Regulation (EC) No 300/2008 of the European Parliament and of the CouncilShow full title

[F1 ANNEX II U.K. F2 ... Specifications for the national quality control programme to be implemented by [F3 the appropriate authority] in the field of civil aviation security

Textual Amendments

F1 Inserted by Commission Regulation (EU) No 18/2010 of 8 January 2010 amending Regulation (EC) No 300/2008 of the European Parliament and of the Council as far as specifications for national quality control programmes in the field of civil aviation security are concerned.

F2 Words in Annex 2 heading omitted (31.12.2020) by virtue of The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 31(a); 2020 c. 1, Sch. 5 para. 1(1)

F3 Words in Annex 2 heading substituted (31.12.2020) by The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 31(b); 2020 c. 1, Sch. 5 para. 1(1)

1. DEFINITIONS U.K.

1.1. For the purposes of this Annex, the following definitions shall apply: U.K.

(1)

‘annual traffic volume’ means the total number of passengers arriving, departing and in transit (counted once);

(2)

F4 ...

(3)

‘auditor’ means any person conducting national compliance monitoring activities on behalf of the appropriate authority;

(4)

‘certification’ means a formal evaluation and confirmation by or on behalf of the appropriate authority that a person possesses the necessary competencies to perform the functions of an auditor to an acceptable level as defined by the appropriate authority;

(5)

‘compliance monitoring activities’ means any procedure or process used for assessing the implementation of this Regulation and the national aviation security programme;

(6)

‘deficiency’ means a failure to comply with an aviation security requirement;

(7)

‘inspection’ means an examination of the implementation of security measures and procedures in order to determine whether they are being carried out effectively and to the required standard and to identify any deficiencies;

(8)

‘interview’ means an oral check by an auditor to establish whether specific security measures or procedures are implemented;

(9)

‘observation’ means a visual check by an auditor that a security measure or procedure is implemented;

(10)

‘representative sample’ means a selection made from amongst possible options for monitoring which is sufficient in number and range to provide a basis for general conclusions on implementing standards;

(11)

‘security audit’ means an in-depth examination of security measures and procedures in order to determine if they are being fully implemented on a continual basis;

(12)

‘test’ means a trial of aviation security measures, where the appropriate authority simulates intent to commit an act of unlawful interference for the purpose of examining the effectiveness of the implementation of existing security measures;

(13)

‘verification’ means an action taken by an auditor to establish whether a specific security measure is actually in place;

(14)

‘vulnerability’ means any weakness in the implemented measures and procedures which could be exploited to carry out an act of unlawful interference.

Textual Amendments

F4 Annex 2 point 1.1(2) omitted (31.12.2020) by virtue of The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 32; 2020 c. 1, Sch. 5 para. 1(1)

2. POWERS OF THE APPROPRIATE AUTHORITY U.K.

2.1. F5 ... U.K.

Textual Amendments

F5 Annex 2 point 2.1 omitted (31.12.2020) by virtue of The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 33; 2020 c. 1, Sch. 5 para. 1(1)

2.2. The appropriate authority shall perform compliance monitoring activities and have the powers necessary to require any identified deficiency to be rectified within set timeframes. U.K.

2.3. A graduated and proportionate approach shall be established regarding deficiency correction activities and enforcement measures. This approach shall consist of progressive steps to be followed until correction is achieved, including: U.K.

(a)

advice and recommendations;

(b)

formal warning;

(c)

enforcement notice;

(d)

administrative sanctions and legal proceedings.

The appropriate authority may omit one or more of these steps, especially where the deficiency is serious or recurring.

3. OBJECTIVES AND CONTENT OF THE NATIONAL QUALITY CONTROL PROGRAMME U.K.

3.1. The objectives of the national quality control programme are to verify that aviation security measures are effectively and properly implemented and to determine the level of compliance with the provisions of this Regulation and the national civil aviation security programme, by means of compliance monitoring activities. U.K.

3.2. The national quality control programme shall include the following elements: U.K.

(a)

organisational structure, responsibilities and resources;

(b)

job descriptions of, and qualifications required for auditors;

(c)

compliance monitoring activities, including scope of security audits, inspections, tests and, following an actual or potential breach of security, investigations, frequencies for security audits and inspections and also classification of compliance;

(d)

surveys, where there is cause to reassess security needs;

(e)

deficiency correction activities providing details concerning deficiency reporting, follow-up and correction in order to ensure compliance with aviation security requirements;

(f)

enforcement measures and, where appropriate, penalties, as specified in [F6 point 2.3] of this Annex;

(g)

reporting of compliance monitoring activities carried out including, where appropriate, information exchange between national bodies on compliance levels;

(h)

monitoring process of the airport, operator and entity internal quality control measures;

(i)

a process to record and analyse the results of the national quality control programme to identify trends and steer future policy development.

