Cyber Resilience in Aviation: From Oversight to Operational Reality

19 February 2026

Cybersecurity in aviation is no longer a theoretical risk discussed in specialist circles. It has become a regulatory priority, an operational requirement, and a strategic responsibility. Recent developments at the European level confirm that oversight is evolving - and aviation organisations must evolve with it.

At the end of January 2026, the European Civil Aviation Conference (ECAC) Study Group on Cyber Security in Civil Aviation (CYBER/54) held its first meeting of the year. The discussions centred on a draft document outlining best practices for conducting aviation cyber security audits and inspections - a direct response to Member States’ requests for clearer oversight guidance raised during the 46^th ECAC Security Forum. The draft focuses on the oversight of cyber security measures designed to protect critical aviation ICT systems and data from threats that could compromise aviation security.

Finalising this guidance is a priority for the study group, while work is progressing on guidance concerning criticality in civil aviation cybersecurity and on shaping a longer-term strategic vision. The message is clear: cybersecurity oversight is becoming more structured, more harmonised, and more demanding.

From Regulation to Implementation: Advanced EASA Part-IS – Implementation

7–10 April 2026 | JAA TO Headquarters (Classroom Course)

Regulatory momentum across Europe is strongly influenced by European Union Aviation Safety Agency Part-IS. For aviation organisations, compliance requires more than awareness - it requires the structured implementation of an Information Security Management System (ISMS). The Advanced EASA Part-IS - Implementation course is designed to support aviation professionals in translating regulatory requirements into operational reality.

The Advanced EASA Part-IS - Implementation course is designed for professionals who need to move beyond regulatory awareness and into structured execution. Rather than approaching Part-IS as a checklist exercise, the course frames it as an organisational transformation: building and embedding an effective Information Security Management System (ISMS) that is proportionate, integrated, and sustainable.

Participants gain a clear understanding of ISMS objectives, the regulatory logic behind Part-IS, and the practical realities of implementation. The programme explores how information security connects with safety and security management, clarifies the distinction between implementation and ongoing operation, and addresses overlaps with related frameworks such as NIS2.

Through detailed examination of Part-IS AR and OR requirements - including AMC and GM - attendees work through realistic implementation pathways, applying learning in discussions and structured exercises tailored to their operational environment.

Refister for Advanced EASA Part-IS – Implementation Course

Building Awareness and Culture: Aviation Cyber Security

17–19 June 2026 | Virtual Course

The Aviation Cyber Security virtual course (17–19 June 2026) addresses this reality by providing a comprehensive introduction to the cyber threat landscape affecting aviation. It places cyber risk within the broader evolution of aviation security, recognising that threat actors continuously adapt their methods. Where physical attacks once dominated security planning, cyber operations now present an attractive alternative for criminals and terrorists seeking disruption, financial gain, or strategic impact.

The course explores how cyber threats manifest in aviation environments, clarifies the distinction between cyber terrorism, cyber attacks, and hacking, and examines the motivations and profiles of potential perpetrators. Participants analyse how attacks may target critical infrastructure and ICT systems, and consider the operational, reputational, and regulatory consequences for organisations and for the industry as a whole. Importantly, the programme does not focus solely on technical vulnerabilities. It addresses legal and regulatory dimensions, reviews international and regional initiatives aimed at strengthening aviation cyber resilience, and encourages reflection on how organisations can move forward in building stronger preventive measures.

Through a combination of expert-led lectures, structured discussions, and practical exercises, participants strengthen their understanding of cyber threats and contribute to the development of a cyber security culture within their organisations. Because sustainable resilience in aviation is not created by technology alone - it requires informed leadership, engaged professionals, and a shared awareness of risk across all levels.

Delivered virtually, the course enables broad participation while maintaining an interactive learning environment, ensuring that aviation professionals worldwide can deepen their understanding of one of the sector’s most pressing challenges.

About JAA TO ✈️

The JAA Training Organisation (JAA TO) is a Dutch non-profit, self-financing organisation and the Associated Body of the European Civil Aviation Conference (ECAC). JAA TO has a history of 50+ years training the aviation industry and national authorities on regulation in the air transport sector. JAA TO is the only Platinum Training Centre of Excellence (TCE) in Europe recognised by the International Civil Aviation Organization (ICAO). JAA TO is an IATA Dangerous Goods CBTA Centre of Excellence, an ACI World Accredited Training Partner, recognized Dutch National Aviation Security Training Centre and a leading member of the EASA Virtual Academy (EVA).

JAA TO schedules more than 300 training courses annually on topics such as safety, security, drones and management. Within the aviation community, JAA TO offers a platform to learn and exchange views on latest regulatory developments. In addition, JAA TO provides advisory services, knowledge solutions, training consultancy and assistance with capacity building for (aviation) training departments.

VISIT JAA TO WEBSITE

Dorothy Uslu

Corporate Communications Representative at JAA Training Organisation