Commission Implementing Regulation (EU) 2019/1583 of 25 September 2019 amending Implementing Regulation (EU) 2015/1998 laying down detailed measures for the implementation of the common basic standards on aviation security, as regards cybersecurity measures (Text with EEA relevance) (c. 1583)

Commission Implementing Regulation (EU) 2019/1583

of 25 September 2019

amending Implementing Regulation (EU) 2015/1998 laying down detailed measures for the implementation of the common basic standards on aviation security, as regards cybersecurity measures

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002(1), and in particular Articles 1 and 4(3) thereof,

Whereas:

(1) One of the main objectives of Regulation (EC) No 300/2008 is to provide the basis for a common interpretation of Annex 17 (Security Annex) of the Convention on International Civil Aviation(2) of 7 December 1944, 10th edition, 2017 to which all the EU Member States are signatories.

(2) The means of achieving the objectives are (a) the setting of common rules and common basic standards on aviation security and (b) mechanisms for monitoring compliance.

(3) The purpose for amending the implementing legislation is to support Member States in ensuring full compliance with the most recent amendment (Amendment 16) to Annex 17 of the Convention on International Civil Aviation, which introduced new standards under chapters 3.1.4 related to national organisation and appropriate authority and 4.9.1 related to preventive cybersecurity measures.

(4) By transposing these standards into the implementing EU wide aviation security legislation, it will be ensured that appropriate authorities establish and implement procedures to share, as appropriate and in a practical and timely manner, relevant information to assist other national authorities and agencies, airport operators, air carriers and other entities concerned, to conduct effective security risk assessments relating to their operations and in that way support these entities in conducting effective security risk assessments related to, among other areas, cybersecurity and implement measures addressing cyber threats.

(5) Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union (NIS Directive) lays down measures with a view to achieving a high common level of security of network and information systems within the Union(3) so as to improve the functioning of the internal market. Measures stemming from the NIS Directive and this Regulation should be coordinated at national levels to avoid gaps and duplications of obligations.

(6) Commission Implementing Regulation (EU) 2015/1998(4) should therefore be amended accordingly.

(7) The measures provided for in this Regulation are in accordance with the opinion of the Committee on Civil Aviation Security set up pursuant to Article 19(1) of Regulation (EC) No 300/2008,

HAS ADOPTED THIS REGULATION:

Article 1 U.K.

The Annex to Implementing Regulation (EU) 2015/1998 is amended in accordance with the Annex to this Regulation.

Article 2 U.K.

This Regulation shall enter into force on 31 December 2020.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 25 September 2019.

For the Commission

The President

Jean-Claude Juncker

ANNEX U.K.

The Annex to Implementing Regulation (EU) 2015/1998 is amended as follows:

(1)

The following point 1.0.6 is added:

‘1.0.6. The appropriate authority shall establish and implement procedures to share, as appropriate and in a practical and timely manner, relevant information to assist other national authorities and agencies, airport operators, air carriers and other entities concerned, to conduct effective security risk assessments relating to their operations.’;

(2)

The following point 1.7 is added:

‘1.7 IDENTIFICATION AND PROTECTION OF CIVIL AVIATION CRITICAL INFORMATION AND COMMUNICATION TECHNOLOGY SYSTEMS AND DATA FROM CYBER THREATS

1.7.1. The appropriate authority shall ensure that airport operators, air carriers and entities as defined in the national civil aviation security programme identify and protect their critical information and communications technology systems and data from cyber-attacks which could affect the security of civil aviation.

1.7.2. Airport operators, air carriers and entities shall identify in their security programme, or any relevant document cross-referenced in the security programme, the critical information and communications technology systems and data described in 1.7.1.

The security programme, or any relevant document cross-referenced in the security programme shall detail the measures to ensure the protection from, detection of, response to and recovery from cyber-attacks, as described in 1.7.1.

1.7.3. The detailed measures to protect such systems and data from unlawful interference shall be identified, developed and implemented in accordance with a risk assessment carried out by the airport operator, air carrier or entity as appropriate.

1.7.4. Where a specific authority or agency is competent for measures related to cyber threats within a single Member State, this authority or agency may be designated as competent for the coordination and/or monitoring of the cyber-related provisions in this Regulation.

1.7.5. Where airport operators, air carriers and entities as defined in the national civil aviation security programme are subjected to separate cybersecurity requirements arising from other EU or national legislation, the appropriate authority may replace compliance with the requirements of this regulation by compliance with the elements contained in the other EU or national legislation. The appropriate authority shall coordinate with any other relevant competent authorities to ensure coordinated or compatible oversight regimes.’;

(3)

Point 11.1.2 is replaced by the following:

‘11.1.2. The following personnel shall have successfully completed an enhanced or a standard background check:

a)

Persons being recruited to implement, or to be responsible for the implementation of, screening, access control or other security controls elsewhere than a security restricted area;

b)

Persons having unescorted access to air cargo and mail, air carrier mail and air carrier material, in-flight supplies and airport supplies to which the required security controls have been applied;

c)

Persons having administrator rights or unsupervised and unlimited access to critical information and communications technology systems and data used for civil aviation security purposes as described in 1.7.1 in accordance with the national aviation security programme, or having been otherwise identified in the risk assessment in accordance with 1.7.3.

Unless otherwise specified in this Regulation, whether an enhanced or a standard background check has to be completed shall be determined by the appropriate authority in accordance with applicable national rules.’;

(4)

The following point 11.2.8 is added:

‘11.2.8. Training of persons with roles and responsibility related to cyber threats

11.2.8.1. Persons implementing the measures as laid down in point 1.7.2 shall have the skills and aptitudes required to carry out their designated tasks effectively. They shall be made aware of relevant cyber risks on a need-to-know basis.

11.2.8.2. Persons having access to data or systems shall receive appropriate and specific job related training commensurate with their role and responsibilities, including being made aware of relevant risks where their job function requires this. The appropriate authority, or the authority or agency as laid down in point 1.7.4 shall specify or approve the content of the course.’.

(1)

OJ L 97, 9.4.2008, p. 72.

(2)

https://icao.int/publications/pages/doc7300.aspx

(3)

Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

(4)

Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of the common basic standards on aviation security (OJ L 299, 14.11.2015, p. 1).