Attackers use the common routes: a phished login, a vulnerable gateway, a supplier with access. In aviation and transport, those routes end at shared check-in, baggage and operations systems, and at several authorities that each want to hear in their own time.
After a cyber incident that touches aviation operations.
Phishing, a stolen password, a vulnerable gateway.
Not only domain administrators. Staff who run departure control, flight operations and terminal systems, and the supplier accounts that support them.
Check-in, baggage, boarding and cargo systems, often run by a supplier for several airlines or terminals at once.
8%of all events in the EU in 2025 were in the transport sector, and 8% of events with significant impact under NIS2 (ENISA Threat Landscape 2026, EU scope)Passengers and freight pile up within hours. Whether the operation continues depends on a manual fallback that has been tested, and on public services that stay up under attack.
The GCAA aviation security regulation asks operators to identify their critical IT systems and report incidents. Its cyber guidelines add the reporting steps. Ships and EU-approved organizations answer to other rules.
GCAA CAR Part VII, Article 4.9.1: airport operators, aircraft operators and air traffic service providers must identify their critical information and communications systems and data, and protect them from unlawful interference. Article 5.1.6 asks for timely incident reports.
IMO Resolution MSC.428(98) encourages administrations to make sure cyber risks are addressed in safety management systems, no later than the first annual verification of the company’s Document of Compliance after 1 January 2021.
EU Part-IS covers air operators, maintenance and continuing airworthiness organizations, training organizations and air navigation service providers, among others. Regulation 2023/203 applies from 22 February 2026. It matters to UAE firms that hold EU approvals.
Edition 05, Revision 1. Article 4.9.1 asks for a list of critical ICT systems and data and their protection. Article 5.1.6 asks for timely incident reporting.
Read the sourceVersion 1. A living guidance document for UAE aviation stakeholders, with examples of critical systems and the reporting steps.
Read the sourceThe international standard on cybersecurity for civil aviation security. ICAO also cites Recommended Practice 4.9.2.
Read the sourceEncourages cyber risk to be addressed in ship safety management systems under the ISM Code.
Read the sourceInformation security risk management for EU-approved aviation organizations, with 72 hour reporting. Context for UAE firms with EU approvals.
Read the sourceSource: UAE GCAA, CAR Part VII and the National Civil Aviation Cybersecurity Guidelines; IMO, MSC.428(98); EU Implementing Regulation 2023/203. This is analysis, not legal advice.
UAE rules, by who you are
Civil aviation has a national cybersecurity policy and GCAA guidelines. Whether a control is binding depends on your role, your approved programme and your registration. Suppliers are often bound by contract, not by the GCAA.
Standard or policyUAE Civil Aviation Cybersecurity Policy and the GCAA National Civil Aviation Cybersecurity Guidelines (September 2024), with the airport security programme.
Assess aviation ICT risk. Identify critical systems and data. Apply least privilege and MFA to critical systems. Use firewalls, cryptography, endpoint protection, monitoring and network separation. Keep awareness, incident response and continuity controls.
Confirm: Check which guideline controls are binding for your operator and programme.
Standard or policyGCAA aviation cybersecurity policy and guidelines, with the aviation safety and security rules for your approval.
Protect flight, maintenance, passenger and operational systems. Run risk assessment and threat modelling. Keep role-based access, network security, anomaly detection, backups and recovery. Reporting duties follow your stakeholder registration.
Standard or policyGCAA policy and guidelines, with approval and programme requirements.
Map operational dependencies and third-party links. Protect safety-relevant data and systems. Set up incident management and continuity.
Regulator ruleGCAA Reporting of Security Breaches (ROSB) mechanism and stakeholder directions.
The GCAA states that ROSB captures mandatory reports from its registered users. Confirm your registration and the reporting procedure.
Confirm: Do not apply this condition to every aviation supplier.
Regulator ruleGCAA national framework, the Dubai airport requirements for your programme, and DESC only where your entity or service is in scope.
Apply the GCAA requirements for your approved programme and role. Confirm any Dubai critical-infrastructure designation and DESC duties separately.
