SIST EN 16495:2019

SLOVENSKI STANDARD
01-september-2019
Nadomešča:
SIST EN 16495:2014
Upravljanje zračnega prometa - Varnost informacij za organizacije na področju
dejavnosti civilnega letalstva
Air Traffic Management - Information security for organisations supporting civil aviation
operations
Flugverkehrsmanagement - Informationssicherheit für Organisationen im Bereich der
Zivilluftfahrt
Gestion du trafic aérien - Sécurité de l'information pour les organismes assurant le
soutien des opérations de l'aviation civile
Ta slovenski standard je istoveten z: EN 16495:2019
ICS:
03.220.50 Zračni transport Air transport
35.240.60 Uporabniške rešitve IT v IT applications in transport
prometu
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EN 16495
EUROPEAN STANDARD
NORME EUROPÉENNE
July 2019
EUROPÄISCHE NORM
ICS 03.100.70; 03.220.50; 35.240.60 Supersedes EN 16495:2014
English Version
Air Traffic Management - Information security for
organisations supporting civil aviation operations
Gestion du trafic aérien - Sécurité de l'information pour Flugverkehrsmanagement - Informationssicherheit für
les organismes assurant le soutien des opérations de Organisationen im Bereich der Zivilluftfahrt
l'aviation civile
This European Standard was approved by CEN on 12 May 2019.

CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this
European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references
concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN
member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management
Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and
United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2019 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 16495:2019 E
worldwide for CEN national Members.

Contents Page
European foreword . 7
Introduction . 8
1 Scope . 9
2 Normative references . 9
3 Terms, definitions and abbreviations . 9
3.1 Terms and definitions . 9
3.2 Abbreviations . 10
4 Aviation specific requirements related to EN ISO/IEC 27001:2017 . 11
4.1 Structure of this European Standard . 11
4.2 Refinement of EN ISO/IEC 27001:2017 requirements . 11
5 Information Security policies . 11
5.1 Management direction for Information security . 11
5.1.1 Policies for information security . 11
5.1.2 Review of the policies for information security . 11
6 Organization of information security . 11
6.1 Internal organization . 11
6.1.1 Information security roles and responsibilities . 11
6.1.2 Segregation of duties . 12
6.1.3 Contact with authorities . 12
6.1.4 Contact with special interest groups . 12
6.1.5 Information security in project management . 12
6.2 Mobile devices and teleworking . 12
7 Human resources security . 12
7.1 Prior to employment . 12
7.1.1 Screening . 12
7.1.2 Terms and conditions of employment . 13
7.2 During employment . 13
7.2.1 Management responsibilities . 13
7.2.2 Information security awareness, education and training . 13
7.2.3 Disciplinary process . 13
7.3 Termination and change of employment . 13
8 Asset management . 13
8.1 Responsibility for assets . 13
8.1.1 Inventory of assets . 13
8.1.2 Ownership of assets . 13
8.1.3 Acceptable use of assets . 13
8.1.4 Return of assets . 14
8.2 Information classification . 14
8.2.1 Classification of information . 14
8.2.2 Labelling of information . 14
8.2.3 Handling of assets . 14
8.3 Media Handling . 14
9 Access control . 14
9.1 Business requirement for access control . 14
9.2 User access management . 14
9.2.1 User registration and de-registration . 14
9.2.2 User access provisioning . 15
9.2.3 Management of privileged access rights . 15
9.2.4 Management of secret authentication information of users. 15
9.2.5 Review of user access rights . 15
9.2.6 Removal or adjustment of access rights . 15
9.2.7 Digital Identity Management . 15
9.2.8 Unique representation of entities across organisations . 16
9.3 User responsibilities . 16
9.4 System and application access control . 16
9.4.1 Information access restriction . 16
9.4.2 Secure log-on procedures . 16
9.4.3 Password management system . 16
9.4.4 Use of privileged utility programs . 16
9.4.5 Access control to program source code . 16
9.4.6 Web Application Firewalls . 16
10 Cryptography . 17
10.1 Cryptographic controls . 17
10.1.1 Policy on the use of cryptographic controls . 17
10.1.2 Key management . 17
11 Physical and environmental security . 17
11.1 Secure areas . 17
11.1.1 Physical security perimeter . 17
11.1.2 Physical entry controls . 18
11.1.3 Securing offices, rooms, and facilities . 18
11.1.4 Protecting against external and environmental threats . 18
11.1.5 Working in secure areas . 18
11.1.6 Delivery and loading areas. 18
11.2 Equipment . 18
11.2.1 Equipment siting and protection . 18
11.2.2 Supporting utilities . 18
11.2.3 Cabling security . 18
11.2.4 Equipment maintenance . 18
11.2.5 Removal of assets . 18
11.2.6 Security of equipment and assets off-premises . 18
11.2.7 Secure disposal or re-use of equipment . 18
11.2.8 Unattended user equipment . 18
11.2.9 Clear desk and clear screen policy . 18
12 Operations security. 19
12.1 Operational procedures and responsibilities . 19
