant to Regulation (EC) No 216/2008 of the
European Parliament and of the Council, amending Commission Implementing
Regulation (EU) No 923/2012 and repealing Commission Regulation (EU) No
805/2011 ([OJ L 63, 6.3.2015, p. 1](https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32015R0340&qid=1620211650743)).

[[16]](#_ftnref16)
Commission Implementing
Regulation (EU) 2017/373 of 1 March 2017 laying down common requirements for
providers of air traffic management/air navigation services and other air
traffic management network functions and their oversight, repealing Regulation
(EC) No 482/2008, Implementing Regulations (EU) No 1034/2011, (EU) No 1035/2011
and (EU) 2016/1377 and amending Regulation (EU) No 677/2011 ([OJ L 62, 8.3.2017, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2012:281:TOC)).

[[17]](#_ftnref17)
Commission Implementing Regulation (EU) No 2021/664 of 22 April 2021 on a
regulatory framework for the U-space ([OJ L 139, 23.4.2021, p. 161](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021R0664)).

[[18]](#_ftnref18)
Commission Implementing Regulation (EU) 2023/1769 of 12 September
2023 laying down technical requirements and administrative procedures for the
approval of organisations involved in the design or production of air
traffic management/air navigation services systems and constituents and
amending Implementing Regulation (EU) 2023/203 (OJ L 228, XX.9.2023,
p. 19).

[[19]](#_ftnref19)
Commission Implementing Regulation (EU) 2024/1109 of 10 April 2024 laying down
rules for the application of Regulation (EU) 2018/1139 of the European
Parliament and of the Council as regards competent authority requirements and
administrative procedures for the certification, oversight and enforcement of
the continuing airworthiness of certified unmanned aircraft systems, and
amending Implementing Regulation (EU) 2023/203 (OJ L, 2024/1109, 17.5.2024,
ELI: http://data.europa.eu/eli/reg\_impl/2024/1109/oj).

[[20]](#_ftnref20)
Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying
down detailed measures for the implementation of the common basic standards on
aviation security ([OJ L 299, 14.11.2015, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2015:299:TOC)).

[[21]](#_ftnref21)
Directive (EU) 2016/1148 of the European Parliament and of the Council of 6
July 2016 concerning measures for a high common level of security of network
and information systems across the Union ([OJ L 194, 19.7.2016, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2016:194:TOC)).

[[22]](#_ftnref22)    Regulation (EU) No 376/2014 of the European Parliament and of the
Council of 3 April 2014 on the reporting, analysis and follow-up of occurrences
in civil aviation, amending Regulation (EU) No 996/2010 of the European
Parliament and of the Council and repealing Directive 2003/42/EC of the
European Parliament and of the Council and Commission Regulations (EC) No
1321/2007 and (EC) No 1330/2007 (OJ L 122, 24.4.2014, p. 18) (<https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32014R0376&qid=1669377456448>).

[[23]](#_ftnref23)
Regulation (EC) No
300/2008 of the European Parliament and of the Council of 11 March 2008 on
common rules in the field of civil aviation security and repealing Regulation
(EC) No 2320/2002, OJ L 97, 9.4.2008, p. 72

[[24]](#_ftnref24)
Regulation (EU) 2021/696 of the European Parliament and of the Council of 28
April 2021 establishing the Union Space Programme and the European Union Agency
for the Space Programme and repealing Regulations (EU) No 912/2010, (EU) No
1285/2013 and (EU) No 377/2014 and Decision No 541/2014/EU (OJ L 170,
12.5.2021, p. 69).

[[26]](#_ftnref26)
Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4
July 2018 on common rules in the field of civil aviation and establishing a
European Union Aviation Safety Agency, and amending Regulations (EC) No
2111/2005, (EC) No 1008/2008, (EU) No 996/2010, (EU) No 376/2014 and Directives
2014/30/EU and 2014/53/EU of the European Parliament and of the Council, and
repealing Regulations (EC) No 552/2004 and (EC) No 216/2008 of the European
Parliament and of the Council and Council Regulation (EEC) No 3922/91 (OJ L
212, 22.8.2018, p. 1) (<https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1535612134845&uri=CELEX:32018R1139>).

[[27]](#_ftnref27)
<https://www.easa.europa.eu/document-library/notices-of-proposed-amendment/npa-2019-07>

[[28]](#_ftnref28)
OJ L 212, 22.8.2018, p. 1.

[[29]](#_ftnref29)
Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying
down detailed measures for the implementation of the common basic standards on
aviation security ([OJ
L 299, 14.11.2015, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2015:299:TOC)).

[[30]](#_ftnref30)
Directive (EU) 2016/1148 of the European Parliament and of the Council of 6
July 2016 concerning measures for a high common level of security of network
and information systems across the Union ([OJ
L 194, 19.7.2016, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2016:194:TOC)).

[[31]](#_ftnref31)
Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down
implementing rules for the airworthiness and environmental certification of
aircraft and related products, parts and appliances, as well as for the
certification of design and production organisations

[[32]](#_ftnref32)
Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down
requirements and administrative procedures related to aerodromes pursuant to
Regulation (EC) No 216/2008 of the European Parliament and of the Council

[[33]](#_ftnref33)
<https://www.easa.europa.eu/document-library/opinions>

[[34]](#_ftnref34)
OJ L 123, 12.5.2016, p. 1.

[[35]](#_ftnref35)
Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down
requirements and administrative procedures related to aerodromes pursuant to
Regulation (EC) No 216/2008 of the European Parliament and of the Council ([OJ
L 44, 14.2.2014, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2014:044:TOC)).

[[36]](#_ftnref36)
Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying
down detailed measures for the implementation of the common basic standards on
aviation security ([OJ
L 299, 14.11.2015, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2015:299:TOC)).