Standard or policyGCAA policy and guidelines, with your licence and approved programme.
Secure operational, maintenance and passenger systems. Keep risk assessment, access control, MFA, network separation, monitoring, training and incident and continuity procedures as they apply.
Contract termCustomer contracts, with GCAA requirements flowed down by the customer.
Not every supplier is a GCAA-regulated stakeholder. Confirm your direct status. Protect remote access and data shared with operators.
Regulator ruleThe Abu Dhabi transport authority requirements that apply to you. UAE IA and CIIP if designated.
Confirm whether your systems support a designated critical service. Protect dispatch, passenger, fare, fleet and control systems. Manage access, monitoring, incident response and recovery as the framework that applies to you requires.
Regulator ruleThe sector licence and authority rules that apply. UAE IA and CIIP if designated.
For OT, keep an asset inventory, network zones, vendor access control, secure changes, vulnerability risk management and recovery plans where your risk framework requires them.
Standard or policyDESC ISR and the transport rules that apply. DESC ICS where critical infrastructure or OT is in scope.
ISR applies to Dubai Government Entities and requires a review of which domains and controls apply. ICS applies to government and semi-government entities that run critical infrastructure or OT.
Standard or policythe DESC security standard for autonomous and connected vehicles, with the transport authority rules that apply.
Intended for Dubai government and semi-government entities that plan to use autonomous vehicles. Confirm its current name and scope with DESC. Apply it where your entity and use case are in scope, and test the vehicle systems and supporting services against the current standard.
Contract termYour licence, customer contracts and the PDPL where it applies. DESC only if in scope.
Private status alone does not bring you under DESC standards. No blanket yearly cyber audit for private logistics firms was identified. Protect telematics, warehouse automation, remote access and customer data, and check what your contracts require.
Regulator ruleCIIP Policy and UAE Information Assurance standard, only where designated.
Apply UAE IA controls and sector directions in addition to aviation rules.
This is analysis, not legal advice. A sector’s presence on a critical-infrastructure list does not make every company in it critical. We state a test or audit frequency only where the binding rule, licence, designation or contract does. Confirm your licence, any designation and the current version of each rule with your counsel.
0of 4 done. Whatever is left is where we start.
The same security decision gets a different answer once shared platforms, physical movement and several authorities are in the picture.
Also the people and supplier accounts that run departure control, baggage and gate systems, and the vendor staff who can reach them remotely.
Standard advice: Domain and cloud administrators.
By the shared platform that stops several airlines or terminals at once, and by who runs it on whose network.
Standard advice: By spend, or by the data they hold.
Check in, board and load with no system for a set period, then restore in an order operations has agreed.
Standard advice: Restore the systems from backup.
Possibly to several, each with its own trigger. Write each trigger down, and name who decides, before an incident.
Standard advice: To one regulator, when the facts are clear.
Public booking and flight information services are common targets of hacktivist traffic. Decide which must stay up and who runs the DDoS plan.
Standard advice: A website problem for IT to fix.
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
Card, privacy, resilience and assurance standards reach a airline or operator through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.
EU Network and Information Security Directive 2
EU air carriers, airports, air traffic control and other transport operators.
Member States had to transpose it by 17 October 2024. In July 2026 the Commission referred four states to the Court of Justice for failing to notify their measures.
Source: European Commission, NIS2 DirectivePayment Card Industry Data Security Standard
Tickets and extras sold by card, online and at the airport.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards CouncilEU General Data Protection Regulation
You have an EU establishment, or sell to and monitor passengers in the EU.
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679AICPA System and Organization Controls 2
Asked of reservation, loyalty and cargo system vendors.
An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.
Source: AICPA, SOC suite of servicesInformation security management systems
A common evidence point for ground-handling and IT suppliers.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001Of EU transport events in 2025 were DDoS claims; 16.3% were unauthorized access (ENISA Threat Landscape 2026, EU scope)
Sources and method. This page is analysis, not legal advice.
