SIST EN 16495:2019

SLOVENSKI STANDARD
oSIST prEN 16495:2018
01-september-2018
8SUDYOMDQMH]UDþQHJDSURPHWD9DUQRVWLQIRUPDFLM]DRUJDQL]DFLMHQDSRGURþMX
GHMDYQRVWLFLYLOQHJDOHWDOVWYD
Air Traffic Management - Information security for organisations supporting civil aviation
operations
Flugverkehrsmanagement - Informationssicherheit für Organisationen im Bereich der
Zivilluftfahrt
Gestion du trafic aérien - Sécurité de l'information pour les organismes assurant le
soutien des opérations de l'aviation civile
Ta slovenski standard je istoveten z: prEN 16495
ICS:
03.220.50 =UDþQLWUDQVSRUW Air transport
35.240.60 Uporabniške rešitve IT v IT applications in transport
prometu
oSIST prEN 16495:2018 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
oSIST prEN 16495:2018

---------------------- Page: 2 ----------------------
oSIST prEN 16495:2018


DRAFT
EUROPEAN STANDARD
prEN 16495
NORME EUROPÉENNE

EUROPÄISCHE NORM

June 2018
ICS 03.100.70; 03.220.50; 35.240.60 Will supersede EN 16495:2014
English Version

Air Traffic Management - Information security for
organisations supporting civil aviation operations
Gestion du trafic aérien - Sécurité de l'information pour Flugverkehrsmanagement - Informationssicherheit für
les organismes assurant le soutien des opérations de Organisationen im Bereich der Zivilluftfahrt
l'aviation civile
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee
CEN/TC 377.

If this draft becomes a European Standard, CEN members are bound to comply with the CEN/CENELEC Internal Regulations
which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.

This draft European Standard was established by CEN in three official versions (English, French, German). A version in any other
language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and United Kingdom.

Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.

Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a European Standard.


EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2018 CEN All rights of exploitation in any form and by any means reserved Ref. No. prEN 16495:2018 E
worldwide for CEN national Members.

---------------------- Page: 3 ----------------------
oSIST prEN 16495:2018
prEN 16495:2018 (E)
Contents Page
European foreword . 5
Introduction . 6
1 Scope . 7
2 Normative references . 7
3 Terms and definitions . 7
4 Information security management in aviation . 8
4.1 Structure of this European Standard . 8
4.2 Aviation specific requirements related to ISO/IEC 27001:2013 . 8
5 Information Security policies . 9
5.1 Management direction for Information security . 9
6 Organisation of information security . 9
6.1 Internal organisation . 9
6.2 Mobile devices and teleworking . 10
7 Human resources security . 10
7.1 Prior to employment . 10
7.2 During employment . 11
7.3 Termination and change of employment . 11
8 Asset management . 11
8.1 Responsibility for assets . 11
8.2 Information classification . 11
8.3 Media Handling . 12
9 Access control . 12
9.1 Business requirement for access control . 12
9.2 User access management . 12
9.3 User responsibilities . 14
9.4 System and application access control . 14
10 Cryptography . 15
10.1 Cryptographic controls . 15
11 Physical and environmental security . 15
11.1 Secure areas . 15
11.2 Equipment . 16
12 Operations security . 16
12.1 Operational procedures and responsibilities . 16
12.2 Protection from malware . 16
12.3 Back-up . 17
12.4 Logging and monitoring . 17
12.5 Control of operational software . 17
12.6 Technical Vulnerability Management . 17
12.7 Information systems audit considerations . 17
13 Communications security. 17
13.1 Network security management . 17
2

---------------------- Page: 4 ----------------------
oSIST prEN 16495:2018
prEN 16495:2018 (E)
13.2 Information transfer . 18
14 System acquisition, development and maintenance . 18
14.1 Security requirements of information systems . 18
14.2 Security in development and support processes . 18
14.3 Test data . 19
15 Supplier relationships . 19
15.1 Information security in supplier relationships . 19
15.2 Supplier service delivery management . 19
16 Information security incident management . 20
16.1 Management of information security incidents and improvements . 20
17 Information security aspects of business continuity management. 21
17.1 Information security continuity . 21
17.2 Redundancies . 22
18 Compliance . 22
18.1 Compliance with legal and contractual requirements . 22
18.2 Information security reviews . 23
Annex A (informative) Additional guidance related to air traffic management . 24
A.1 Assessment of information security risks . 24
A.1.1 Internal information security risk management . 24
A.2 Interoperability issues of risk assessments . 27
A.2.1 General . 27
A.2.2 Information security risk management for multiple organisations . 28
A.2.3 Alignment of safety and security risk management. 28
A.3 Selecting controls . 28
A.4 Levels of trust . 29
A.4.1 Introduction. 29

