Sofema Aviation Services (SAS) www.sassofia.com considers fundamental issues related to the challenge to address cyber security threats within EASA Regulated Design Organisations
Introduction
AMC 20-42 serves as a structured framework for identifying, assessing, and mitigating information security risks in aviation products and systems. By leveraging EUROCAE/RTCA standards, it ensures airworthiness and safety are maintained against evolving cybersecurity threats while aligning with European regulatory requirements.
- AMC 20-42 provides guidance on performing airworthiness information security risk assessments for aviation products, parts, and systems.
- It is published under ED Decision 2020/006/R and serves as an acceptable means of compliance (AMC) for meeting the regulatory requirements concerning information security in civil aviation.
Purpose
- Compliance Framework – AMC 20-42 outlines a non-mandatory yet acceptable method to show compliance with applicable airworthiness certification rules for managing information security risks.
- Scope of Application:
This AMC applies to manufacturers, design approval holders (DAHs), and other aviation stakeholders seeking certification for:- New products (e.g., aircraft, engines, propellers).
- Supplemental type certificates (STCs).
- Changes to existing products or equipment under ETSO (European Technical Standard Orders).
- Systems susceptible to information security threats that may impact airworthiness.
Key Aspects of AMC 20-42
Product Information Security Risk Assessment (PISRA):
AMC 20-42 introduces the concept of PISRA to address intentional unauthorized electronic interaction (IUEI) that could pose a safety risk. The process includes:
- Determining the security environment.
- Identifying assets and attack paths.
- Assessing safety consequences of security threats.
- Evaluating risks and proposing mitigation measures if necessary.
- Iterating the process until residual risks are deemed acceptable.
Reference: PISRA aligns with the process outlined in EUROCAE ED-202A and is further supported by ED-203A for guidance.
Risk Acceptability
The acceptability of risk is based on:
- Severity: The safety effect of an incident (e.g., major, hazardous, catastrophic).
- Threat Level: Likelihood and difficulty of exploitation.
For example, a threat with major safety effects may be unacceptable for CS-25 (large aircraft) but acceptable under other contexts like CS-29 (rotorcraft).
Reporting Requirements
- Operators must report information security occurrences to the designer or certificate holder.
- Designers must analyze impacts and notify EASA if unsafe conditions arise, ensuring timely corrective actions under 21.A.3A of Annex I (Regulation (EU) No 748/2012).
Instructions for Continued Airworthiness (ICA):
To maintain an acceptable security risk level, manufacturers must:
- Develop security procedures for operations, monitoring, and auditing.
- Address in-service occurrences that may result from IUEIs.
- Assess new threats and communicate mitigation solutions promptly to operators and competent authorities.
Guidance Reference: Continued airworthiness guidance aligns with EUROCAE ED-203A/RTCA DO-356A and ED-204/RTCA DO-355.
Validation and Verification
To ensure the effectiveness of mitigation strategies:
- Security verification methods include analysis, robustness testing, inspections, and adversary-focused security testing.
Referenced Standards
AMC 20-42 acknowledges EUROCAE and RTCA standards as acceptable means of compliance:
- ED-202A / DO-326A: Airworthiness Security Process Specification.
- ED-203A / DO-356: Airworthiness Security Methods and Considerations.
- ED-204 / DO-355: Information Security Guidance for Continuing Airworthiness.
Next Steps
- Follow this link to our Library to find & download related documents for Free.
- See the following 2 day course-Implementing an Information Cyber Security Program in an EASA Part 145 Organization – 2 Days
for comments or questions please email team@sassofia.com
Tags:
Information Security Risk Mitigation, PISRA, 21.A.3A of Annex I, EUROCAE ED-202A and ED-203A Standards, Aviation Cyber Threats Mitigation, EASA AMC 20-42 Compliance, Airworthiness Certification Rules, Aviation Safety Risk Assessment, Intentional Unauthorized Electronic Interaction (IUEI), Civil Aviation Security, RTCA, EASA Cybersecurity Regulations, RTCA Standards, EUROCAE Standards, Product Information Security Risk Assessment (PISRA), Aviation Compliance Framework, Airworthiness Information Security, AMC 20-42, BlogSeries, Aviation Cyber Security
