This Objective is dealing with the Stakeholders’ SWIM PKI and cybersecurity. It aims at implementing basic/generic public key infrastructure management at each civil or military stakeholder, in line with their own Security Management System approved by their National Supervisory Authority (NSA). The local implementation may differ depending on whether the stakeholders will become a CA (Certificate Authority) themselves or use the European Common Aviation PKI (EACP) to generate certificates.

The stakeholder’s local implementation includes two options (the options are also addressed in the description of the individual SLoAs):

• If the stakeholder decides to develop its own PKI:
o definition of local policies and procedures for authorising and mandating local organisation to do certificate management in compliance with EACP policies;
o implementation of audit programmes ensuring continuous compliance with common and local policies and standards;
o implementation of its own local PKI while benefiting from the interoperability with other PKIs by using the EACP solution;
o adaptation of systems (equipment and procedures) to use local certificates and EACP services.

• If the stakeholder decides to use the EACP solution
o Use of EACP policies and procedures for authorising and mandating local organisation to use EACP certificates and services;
o implementation of audit programmes ensuring continuous compliance with EACP policies and standards;
o adaptation of systems (equipment and procedures) to use EACP solution;

• Whatever the decision will be, the following activities must be operated:
o training of technical personnel;
o monitoring and control, e.g. establish a local or multi-stakeholders Security Operations Centre (or equivalent) to monitor and protect the IT systems against cyber-attacks.

Combining both options is a valid and acceptable approach (they are not exclusive) as:
• National regulation may impose to use a national PKI for critical infrastructure or operator of essential service or government-related organisations;
• Some stakeholders may already have a PKI that would have to be upgraded to be auditable and conform with EACP solution and they may wish to keep on using it;
• Some stakeholders may decide to implement a local PKI for internal or specific uses and use EACP for other purposes.

System requirements:

Stakeholders shall implement, on one hand a Public Key Infrastructure (PKI) and, on the other hand cyber-security monitoring and control means. To implement the PKI, stakeholders have two main options:

• To use the European Aviation Common PKI (EACP) solution. In such case, stakeholders must:
o define the local framework to use digital certificates (policies, procedures);
o implement audit programmes to ensure that their organisation and its policies & procedures are auditable and that consequently they can be trusted to use EACP certificates and thus by parties with whom information exchanges are secured using EACP digital certificates;
o adapt their systems to use the EACP solution (e.g. access to EACP certificate publication and validation services);
o train their staff to ensure that they have the required demonstrated level of competence to use EACP digital certificates and services.

• To deploy their own local PKI and to benefit from the EACP solution only to ensure the interoperability of their local PKI with other stakeholders. In such case, stakeholders must:
o define the local framework to deploy their local PKI (policies, procedures). If stakeholders want to benefit from the EACP interoperability and validation services, they will have to ensure that the policies and procedures of their local PKI is also compliant with EACP framework trust framework;
o implement audit programmes to ensure that their organisation and its policies & procedures are auditable and that consequently they can be trusted to benefit from EACP interoperability service and thus by parties with whom information exchanges are secured using EACP interoperability and validation services;
o adapt their systems to use their local PKI solution as well as EACP validation service;
o train their staff to ensure that they have the required demonstrated level of competence to use their local digital certificates and EACP interoperability and validation services.

Combining both options is a valid and acceptable approach (they are not exclusive) as:
o National Regulation may impose to use a national PKI for critical infrastructure or operator of essential service or government-related organisations;
o some stakeholders may already have a PKI that would have to be upgraded to be auditable and conform with EACP solution and they may wish to keep on using it;
o some stakeholders may decide to implement a local PKI for internal or specific uses and use EACP for other purposes.

NOTE: For a description of the EACP solution, see Family 5.1.1 of the Deployment Programme.

NOTE FOR MILITARY AUTHORITIES: It is the responsibility of each military authority to review this Objective IN ITS ENTIRETY and address each of the SLoAs that the military authority considers RELEVANT for itself. This has to be done on top and above of the review of "MIL" SLoAs which identify actions EXCLUSIVE to military authorities.

Edition

2022

Stakeholders

Air Navigation Service Provider / Airport Operator / Airspace Users / Network Manager

Type

CP1

Scope

ECAC+

Status

Active