12.2 Protection from malware . 19
12.3 Information Back-up . 19
12.4 Logging and monitoring . 19
12.4.1 Event logging . 19
12.4.2 Protection of log information . 19
12.4.3 Administrator and operator logs . 19
12.4.4 Clock synchronisation . 19
12.5 Control of operational software . 19
12.6 Technical Vulnerability Management . 19
12.7 Information systems audit considerations . 19
13 Communications security . 19
13.1 Network security management . 19
13.1.1 Network controls . 19
13.1.2 Security of network services . 20
13.1.3 Segregation in networks . 20
13.2 Information transfer . 20
14 System acquisition, development and maintenance . 20
14.1 Security requirements of information systems . 20
14.1.1 Information Security requirements analysis and specification . 20
14.1.2 Securing application services on public networks . 20
14.1.3 Protecting application services transactions. 20
14.2 Security in development and support processes . 20
14.2.1 Secure development policy . 20
14.2.2 System change control procedures. 20
14.2.3 Technical review of applications after operating platform changes . 20
14.2.4 Restrictions on changes to software packages . 21
14.2.5 Secure system engineering principles . 21
14.2.6 Secure development environment. 21
14.2.7 Outsourced development . 21
14.2.8 System security testing . 21
14.2.9 System acceptance testing . 21
14.3 Test data . 21
15 Supplier relationships . 21
15.1 Information security in supplier relationships. 21
15.1.1 Information security policy for supplier relationships . 21
15.1.2 Addressing security within supplier agreements . 21
15.1.3 Information and communication technology supply chain . 21
15.2 Supplier service delivery management . 21
16 Information security incident management . 22
16.1 Management of information security incidents and improvements . 22
16.1.1 Responsibilities and procedures . 22
16.1.2 Reporting information security events . 22
16.1.3 Reporting information security weaknesses . 22
16.1.4 Assessment of and decision on information security events . 22
16.1.5 Response to information security incidents . 22
16.1.6 Learning from information security incidents . 22
16.1.7 Collection of evidence . 22
17 Information security aspects of business continuity management . 23
17.1 Information security continuity . 23
17.1.1 Planning information security continuity . 23
17.1.2 Implementing information security continuity . 23
17.1.3 Verify, review and evaluate information security continuity . 23
17.1.4 Business continuity planning framework . 24
17.2 Redundancies . 24
18 Compliance . 24
18.1 Compliance with legal and contractual requirements . 24
18.1.1 Identification of applicable legislation and contractual requirements . 24
18.1.2 Intellectual property rights . 24
18.1.3 Protection of records . 24
18.1.4 Privacy and protection of personally identifiable information . 24
18.1.5 Regulation of cryptographic controls . 25
18.2 Information security reviews . 25
18.2.1 Independent review of information security . 25
18.2.2 Compliance with security policies and standards . 25
18.2.3 Technical compliance review . 25
Annex A (informative) Additional guidance related to air traffic management . 26
A.1 Assessment of information security risks . 26
A.1.1 Internal information security risk management . 26
Figure A.1 —Assessment of information security risks . 27
A.2 Interoperability issues of risk assessments . 29
A.2.1 General . 29
A.2.2 Information security risk management for multiple organisations . 29
A.2.3 Alignment of safety and security risk management. 30
A.3 Determining controls . 30
A.4 Levels of trust . 30
A.4.1 Introduction. 30
A.4.2 Scale of trust levels . 31
A.4.3 Classification criteria . 32
A.5 Statement of applicability . 32
A.6 Measurement and auditing of security . 32
Annex B (informative) Implementation examples . 33
B.1 General . 33
Table B.1 —Overview of an example for LoT-O . 33
Figure B.1 —LoT-A versus LoT-O . 34
B.2 Security of information in web applications and web services (LoT-A-WEB) . 34
B.2.1 General . 34
B.2.2 Parameters for the Level of Trust of a web application/web service . 34
B.2.3 Determination of the web application / the web service (LoT-A-WEB) . 34
Table B.2 —Level of Trust of the web application/the web service . 35
B.2.4 Consequences . 35
Table B.3 —Evaluation Criteria for LoT-A-WEB . 35
B.3 Connections between multiple organisations/external connections (LoT-A-NET) . 35
B.3.1 Determination of the necessary protection controls. 35
B.3.1.1 General . 35
Figure B.2 —Process for implementation of external connection protection . 36
B.3.1.2 Identity of the User . 36
B.3.1.3 Owner of the terminal device . 37
B.3.1.4 Connection point/Protection of the terminal device . 37
B.3.1.5 Authentication of the connection. 37
B.3.1.6 Transfer net . 38
Table B.4 —Maximum Level of Trust depending on the respective technical parameters . 38
B.3.2 Effects of the coupling of networks . 40
B.4 Certificates/Public Key Infrastructure (LoT-A-PKI) . 41
B.4.1 Parameters for the Level of Trust of the certificate management . 41