Textual Amendments

F6 Words in Annex 2 point 3.2(f) substituted (31.12.2020) by The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 34; 2020 c. 1, Sch. 5 para. 1(1)

4. COMPLIANCE MONITORING U.K.

4.1. All airports, operators and other entities with aviation security responsibilities shall be regularly monitored to ensure the swift detection and correction of failures. U.K.

4.2. Monitoring shall be undertaken in accordance with the national quality control programme, taking into consideration the threat level, type and nature of the operations, standard of implementation, results of internal quality control of airports, operators and entities and other factors and assessments which will affect the frequency of monitoring. U.K.

4.3. Monitoring shall include the implementation and effectiveness of the internal quality control measures of airports, operators and other entities. U.K.

4.4. Monitoring at each individual airport shall be made up of a suitable mixture of compliance monitoring activities and provide a comprehensive overview of the implementation of security measures in the field. U.K.

4.5. The management, setting of priorities and organisation of the quality control programme shall be undertaken independently from the operational implementation of the measures taken under the national civil aviation security programme. U.K.

4.6. Compliance monitoring activities shall include security audits, inspections and tests. U.K.

5. METHODOLOGY U.K.

5.1. The methodology for conducting monitoring activities shall conform to a standardised approach, which includes tasking, planning, preparation, on-site activity, the classification of findings, the completion of the report and the correction process. U.K.

5.2. Compliance monitoring activities shall be based on the systematic gathering of information by means of observations, interviews, examination of documents and verifications. U.K.

5.3. Compliance monitoring shall include both announced and unannounced activities. U.K.

6. SECURITY AUDITS U.K.

6.1. A security audit shall cover: U.K.

(a)

all security measures at an airport; or

(b)

all security measures implemented by an individual airport, terminal of an airport, operator or entity; or

(c)

a particular part of the National Civil Aviation Security Programme.

6.2. The methodology for conducting a security audit shall take into consideration the following elements: U.K.

(a)

announcement of the security audit and communication of a pre-audit questionnaire, if appropriate;

(b)

preparation phase including examination of the completed pre-audit questionnaire and other relevant documentation;

(c)

entry briefing with airport/operator/entity representatives prior to beginning the monitoring activity on-site;

(d)

on-site activity;

(e)

debriefing and reporting;

(f)

where deficiencies are identified, the correction process and the associated monitoring of that process.

6.3. In order to confirm that security measures are implemented, the conduct of a security audit shall be based on a systematic gathering of information by one or more of the following techniques: U.K.

(a)

examination of documents;

(b)

observations;

(c)

interviews;

(d)

verifications.

6.4. Airports with an annual traffic volume of more than 10 million passengers shall be subject to a security audit covering all aviation security standards at least every 4 years. The examination shall include a representative sample of information. U.K.

7. INSPECTIONS U.K.

7.1. The scope of an inspection shall cover at least one set of directly linked security measures of Annex I to this Regulation and the corresponding implementing acts monitored as a single activity or within a reasonable time frame, not normally exceeding three months. The examination shall include a representative sample of information. U.K.

7.2. A set of directly linked security measures is a set of two or more requirements as referred to in Annex I to this Regulation and the corresponding implementing acts which impact on each other so closely that achievement of the objective cannot be adequately assessed unless they are considered together. These sets shall include those listed in Appendix I to this Annex. U.K.

7.3. Inspections shall be unannounced. Where the appropriate authority considers that this is not practicable, inspections may be announced. The methodology for conducting an inspection shall take into consideration the following elements: U.K.

(a)

preparation phase;

(b)

on-site activity;

(c)

a debrief, depending on the frequency and the results of the monitoring activities;

(d)

reporting/recording;

(e)

correction process and its monitoring.

7.4. In order to confirm that security measures are effective, the conduct of the inspection shall be based on the systematic gathering of information by one or more of the following techniques: U.K.

(a)

examination of documents;

(b)

observations;

(c)

interviews;

(d)

verifications.

7.5. At airports with an annual traffic volume of more than 2 million passengers the minimum frequency for inspecting all sets of directly linked security measures set out in chapters 1 to 6 of Annex I to this Regulation shall be at least every 12 months, unless an audit has been carried out at the airport during that time. The frequency for inspecting all security measures covered by chapters 7 to 12 of Annex I shall be determined by the appropriate authority based on a risk assessment. U.K.

