DO-326A / ED-202B and CS 25.1319: avionics cybersecurity

Hugues Orgitello updated 7 Oct 2026 12 min read

In Europe, airworthiness security has been a written certification specification since 1 January 2021, when EASA ED Decision 2020/006/R added CS 25.1319 and its equivalents for rotorcraft, engines, propellers, APUs and ETSO articles, with AMC 20-42 pointing to ED-202A / DO-326A, ED-203A / DO-356 and ED-204 / DO-355. The United States has not caught up: the FAA still uses project-specific special conditions and only proposed a 14 CFR 25.1319 in August 2024. Meanwhile the documents moved on, with DO-326B / ED-202B published in 2024, and the EU added an organisation layer, Part-IS, applicable to design and production organisations from 16 October 2025 and to operators, maintenance organisations and ATM/ANS providers from 22 February 2026. This guide maps what each text requires, with dates taken from the catalogues and the official journals, and lists the common readings those texts contradict.

TL;DR: DO-326A / ED-202A (process), DO-356A / ED-203A (methods) and DO-355A / ED-204A (continuing airworthiness) are means of compliance, not rules. EASA made airworthiness security a certification specification in 2020 (applicable 2021), not in 2024. The FAA rule is still a proposal from August 2024. Revision B of DO-326 / ED-202 exists since 2024. Part-IS applies to organisations, with a 72-hour report to the competent authority for incidents and vulnerabilities that may represent a significant risk to aviation safety.

The document set and its editions

RTCA SC-216 and EUROCAE WG-72 develop the documents jointly. The SC-216 terms of reference (Rev 20, December 16, 2025) list the equivalences below; dates come from the EUROCAE catalogue, from AMC 20-42 and from RTCA records.

RTCA	EUROCAE	Title	Current edition and date
DO-326B	ED-202B	Airworthiness Security Process Specification	ED-202B October 2024; DO-326B approved by the RTCA PMC on September 26, 2024
DO-326A	ED-202A	Airworthiness Security Process Specification	DO-326A August 2014; ED-202A 2014 (catalogue date May 30, 2014; AMC 20-42 says June 2014), superseded by ED-202B
DO-356A	ED-203A	Airworthiness Security Methods and Considerations	June 2018 (ED-203 first edition August 2015)
DO-355A	ED-204A	Information Security Guidance for Continuing Airworthiness	ED-204A September 13, 2020 (ED-204 first edition May 2014)
DO-391	ED-201A	Aeronautical Information System Security Framework Guidance
DO-392	ED-206	Guidance on Information Security Event Management
DO-393	ED-205A	Process Standard for Security Certification and Declaration of ATM ANS Ground Systems
RTCA Paper 120-21/PMC-2151	ER-013	Aeronautical Information System Security Glossary

Work in progress listed in the same terms of reference: a supporting-information report for DO-356A, then DO-356B (projected publication March 2029), DO-392A (March 2027), DO-355B (September 2027) and a new information security management system standard. On July 28, 2026, EUROCAE published ER-042, a report answering frequent industry questions on applying ED-202B / DO-326B and ED-203A / DO-356A.

What changed in revision B

EUROCAE lists three changes from ED-202A to ED-202B: improvements to the security process discussion in section 3.5, improvements to the change impact analysis discussion in section 4, and a new change impact questionnaire in Appendix B. The revision is about how to handle changes to a certified product, not a new process.

Europe: CS 25.1319 and AMC 20-42 since 2021

ED Decision 2020/006/R, Aircraft cybersecurity, was signed on 24 June 2020 and applies from 1 January 2021. It inserted one paragraph in each product code and created AMC 20-42.