B.4.2 Determination of the Level of Trust of the certificate management (LoT-A-PKI) . 41
Table B.5 —Trust of identity management . 41
B.4.3 Effects: Recognition of Certificates/PKI . 41
B.5 Identity Management (LoT-A-IDM) . 42
B.5.1 Parameters for the Level of Trust of Identity Management . 42
B.5.2 Determination of the Level of Trust of the Identity Management (LoT-A-IDM) . 42
Table B.6 —Level of Trust of the Identity Management . 43
B.5.3 Effects: Recognition of identities . 43
Annex C (informative) Level of trust — Implementation Example . 44
Table C.1 —Further security controls appropriate to different levels of trust . 44
Annex D (informative) Application of Controls in Regulatory Oversight — Implementation
Example . 58
Figure D.1 —Oversight scheme . 59
Table D.1 — Mapping of Controls . 59
Annex E (informativ) Guidance on aviation specific transorganisational aspects . 63
Bibliography . 64

European foreword
This document (EN 16495:2019) has been prepared by Technical Committee CEN/TC 377 “Air Traffic
Management”, the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by January 2020, and conflicting national standards shall
be withdrawn at the latest by January 2020.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN 16495:2014.
In comparison with the previous edition, the following technical modifications have been made:
— adaptation to the structures of EN ISO/IEC 27002:2017 and ISO/IEC 27009:2016;
— guidance on alignment of safety and security management;
— guidance on Information Security specific to development and production and maintenance;
— guidance on information security assurance;
— informative Annex D “Application of Controls in Regulatory Oversight — Implementation Example”;
— informative Annex E “Guidance on aviation specific transorganisational aspects”.
According to the CEN-CENELEC Internal Regulations, the national standards organisations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the
United Kingdom.
Introduction
This document provides guiding principles based on EN ISO/IEC 27002:2017 “Code of practice for
information security controls” applied to security management systems in aviation organisations. The
aim of this document is to extend the contents of EN ISO/IEC 27002:2017 to the domain of air traffic
management, thus allowing aviation organisations to implement a standardized and specific
information security management system (ISMS), that is in accordance with EN ISO/IEC 27001:2017
transorganisational aspects of air traffic management.
In addition to the security objectives and measures that are set forth in EN ISO/IEC 27001:2017,
aviation organisations are subject to further special requirements: Service delivery in aviation is greatly
defined by the cooperation of the individual participants. An organization’s information security
management is therefore dependent on the information security management of the organisations with
which it cooperates to deliver service. This document therefore focuses on aspects of cooperation.
This cooperation requires
— sharing the results of risk assessments along the business process chain;
— agreement on the required level of trust;
— agreement on the required security controls and their implementation.
1 Scope
This document provides guidance based on EN ISO/IEC 27002:2017 applied to organisations
supporting civil aviation, with a focus on air traffic management operations.
This includes, but is not limited to, airspace users, airports and air navigation service providers.
Not included are activities of the organisations that do not have any impact on the security of civil
aviation operations like for example airport retail and service business and corporate real estate
management.
The basis of all guidance in this document is trust and cooperation between the parties involved in Air
Traffic Management.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 27000:2018, Information technology — Security techniques — Information security
management systems — Overview and vocabulary
EN ISO/IEC 27001:2017, Information technology — Security techniques — Information security
management systems — Requirements
EN ISO/IEC 27002:2017, Information technology — Security techniques — Code of practice for
information security controls
3 Terms, definitions and abbreviations
3.1 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 27000:2018 and the
following apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http://www.electropedia.org/
— ISO Online browsing platform: available at http://www.iso.org/obp
3.1.1
air traffic management
functional system comprised of an aggregation of the airborne and ground-based functions (air traffic
services, airspace management and air traffic flow management) required to ensure the safe and
efficient movement of aircraft during all phases of operations and covering responsibilities of all
partners of the air traffic transport value chain
3.1.2
trust
situation where one party is willing to rely on the actions of another party
Note 1 to entry: Trust is more than what can be achieved by assurance. However, assurance represents a
supporting instrument to trust building.