7.6. F7 ... U.K.

Textual Amendments

F7 Annex 2 point 7.6 omitted (31.12.2020) by virtue of The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 35; 2020 c. 1, Sch. 5 para. 1(1)

8. TESTS U.K.

8.1. Tests shall be carried out to examine the effectiveness of the implementation of at least the following security measures: U.K.

(a)

access control to security restricted areas;

(b)

aircraft protection;

(c)

screening of passengers and cabin baggage;

(d)

screening of staff and items carried;

(e)

protection of hold baggage;

(f)

screening of cargo or mail;

(g)

protection of cargo and mail.

8.2. A test protocol including the methodology shall be developed taking into consideration the legal, safety and operational requirements. The methodology shall address the following elements: U.K.

(a)

preparation phase;

(b)

on-site activity;

(c)

a debrief, depending on the frequency and the results of the monitoring activities;

(d)

reporting/recording;

(e)

correction process and the associated monitoring.

9. SURVEYS U.K.

9.1. Surveys shall be carried out whenever the appropriate authority recognises a need to re-evaluate operations in order to identify and address any vulnerabilities. Where a vulnerability is identified, the appropriate authority shall require the implementation of protective measures commensurate with the threat. U.K.

10. REPORTING U.K.

10.1. Compliance monitoring activities shall be reported or recorded in a standardised format which allows for an on-going analysis of trends. U.K.

10.2. The following elements shall be included: U.K.

(a)

type of activity;

(b)

airport, operator or entity monitored;

(c)

date and time of the activity;

(d)

name of the auditors conducting the activity;

(e)

scope of the activity;

(f)

findings with the corresponding provisions of the National Civil Aviation Security Programme;

(g)

classification of compliance;

(h)

recommendations for remedial actions, where appropriate;

(i)

time frame for correction, where appropriate.

10.3. Where deficiencies are identified, the appropriate authority shall report the relevant findings to the airport, operators or entities subjected to monitoring. U.K.

11. F8 ... CLASSIFICATION OF COMPLIANCE U.K.

11.1. Compliance monitoring activities shall assess the implementation of the national civil aviation security programme using the F9 ... classification system of compliance set out in Appendix II. U.K.

Textual Amendments

F9 Word in Annex 2 point 11.1 omitted (31.12.2020) by virtue of The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 36(b); 2020 c. 1, Sch. 5 para. 1(1)

Textual Amendments

F8 Word in Annex 2 point 11 heading omitted (31.12.2020) by virtue of The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 36(a); 2020 c. 1, Sch. 5 para. 1(1)

12. CORRECTION OF DEFICIENCIES U.K.

12.1. The correction of identified deficiencies shall be implemented promptly. Where the correction cannot take place promptly, compensatory measures shall be implemented. U.K.

12.2. The appropriate authority shall require airports, operators or entities subjected to compliance monitoring activities to submit for agreement an action plan addressing any deficiencies outlined in the reports together with a timeframe for implementation of the remedial actions and to provide confirmation when the correction process has been completed. U.K.

13. FOLLOW-UP ACTIVITIES RELATED TO THE VERIFICATION OF THE CORRECTION U.K.

13.1. Following confirmation by the airport, operator or entity subjected to monitoring that any required remedial actions have been taken, the appropriate authority shall verify the implementation of the remedial actions. U.K.

13.2. Follow-up activities shall use the most relevant monitoring method. U.K.

14. AVAILABILITY OF AUDITORS U.K.

14.1. [F10 The appropriate authority] shall ensure that a sufficient number of auditors are available to the appropriate authority directly or under its supervision for performing all compliance monitoring activities. U.K.

Textual Amendments

F10 Words in Annex 2 point 14.1 substituted (31.12.2020) by The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 37; 2020 c. 1, Sch. 5 para. 1(1)

15. QUALIFICATION CRITERIA FOR AUDITORS U.K.

15.1. [F11 The appropriate authority] shall ensure that auditors performing functions on behalf of the appropriate authority: U.K.

(a)

are free from any contractual or pecuniary obligation to the airport, operator or entity to be monitored; and

(b)

have the appropriate competencies, which include sufficient theoretical and practical experience in the relevant field.

Auditors shall be subject to certification or equivalent approval by the appropriate authority.

