INDUSTRY FACT FILE · AVIATION & AEROSPACE

Cybersecurity FAQs for Aviation and Aerospace

Forty frequently asked questions and answers in five categories, written for Boards, CIOs and CISOs, airport and airline operations, AVSEC, engineering, digital and loyalty teams, procurement and compliance.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, standards and partner requirements 3.  Category 3: Airports, platforms and operational technology 4.  Category 4: SOC, incidents, fraud and resilience 5.  Category 5: Suppliers, data and passengers

Audience: Boards, CEOs, CFOs, CIOs and CISOs

Q1. Why is aviation an attractive target?

Because stopped aircraft and stranded passengers create visible pressure to pay, passenger records contain passports and dates of birth, loyalty miles are cash equivalents, and airports and aerospace firms are critical infrastructure with valuable designs. Shared platforms and thousands of suppliers widen the door.

Q2. What are the biggest risks for an Indian airline or airport?

Ransomware stopping check-in, baggage or dispatch; passenger data breaches at providers; outages of shared platforms; airport OT on flat networks; supplier compromise; loyalty account takeover; and slow detection that misses CERT-In's six-hour window.

Q3. Which incidents should the Board know about?

The 2021 SITA breach affecting about 4.5 million Air India passengers; SpiceJet's 2022 ransomware delays; the 2024 Port of Seattle ransomware attack that shut check-in and baggage systems; Qantas's 2025 contact-centre breach affecting 5.7 million customers; the September 2025 Collins Aerospace MUSE disruption at three European hubs; and LockBit's 2023 leak of Boeing data.

Q4. Is this an IT problem or an operations and safety problem?

Both. Most incidents begin in IT or at a provider and reach operations through platform dependencies, flat networks or vendor access. Security must be owned jointly by IT, operations, AVSEC and engineering, with the Board accountable.

Q5. What should the Board review each quarter?

Platform and provider dependencies and recovery tests, airport OT segmentation status, passenger data inventory and DPDP progress, supplier assessments, loyalty fraud trends, incidents and near misses, audit findings, SOC coverage and exercise results.

Q6. Who should own aviation cybersecurity?

A CISO or security head working with operations, AVSEC, engineering and digital leadership, with named owners for each platform, airport system, data store and critical supplier relationship.

Q7. How should we prioritise investment?

Make operations recoverable with rehearsed fallback, segment airport OT, assure the providers and suppliers you depend on, map and protect passenger data, harden apps and loyalty, and build monitoring across airline, airport and OT—in that order.

Q8. How can Codec Networks help?

Codec Networks provides airport IT/OT assessments, passenger data and DPDP programmes, 24x7 aviation SOC, platform and supplier assurance, operational resilience with fallback rehearsals, airline app and API testing, forensics and crisis exercises.

Audience: Compliance, legal, company secretarial, AVSEC and CISO offices

Q9. Do CERT-In Directions apply to airlines, airports and suppliers?

Yes. They apply to bodies corporate generally. Cyber incidents must be reported within six hours of noticing them and ICT logs retained for 180 days in India.

Q10. What do CERT-In's 2025 audit guidelines expect?

Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications, with closure of findings—so baggage systems, BMS, shared platforms and cloud services belong in the audit scope.

Q11. Does NCIIPC apply to us?

Transport is a critical sector, but obligations attach to systems notified as protected systems—more likely at major airports, air navigation and national platforms. Good practice aligns with NCIIPC guidance regardless.

Q12. What does ICAO Annex 17 say about cybersecurity?

Standard 4.9.1 requires States to identify critical aviation ICT systems and data on a risk basis and protect them; Recommended Practice 4.9.2 covers confidentiality, integrity and availability, security by design, supply-chain security and remote-access protection. India implements these through DGCA and BCAS programmes.

Q13. What must listed airlines and airport companies disclose?

Under SEBI's LODR Regulations, listed entities disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report, and material events as required.

Q14. How does the DPDP Act affect an airline or airport?

You process personal data of passengers, crew, loyalty members, visitors and employees, often through processors. The DPDP Act and Rules require notice, consent, safeguards, retention limits and breach intimation, with most obligations taking effect in May 2027—biometric data deserves particular care.

Q15. Does EASA Part-IS affect Indian organisations?

If you hold EU approvals—for example as a maintenance, design or production organisation—or serve EU partners, Part-IS information security management requirements apply from October 2025 or February 2026 depending on the organisation type, and partners will ask for evidence.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT/OT audits, ISO 27001 and IEC 62443 gap assessments, Annex 17 and Part-IS alignment reviews and partner audit support.

Audience: Airport operations, AVSEC, engineering and facilities teams

Q17. Which airport systems count as OT?

Baggage handling systems, building management, access control, CCTV, screening equipment, aerobridges, fuel hydrant and apron systems, parking and lighting controls—anything with controllers and vendors that cannot simply be patched like office IT.

Q18. How should airport OT be separated from IT?