Code (amendment)	Paragraph	Scope of the requirement
CS-25 (Amendment 25)	CS 25.1319 + Appendix H25.6 (ICA)	Aeroplane equipment, systems and networks, protected from IUEI that may result in adverse effects on the safety of the aeroplane
CS-29 (Amendment 8)	CS 29.1319 + A29.5 (ICA)	Same wording for large rotorcraft
CS-27 (Amendment 7)	CS 27.1319 + A27.5 (ICA)	Category A rotorcraft only, and only IUEI that may result in catastrophic or hazardous effects
CS-E (Amendment 6)	CS-E 50(l), plus CS-E 20(d) and CS-E 25	Engine control systems, including networks, software and data
CS-P (Amendment 2)	CS-P 230(g)	Propeller control systems
CS-APU (Amendment 1)	CS-APU 90(d)	APU control systems
CS-ETSO (Amendment 15)	Subpart A, 2.6	An ETSO article may be designed with a security assurance level (SAL) for specified security measures, per AMC 20-42
AMC & GM to CS-23 (Issue 3)	GM 23.2500(b)	Guidance only: applicants for certification level 4 aeroplanes should consider cybersecurity threats as sources of improper functioning
AMC-20 (Amendment 18)	AMC 20-42	Airworthiness information security risk assessment

CS 25.1319 has two sentences of substance: the security risks must be "identified, assessed and mitigated as necessary", and the applicant must make procedures and Instructions for Continued Airworthiness available so that the protections are maintained. The AMC to CS 25.1319 adds that the scope is limited to effects on the safety of the aeroplane: a device that processes passenger credit cards is a business matter for the operator, not a certification item.

AMC 20-42, section by section

Section	Content
1 Purpose	Recognises ED-202A / DO-326A, ED-203A / DO-356 and ED-204 / DO-355 as an acceptable means, not the only means; credit for products developed with earlier versions may be discussed with EASA
2 Applicability	New type certificates, supplemental type certificates, changes to products, ETSO articles (with security measures that may carry a SAL), and other systems whose certification is required by national regulation
4 General principles	Assess any IUEI threat and vulnerability that could result in an unsafe condition; mitigate; provide the means of mitigation to operators in a timely manner
5 PISRA	Product information security risk assessment: security environment, assets, attack paths, safety consequences, level of threat, acceptability of the risk (severity combined with potentiality of attack), mitigation and iteration. The Security Risk Assessment process of ED-202A section 2.1.1 is an acceptable means
6 Risk acceptability	Context-dependent: a threat condition with a major safety effect, as defined in CS xx.1309, may be unacceptable for a CS-25 product and acceptable for a CS-29 product
7 Reporting	Operators report security occurrences to the designer or TC/STC holder; the designer reports potential unsafe conditions to the authority (point 21.A.3A of Part 21)
8 Validation and verification	Analysis, security-oriented robustness testing, inspections and reviews; security testing from the perspective of a potential adversary when necessary
9 Continued protection	ICA covering assets and protection mechanisms (physical and operational procedures, monitoring, key management); assessment of new threats after entry into service
10 Definitions	Terminology of EUROCAE ER-013

The same decision amended Appendix A to GM 21.A.91 (classification of changes): a change that creates a new digital communication means between a more closed security domain and a more open one, for example between the aircraft control domain and the airline information services domain, is an example of a major change. A new simplex link (ARINC 429 is the example given) towards a more open domain is not, if it has been verified that it cannot be reversed by any known IUEI.

United States: special conditions and the 2024 proposal

The FAA has handled aircraft cybersecurity through special conditions under 14 CFR 21.16. An early example is Special Conditions 25-357-SC for the Boeing 787-8 (72 FR 73582, December 28, 2007), on protecting aeroplane systems and data networks from unauthorized external access. A September 2023 FAA TSO workshop presentation states that special conditions are established on the basis of policy statement PS-AIR-21.16-02 Rev 2 and that a PSecAC and PSecAC Summary are required for TSO approval when the cybersecurity requirement applies.

On August 21, 2024, the FAA published a notice of proposed rulemaking (89 FR 67564, docket FAA-2024-1398, RIN 2120-AL94). Comments closed on October 21, 2024. As of October 2026, the Federal Register shows no final rule and the eCFR has no § 25.1319.