[[37]](#_ftnref37)
Directive (EU) 2016/1148 of the European Parliament and of the Council of 6
July 2016 concerning measures for a high common level of security of network
and information systems across the Union ([OJ
L 194, 19.7.2016, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2016:194:TOC)).

[[38]](#_ftnref38)    Regulation (EU) No 376/2014 of the European Parliament and of the
Council of 3 April 2014 on the reporting, analysis and follow-up of occurrences
in civil aviation, amending Regulation (EU) No 996/2010 of the European
Parliament and of the Council and repealing Directive 2003/42/EC of the
European Parliament and of the Council and Commission Regulations (EC) No
1321/2007 and (EC) No 1330/2007 (OJ L 122, 24.4.2014, p. 18) (<https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32014R0376&qid=1669377456448>).

[[39]](#_ftnref39)
Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11
March 2008 on common rules in the field of civil aviation security and
repealing Regulation (EC) No 2320/2002 (OJ L 97, 9.4.2008, p. 72).

[[40]](#_ftnref40)           Commission
Regulation (EU) No 139/2014 of 12 February 2014 laying down requirements and
administrative procedures related to aerodromes pursuant to Regulation (EC) No
216/2008 of the European Parliament and of the Council ([OJ L 44, 14.2.2014, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2014:044:TOC)).

([41]) Regulation
(EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014
on the reporting, analysis and follow-up of occurrences in civil aviation,
amending Regulation (EU) No 996/2010 of the European Parliament and of the
Council and repealing Directive 2003/42/EC of the European Parliament and of
the Council and Commission Regulations (EC) No 1321/2007 and (EC) No 1330/2007 ([OJ L 122,
24.4.2014, p. 18](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2014:122:TOC)).

if !supportAnnotations?

---

if !supportAnnotations?

if !supportAnnotations?[[LD1]](#_msoanchor_1)link

if !supportAnnotations?

---

[[1]](#_ftnref1)      The published date represents the date when the consolidated version of
the document was generated.

[[2]](#_ftnref2)      Euro-Lex, Important Legal Notice: <http://eur-lex.europa.eu/content/legal-notice/legal-notice.html>.

[[4]](#_ftnref4)      ‘As regards the case of the EGNOS air
navigation service provider subject to Implementing Regulation (EU) 2017/373 it
shall apply from 1 January 2026.’.

[[5]](#_ftnref5)             [OJ
L 212, 22.8.2018, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2018:212:TOC).

[[10]](#_ftnref10)
<https://www.easa.europa.eu/document-library/opinions>

[[27]](#_ftnref27)
<https://www.easa.europa.eu/document-library/notices-of-proposed-amendment/npa-2019-07>

[[28]](#_ftnref28)
OJ L 212, 22.8.2018, p. 1.

[[33]](#_ftnref33)
<https://www.easa.europa.eu/document-library/opinions>

[[34]](#_ftnref34)
OJ L 123, 12.5.2016, p. 1.

##### Appendix III — Examples of aviation services and interfaces

*ED Decision 2025/014/R*

**AVIATION SERVICES**

The following is a non-exhaustive and non-complete list of aviation
services that can be used as a basis to identify the scope of the
risk assessment for the organisation.

—
aerodrome & ATM-MET service providers

—
aeronautical digital mapping services

—
aeronautical information management (AIM) – external, national,
regional

—
airports

—
air traffic control (ATC) – external, superior

—
air traffic management (ATM)

—
approach (APP) & area control (ACC) Services – ER ACC, APP ACC

—
cargo and passenger loading

—
civil & state airspace user (AU) operations centres

—
communication infrastructure

—
flight information services / traffic information services (FIS/TIS)
data integrator

—
fuel calculation

—
navigation infrastructure – ground-based, satellite-based

—
non-ATM meteorological (MET) service providers

—
mass & balance calculation

—
non-aviation users (external)

—
regional & sub-regional airspace management (ASM) and air traffic
flow & capacity management (ATFCM)

—
static aeronautical data services

—
sub-regional demand & capacity balancing (DCB) common service
providers

—
surveillance infrastructure – airport, en-route,
terminal manoeuvring area (TMA)

—
route planning

—
time reference services (external)

—
tower (TWR) services

**INTERFACES**

Below are some examples of data exchange at the interfaces between
organisations interacting in different functional chains, which can
be used as a basis for identifying the scope of the risk assessment
for the organisation.

Note 1: These examples are graphical representations based on the
‘**Examples
of ecosystem data exchange’ provided in EUROCAE ED-201A, Appendix B
- Tables B-14**, which can be consulted for further
information.

Note 2: Although it is not an organisation, an aircraft has been
included in all these examples for the sake of completeness of the
description of the data exchange. The aircraft should be considered
as an element within the scope of the ISMS of the organisation to
which it belongs (typically the airline). Any data exchange between
aircraft and other systems within the organisation should take into
account existing security measures that may have been evaluated as
part of aircraft certification (see also [GM1 IS.D.OR.205(c)](#_DxCrossRefBm1749084465)).

![](/static/files/file_jgagq8469rH/image011.png)

***Figure
1: Interfaces of other organisations with an airline operator***

![](/static/files/file_jgagq8469rH/image012.png)

***Figure
2: Interfaces of an airline operator with other organisations***

![](/static/files/file_jgagq8469rH/image013.png)

***Figure
3: Interfaces of other organisations with a maintenance service
provider***

![](/static/files/file_jgagq8469rH/image014.png)

***Figure
4: Interfaces of a maintenance service provider with other
organisations***

Compare / EASA/ Incorporated Amendments/ Compare & Highlight Differences

Appendix III -- Examples of aviation services and interfaces

View