Textual Amendments

F11 Words in Annex 2 point 15.1 substituted (31.12.2020) by The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 37; 2020 c. 1, Sch. 5 para. 1(1)

15.2. The auditors shall have the following competencies: U.K.

(a)

an understanding of current applicable security measures and how they are applied to the operations being examined including:

• an understanding of security principles,

• an understanding of supervisory tasks,

• an understanding of factors affecting human performance,

(b)

a working knowledge of security technologies and techniques;

(c)

a knowledge of compliance monitoring principles, procedures and techniques;

(d)

a working knowledge of the operations being examined;

(e)

an understanding of the role and powers of the auditor.

15.3. Auditors shall undergo recurrent training at a frequency sufficient to ensure that existing competencies are maintained and new competencies are acquired to take account of developments in the field of security. U.K.

16. POWERS OF AUDITORS U.K.

16.1. Auditors carrying out monitoring activities shall be provided with sufficient authority to obtain the information necessary to carry out their tasks. U.K.

16.2. Auditors shall carry a proof of identity authorising compliance monitoring activities on behalf of the appropriate authority and allowing access to all areas required. U.K.

16.3. Auditors shall be entitled to: U.K.

(a)

obtain immediate access to all relevant areas including aircraft and buildings for monitoring purposes; and

(b)

require the correct implementation or repetition of the security measures.

16.4. As a consequence of the powers conferred on auditors, the appropriate authority shall act in accordance with point 2.3 in the following cases: U.K.

(a)

intentional obstruction or impediment of an auditor;

(b)

failure or refusal to supply information requested by an auditor;

(c)

when false or misleading information is supplied to an auditor with intent to deceive; and

(d)

impersonation of an auditor with intent to deceive.

F12 17. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . U.K.

Textual Amendments

F12 Annex 2 point 17-18.3 omitted (31.12.2020) by virtue of The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 38; 2020 c. 1, Sch. 5 para. 1(1)

F12 18. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . U.K.

Appendix I

Elements to be included in the set of directly linked security measures U.K.

The sets of directly linked security measures as referred to in point 7.1 of Annex II shall include the following elements of Annex I to this Regulation and the corresponding provisions in its implementing acts:

For point 1 — Airport security: U.K.

(i)

point 1.1; or

(ii)

point 1.2 (except provisions relating to identification cards and vehicle passes); or

(iii)

point 1.2 (provisions relating to identification cards); or

(iv)

point 1.2 (provisions relating to vehicle passes); or

(v)

point 1.3 and the relevant elements of point 12; or

(vi)

point 1.4; or

(vii)

point 1.5.

For point 2 — Demarcated areas of airports: U.K.

the whole point

For point 3 — Aircraft security: U.K.

(i)

point 3.1; or

(ii)

point 3.2.

For point 4 — Passengers and cabin baggage: U.K.

(i)

point 4.1 and the relevant elements of point 12: or

(ii)

point 4.2; or

(iii)

point 4.3.

For point 5 — Hold baggage: U.K.

(i)

point 5.1 and the relevant elements of point 12; or

(ii)

point 5.2; or

(iii)

point 5.3.

For point 6 — Cargo and mail: U.K.

(i)

all provisions relating to screening and security controls applied by a regulated agent, except as detailed in points (ii) to (v) below; or

(ii)

all provisions relating to security controls applied by known consignors; or

(iii)

all provisions relating to account consignors; or

(iv)

all provisions relating to the transportation of cargo and mail; or

(v)

all provisions relating to the protection of cargo and mail at airports.

For point 7 — Air carrier mail and air carrier materials: U.K.

the whole point

For point 8 — In-flight supplies: U.K.

the whole point

For point 9 — Airport supplies: U.K.

the whole point

For point 10 — In-flight security measures: U.K.

the whole point

For point 11— Staff recruitment and training: U.K.

(i)

all provisions relating to staff recruitment at airport, air carrier or entity; or

(ii)

all provisions relating to staff training at an airport, air carrier or entity.

Appendix II

F13 ... Classification system of compliance U.K.

The following classification of compliance shall apply to assess the implementation of the national civil aviation security programme.

	Security audit	Inspection	Test
Fully compliant
Compliant, but improvement desirable
Not compliant
Not compliant, with serious deficiencies
Not applicable
Not confirmed

Textual Amendments

F13 Word in Annex 2 Appendix 2 heading omitted (31.12.2020) by virtue of The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 39; 2020 c. 1, Sch. 5 para. 1(1)

F14 Appendix III

Textual Amendments

F14 Annex 2 Appendix 3 omitted (31.12.2020) by virtue of The Aviation Security (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/547), regs. 1, 40; 2020 c. 1, Sch. 5 para. 1(1)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .] U.K.