Proposed section	Product	Content
§ 25.1319	Transport category aeroplanes	Protect equipment, systems and networks from IUEI; identify, assess and mitigate the security risks; provide procedures and ICA
§ 33.28(n) + Appendix A a33.3(a)(10)	Engines	Same for engine control, monitoring and auxiliary systems; ICA for transfer of software and data
§ 35.23(f) + Appendix A a35.3(a)(10)	Propellers	Same for propeller control systems
Parts 23, 27, 29	Small aeroplanes, rotorcraft	No new rule proposed: the FAA states that §§ 23.2500 to 23.2510, 27.1301/1309 and 29.1301/1309 suffice

The NPRM explains that the text follows the ASISP working group of the Aviation Rulemaking Advisory Committee (report of 2016) and the special conditions already issued, and announces a draft AC 20-XXX, Aircraft Systems Information Security/Protection, as guidance for §§ 25.1319, 33.28(n) and 35.23(f).

On the operator side, AC 119-1A (September 28, 2023) replaced AC 119-1 of September 30, 2015. It covers the Aircraft Network Security Program (ANSP) authorised through OpSpec D301 for parts 121, 121/135, 125 and 129 operators of aircraft certificated with a cybersecurity special condition, and states that the current edition of DO-355 is an acceptable alternative to its content.

Part-IS: the organisation layer in the EU

DO-326A and CS 25.1319 apply to a type design. Part-IS applies to the organisations around it, with the same structure in both regulations.

Regulation	Organisations	Applies from
Delegated Regulation (EU) 2022/1645 (Part-IS.D.OR)	Design and production organisations (Part 21 Subparts J and G, new points 21.A.239A and 21.A.139A), except those solely involved in ELA2 aircraft; aerodrome operators and apron management service providers	16 October 2025
Implementing Regulation (EU) 2023/203 (Part-IS.I.OR, Part-IS.AR)	Part-145 and CAMO (except Part-ML only), air operators (with exemptions for ELA2 and small VFR-day operations), approved training organisations, aero-medical centres, FSTD operators, ATCO training organisations, ATM/ANS providers, U-space providers, competent authorities	22 February 2026 (1 January 2026 for the EGNOS air navigation service provider)

The requirement points run from IS.D.OR.200 (information security management system) through 205 (risk assessment), 210 (risk treatment), 215 (internal reporting), 220 (incident detection, response and recovery), 230 (external reporting), 235 (contracting), 240 (personnel), 245 (record-keeping), 250 (manual), 255 (changes) and 260 (continuous improvement). Under point 230, an incident or vulnerability that may represent a significant risk to aviation safety is notified as soon as it is known, and a report follows as soon as possible and within 72 hours, to the competent authority and, when an aircraft or component is affected, to the design approval holder.

Process and safety assessment

DO-326A works at aircraft and system level, alongside the development and safety assessment processes now described in ARP4754B and ARP4761A (both 2023), and above DO-178C and DO-254. AMC 20-42 ties the two worlds together through the severity classes of CS xx.1309: a threat condition is assessed by its safety effect, and the risk combines that severity with the level of threat. The security measures that come out of the assessment then become requirements for software and hardware developed under DO-178C and DO-254.

The deliverables are named in the documents themselves, which are sold by RTCA and EUROCAE. The public texts confirm two of them: the PSecAC (Plan for Security Aspects of Certification) and the PSecAC Summary, required for FAA TSO approval when cybersecurity applies, and the PISRA of AMC 20-42 on the EASA side. For the full list of data items and objectives, read DO-326B / ED-202B itself.

For the safety side that DO-326A interfaces with, see DO-178C and DO-254 and the broader risk assessment framework in ISO 14971, IEC 31010, FMEA, FTA.

DO-326A and ISO 27001 are not interchangeable

ISO/IEC 27001 certifies an organisation's information security management system. DO-326A produces evidence on a specific type design. A supplier with ISO 27001 on its corporate IT has not met any DO-326A objective on an aircraft programme, and DO-326A compliance says nothing about the supplier's IT. Part-IS sits between the two: it is an organisation requirement, but limited to information security risks with a potential impact on aviation safety.

For enterprise cybersecurity baselines, see CMMC and UK Cyber Essentials.