3.1.3
transorganisational process
process between several organisations that interact as interested parties between each other
3.1.4
functional system
combination of systems, procedures and human resources organised to perform a function within the
context of ATM
[SOURCE: COMMISSION REGULATION (EC) No 2096/2005, Article 2]
3.2 Abbreviations
API Application Programming Interface
ATM Air Traffic Management
CA Certification Authority
Ch. Chapter
CP Certificate Policy
CPS Certificate Practice Statement
CS Certificate Service
cts Client-to-site VPN
DIM Digital Identity Management
HTTP HyperText Transfer Protocol
HTTPS HyperText Transfer Protocol Secure
ICAO International Civial Aviation Authority
IDM Identity Management
ISDN Integrated Services Digital Network
ITU International Telecommunication Union
LDAP Lightweight Directory Access Protocol
LoT-A Level of Trust for the Application Area
LoT-O Level of Trust of the Organization
PKI Public Key Infrastructure
PPr Partner network, protected
PPu Partner network, public
PSTN Public Switched Telephone Network
PuP Public, unprotected
PuP Public, protected
SQL Structured Query Language
sts Site-to-site VPN
u Unencrypted
v Encrypted
XSS Cross-Site Scripting
4 Aviation specific requirements related to EN ISO/IEC 27001:2017
4.1 Structure of this European Standard
This European Standard is structured in line with EN ISO/IEC 27009.
Guidance on additional aviation specific controls and concepts in relation to the global public key
infrastructures are included in Annex E.
4.2 Refinement of EN ISO/IEC 27001:2017 requirements
All requirements from EN ISO/IEC 27001:2017 that do not appear below apply unchanged
EN ISO/IEC 27001:2017, 6.1.3 c) is refined as follows:
Compare the controls determined in 6.1.3 b) above with those in EN ISO/IEC 27001:2017, Annex A and
with Annex A of this document to verity that no necessary controls have been omitted.
EN ISO/IEC 27001:2017, 6.1.3 d) is refined as follows.
Produce a Statement of Applicability that contains:
— the necessary controls [see EN ISO/IEC 27001:2017, 6.1.3 b) and c)];
— a justification for their inclusion;
— whether the necessary controls are implemented or not; and
— a justification for excluding any of the controls in EN ISO/IEC 27001:2017, Annex A or Annex A of
this document.
NOTE These refinements are necessary due to the introduction of new sector-specific controls in this
document.
5 Information Security policies
5.1 Management direction for Information security
5.1.1 Policies for information security
Additional Implementation guidance for EN ISO/IEC 27002:2017, 5.1.1
The policies for information security should be coordinated with the various security requirements in
other areas of aviation (e.g.: physical security of secure areas). The distinctions and mutual
dependencies between the individual areas should be documented in the policies or in separate
documents.
5.1.2 Review of the policies for information security
No additional information specific to aviation organisations for EN ISO/IEC 27002:2017, 5.1.2.
6 Organization of information security
6.1 Internal organization
6.1.1 Information security roles and responsibilities
Additional Implementation guidance for EN ISO/IEC 27002:2017, 6.1.1
The organization should appoint a person responsible to serve as a point of contact for strategic
information security issues for third parties (e.g. for the planning and implementation of joint
measures, etc.).
6.1.2 Segregation of duties
No additional information specific to aviation organisations for EN ISO/IEC 27002:2017, 6.1.2.
6.1.3 Contact with authorities
Additional Implementation guidance for EN ISO/IEC 27002:2017, 6.1.3
The organization should cooperate with the appropriate specialist and supervisory authorities,
particularly in the areas of IT security and prosecution, and with other critical infrastructures as well.
This includes contacts to authorities involved in critical infrastructure protection at the national and
European level.
6.1.4 Contact with special interest groups
Additional Implementation guidance for EN ISO/IEC 27002:2017, 6.1.4
The organization should establish an interface to other organisations.
Contacts should also consider the needs and expectations of interested parties, in particular
organisations with which the organization shares information security risks in terms of the creation or
contribution to aviation safety hazards and the management thereof.
The establishment of formal interfaces to critical organisations should be considered.
The organization should also be aware of the criticality of its services at a regional, national and
international level. It may therefore participate in associations and alliances as well as national and
international programs to provide comprehensive support to air safety.
Given the special nature of threats to air traffic, the organization may need to cooperate with other
aviation organisations to present an agreed position. Such a position should form the basis for the
selection of adequate, preventive and reactive measures:
— ensuring the interoperability of the
...