Use a zone-and-conduit model: separate zones for baggage, BMS, access control and CCTV behind a DMZ, no dual-homed devices, brokered vendor access and the ability to run operations if office IT is down.

Q19. How do we assess airport systems without disrupting operations?

Passive asset discovery, configuration and architecture reviews, and any active testing planned with operations in low-traffic windows—never unplanned scanning of baggage or access control controllers.

Q20. How should vendor remote maintenance work?

Through a brokered gateway with MFA, named accounts, approval per session, time limits and recording—never standing VPNs or shared passwords—with security clauses in maintenance contracts.

Q21. How do we prepare for a shared platform outage?

Assess the provider, agree recovery and notification duties, map which processes depend on it, keep manual check-in, baggage tag and boarding procedures ready and rehearse them with airlines and handlers.

Q22. Are kiosks, Wi-Fi and biometric gates risks?

Yes. They sit on campus networks and face the public; test them, isolate them from operational zones, manage their credentials and firmware and protect biometric data end to end.

Q23. What about connected aircraft and EFBs?

Treat EFBs as managed devices with controlled apps and data, secure the ground systems and vendors they depend on, and include aircraft data links in your risk assessments with your OEMs.

Q24. How do we protect maintenance records?

Restrict and log access to records systems, enforce integrity controls and approvals for changes, back records up immutably and include records systems in audits and Part-IS scope.

Audience: SOC, digital, loyalty, finance and incident response teams

Q25. Do airlines and airports need a 24x7 SOC?

Yes. Operations run around the clock and attacks are timed for nights and peaks; a SOC that correlates airline, airport, OT, cloud and provider telemetry catches intrusions and fraud early.

Q26. What should an aviation SOC monitor?

Privilege escalation on platforms, provider and vendor access, OT traffic in baggage and BMS zones, login and redemption anomalies in loyalty, mailbox rules and payment changes, cloud key usage and public-facing system abuse.

Q27. How do we stop loyalty account takeover?

Rate-limit and monitor login flows, use risk-based MFA, require step-up authentication before miles are redeemed or contact details changed, apply redemption velocity limits and test the controls regularly.

Q28. What should an incident playbook include?

Containment that keeps aircraft and passengers moving safely, manual fallback for check-in and baggage, CERT-In reporting within six hours, engagement with DGCA or BCAS where safety or security systems are affected, partner and provider notification, SEBI disclosure if listed and DPDP breach intimation once in force.

Q29. How should backups be designed?

Immutable or offline backups of operational platforms, databases, PLC programs and configurations, maintenance records and loyalty data, with regular restore tests and documented restart sequences by system and site.

Q30. Should we run exercises?

Yes—an annual ransomware tabletop with leadership and operations, a platform-outage rehearsal with airlines and handlers, a passenger data breach exercise with legal and communications and a BEC exercise with finance.

Q31. How quickly can an airport or airline recover from ransomware?

With segmented OT, tested backups and rehearsed manual fallback, days with degraded service; without them, weeks—as public cases show.

Q32. When should forensics be engaged?

As soon as compromise is suspected, with investigators who understand aviation platforms and OT, to preserve evidence, establish root cause and support CERT-In, regulator, partner and insurance processes.

Audience: Procurement, partnerships, privacy, customer and cargo teams

Q33. How do we manage risk from platform providers and processors?

Identify the providers whose outage or breach would stop operations or expose passenger data, assess their security and resilience, agree recovery, notification and audit rights in contracts, monitor your integrations and rehearse running without them.

Q34. How should handlers, caterers and IT vendors access our systems?

With least-privilege, MFA-protected, brokered access tied to named individuals, security requirements in contracts, device standards and regular recertification.

Q35. How do we protect passenger data?

Know every copy—PSS, loyalty, contact centres, handlers, analytics, providers—minimise and encrypt it, restrict access by role, monitor bulk access, enforce retention limits and treat passports and biometrics as the most sensitive tier.

Q36. How do we deal with fake booking sites and refund scams?

Monitor domains, app stores and social channels, issue takedowns, warn passengers through official channels and close the data leaks that make scams convincing.

Q37. What should aerospace suppliers do about OEM security requirements?

Classify and segment design data, control export-controlled information, build an ISO 27001-aligned ISMS, back up ERP, CAD and quality systems immutably and keep an evidence pack for OEM questionnaires and audits.

Q38. How should cargo and customs systems be secured?

Protect filing credentials, restrict and log access to cargo management and customs integrations, test portals and monitor for fraudulent filings and unusual access.

Q39. What about AI chatbots and disruption-management tools?

Treat them as applications: test for prompt injection and data leakage, limit what they can access and do, log interactions and govern how passenger data trains or feeds them.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your platforms, airports, fleets, suppliers and partners; Codec Networks will propose an operations-aware assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, safety or regulatory advice. Confirm obligations against the official instruments and your partner and lessor contracts.