Claims the texts contradict

Common claim	What the texts say
"CS 25.1319 was introduced by CS-25 Amendment 25/29 in August 2024" (made by an earlier version of this page)	CS 25.1319 was inserted by CS-25 Amendment 25, ED Decision 2020/006/R of 24 June 2020, applicable from 1 January 2021
"14 CFR 25.1319 has been in force since 2024"	The FAA only proposed § 25.1319 on August 21, 2024; no final rule is published and the eCFR has no such section
"Part 29 carries an equivalent FAA provision for rotorcraft"	The NPRM covers parts 25, 33 and 35 only and states that existing part 23, 27 and 29 rules suffice. The rotorcraft paragraphs (CS 27.1319, CS 29.1319) are EASA ones
"Engines are covered only through the airframe"	CS-E 50(l) (EASA) and proposed § 33.28(n) (FAA) address engine control systems directly
"DO-326A is the current edition"	DO-326B / ED-202B were published in 2024; EUROCAE states that ED-202B supersedes ED-202A
"DO-392 / ED-205A covers ATM/ANS ground systems"	DO-392 / ED-206 is Information Security Event Management. Ground systems are DO-393 / ED-205A
"ED-204A was revised in 2022"	ED-204A is dated September 13, 2020 in the EUROCAE catalogue
"EASA used CRI F-19 for airworthiness security"	Not found in any EASA text consulted. The FAA NPRM says EASA, like the FAA, used special conditions before 2020
"DO-356A scores attackers on four tiers: basic, enhanced, high, extended"	Not in any public text. AMC 20-42 speaks of level of threat and potentiality of attack; ED-203A itself is the reference for the method
"CS-23 aeroplanes are handled by special conditions"	GM 23.2500(b) refers certification level 4 aeroplanes to AMC 20-42 under the existing CS 23.2500(b)
"AC 119-1 is the operator guidance"	AC 119-1 (2015) was cancelled by AC 119-1A of September 28, 2023

Frequent pitfalls

Pitfall	What to check
Assuming the FAA basis equals the EASA basis	Until a final rule, the FAA basis is a project special condition; EASA applies CS xx.1319 from the code amendment in your basis
Citing DO-326A in a new plan without checking revision B	ED-202B supersedes ED-202A; AMC 20-42 as issued names ED-202A, so agree the revision with the authority
Treating a new data link as a minor change	Appendix A to GM 21.A.91 gives a new link from a closed to an open security domain as an example of a major change
Forgetting the ICA	CS 25.1319(b) and Appendix H25.6 require procedures and ICA to maintain the protections
Confusing product and organisation requirements	DO-326A and CS 25.1319 cover the design; Part-IS covers the organisation, with a 72-hour report deadline
Ignoring the threat after entry into service	AMC 20-42 section 9 asks the applicant to assess new threats and notify operators and the authority

Going further

• DO-178C and DO-254, airborne software and hardware: the software and hardware assurance that receives the security requirements
• Risk management, ISO 14971, IEC 31010, FMEA, FTA: the broader risk-assessment families
• CMMC and UK Cyber Essentials: corporate cybersecurity baselines, distinct from product airworthiness security
• Glossary: definitions of the acronyms used on this page

See also

• DO-178C and DO-254: avionics software and hardware
• IEC 62443 (ISA-99), industrial control cybersecurity
• Common Criteria (ISO/IEC 15408): IT security eval
• Cyber Resilience Act (CRA): EU baseline for digital
• MIL-STD-461 and MIL-STD-464, defense EMC standards
• AEC-Q100, Q101, Q200: automotive component qualification
• IATF 16949: automotive quality management
• ISO 26262: automotive functional safety
• ISO/SAE 21434 and UN R155/R156: automotive cybersecurity

Working on DO-326A and ED-202A airworthiness security process for an avionics programme under CS 25.1319 or 14 CFR Part 25 for a real product? AESTECHNO can audit your design and certification plan. Get in touch

A 30-minute audit with AESTECHNO engineers.

AESTECHNO is the electronics design house that edits spilma. We help product teams scope their certification effort and avoid the common mistakes.

Book a free audit

Sources & references

1. EUROCAE ED-202B, Airworthiness Security Process Specification (October 2024, supersedes ED-202A), EUROCAE www.eurocae.net/product/ed-202b-airworthiness-security-process-specification/
2. EUROCAE ED-202A, Airworthiness Security Process Specification (catalogue entry, 2014), EUROCAE www.eurocae.net/product/ed-202a-airworthiness-security-process-specification/
3. EUROCAE ED-203A, Airworthiness Security Methods and Considerations (June 2018), EUROCAE www.eurocae.net/product/ed-203a-airworthiness-security-methods-and-considerations/
4. EUROCAE ED-204A, Information Security Guidance for Continuing Airworthiness (September 2020), EUROCAE www.eurocae.net/product/ed-204a-information-security-guidance-for-continuing-airworthiness/
5. EUROCAE ER-042, Discussions related to Aeronautical Information System Security (AISS) Standards (July 2026), EUROCAE www.eurocae.net/new-publication-er-042-discussions-related-to-aeronautical-information-system-security-aiss-standards/
6. RTCA, Security standards: DO-326A/B, DO-355A, DO-356A, DO-391, DO-392, DO-393, RTCA www.rtca.org/security/
7. RTCA PMC meeting summary of September 26, 2024 (approval of DO-326B), RTCA www.rtca.org/wp-content/uploads/2024/12/2-A-PMC-Summary-2024-09-26_Final.pdf
8. RTCA SC-216 Terms of Reference, Rev 20 (December 16, 2025), RTCA www.rtca.org/wp-content/uploads/2026/01/SC-216-TOR-Rev-20-Approved-2025-12-16.pdf
9. EASA ED Decision 2020/006/R, Aircraft cybersecurity (CS-25 Amendment 25, CS-27 Amendment 7, CS-29 Amendment 8, CS-E Amendment 6, CS-P Amendment 2, AMC-20 Amendment 18), EASA www.easa.europa.eu/en/document-library/agency-decisions/ed-decision-2020006r
10. EASA AMC-20 Amendment 18, change information (AMC 20-42 Airworthiness information security risk assessment), EASA www.easa.europa.eu/en/downloads/116276/en
11. EASA CS-25 Amendment 25, change information (CS 25.1319 and Appendix H25.6), EASA www.easa.europa.eu/en/downloads/116280/en
12. Commission Delegated Regulation (EU) 2022/1645 (Part-IS.D.OR, applies from 16 October 2025), Official Journal of the European Union eur-lex.europa.eu/eli/reg_del/2022/1645/oj
13. Commission Implementing Regulation (EU) 2023/203 (Part-IS.I.OR and Part-IS.AR, applies from 22 February 2026), Official Journal of the European Union eur-lex.europa.eu/eli/reg_impl/2023/203/oj
14. FAA NPRM, Equipment, Systems, and Network Information Security Protection, 89 FR 67564 (August 21, 2024), Federal Register www.federalregister.gov/documents/2024/08/21/2024-17916/equipment-systems-and-network-information-security-protection
15. FAA Special Conditions 25-357-SC, Boeing Model 787-8, Systems and Data Networks Security, 72 FR 73582 (December 28, 2007), Federal Register www.federalregister.gov/documents/2007/12/28/E7-25075/special-conditions-boeing-model-787-8-airplane-systems-and-data-networks-security-protection-of
16. FAA AC 119-1A, Operational Authorization of Aircraft Network Security Program (September 28, 2023), Federal Aviation Administration www.faa.gov/documentLibrary/media/Advisory_Circular/AC_119-1A.pdf
17. FAA, TSO Cybersecurity: Aircraft Systems Information Security Protection (ASISP), TSO workshop presentation (September 21, 2023), Federal Aviation Administration www.faa.gov/aircraft/air_cert/design_approvals/dah/cybersecurity
18. SAE ARP4754B, Guidelines for Development of Civil Aircraft and Systems (2023), SAE International www.sae.org/standards/content/arp4754b/
19. SAE ARP4761A, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems (2023), SAE International www.sae.org/standards/content/arp4761a/