A.5 Statement of applicability . 30
A.6 Measurement and auditing of security . 31
Annex B (informative) Implementation examples . 32
B.1 General . 32
Table B.1 — Overview of an example for LoT-O . 32
B.2 Security of information in web applications and web services (LoT-A-WEB) . 33
B.2.1 General . 33
B.2.2 Parameters for the Level of Trust of a web application / web service . 33
B.2.3 Determination of the web application / the web service (LoT-A-WEB) . 33
Table B.2 — Level of Trust of the web application / the web service . 34
B.2.4 Consequences . 34
Table B.3 — Evaluation Criteria for LoT-A-WEB . 34
B.3 Connections between multiple organisations /external connections (LoT-A-NET) . 34
B.3.1 Determination of the necessary protection controls. 34
3

---------------------- Page: 5 ----------------------
oSIST prEN 16495:2018
prEN 16495:2018 (E)
B.3.1.1 General . 34
B.3.1.2 Identity of the User . 35
B.3.1.3 Owner of the terminal device . 36
B.3.1.4 Connection point / Protection of the terminal device: . 36
B.3.1.5 Authentication of the connection . 36
B.3.1.6 Transfer net . 36
Table B.4 — Maximum Level of Trust depending on the respective technical parameters . 37
B.3.2 Effects of the coupling of networks . 40
B.4 Certificates / Public Key Infrastructure (LoT-A-PKI). 41
B.4.1 Parameters for the Level of Trust of the certificate management . 41
B.4.2 Determination of the Level of Trust of the certificate management (LoT-A-PKI) . 41
Table B.5 — Trust of identity management . 41
B.4.3 Effects: Recognition of Certificates / PK . 41
B.5 Identity Management (LoT-A-IDM) . 42
B.5.1 Parameters for the Level of Trust of Identity Management . 42
B.5.2 Determination of the Level of Trust of the Identity Management (LoT-A-IDM) . 42
Table B.6 — Level of Trust of the Identity Management . 42
B.5.3 Effects: Recognition of identities . 43
Annex C (informative) Level of trust – Implementation Example . 44
Table C.1 — Security requirements appropriate to different levels of trust . 44
Annex D (informative) Application of Controls in Regulatory Oversight – Implementation
Example . 63
Table D.1 — Mapping of Controls . 64
Bibliography . 68

4

---------------------- Page: 6 ----------------------
oSIST prEN 16495:2018
prEN 16495:2018 (E)
European foreword
This document (prEN 16495:2018) has been prepared by Technical Committee CEN/TC 377 “Air Traffic
Management”, the secretariat of which is held by DIN.
This document is currently submitted to the CEN Enquiry.
This document will supersede EN 16495:2014.
In comparison with the previous edition, the following technical modifications have been made:
• Adaptation to the structures of ISO/IEC 27002:2013 and ISO/IEC DIS 27009:2015
• Advise on alignment of safety and security management
• Advise on Security specific to development & production and maintenance
• Advise on security assurance
• Informative Annex on
5

---------------------- Page: 7 ----------------------
oSIST prEN 16495:2018
prEN 16495:2018 (E)
Introduction
This document provides guiding principles based on ISO/IEC 27001:2013 "Information technology —
Security techniques — Information security management systems — Requirements" applied to security
management systems in aviation organisations. The aim of this document is to extend the contents of
ISO/IEC 27002:2013 to the domain of aviation, thus allowing aviation organisations to implement a
standardized and specific information security management system (ISMS) and to extend it from the
level of an individual organisation to the transorganisational level.
In addition to the security objectives and measures that are set forth in ISO/IEC 27002:2013, security
management in aviation organisations are subject to further special requirements: Service delivery in
aviation is greatly defined by the cooperation of the individual participants. An organisation's
information security management is therefore dependent on the information security management of
the organisations with which it cooperates to deliver service. This European Standard therefore focuses
on aspects of cooperation.
This cooperation requires
• sharing the results of risk assessments along the business process chain,
• agreement on the required level of trust,
• agreement on the required security controls and their implementation.
6

---------------------- Page: 8 ----------------------
oSIST prEN 16495:2018
prEN 16495:2018 (E)
1 Scope
This European Standard defines guidelines and general principles for the implementation of an
information security management system in organisations supporting civil aviation operations.
Not included are activities of the organisations that do not have any impact on the security of civil
aviation operations like for example airport retail and service business and corporate real estate
management.
For the purpose of this European Standard, Air Traffic management is seen as functional expression
covering responsibilities of all partners of the air traffic value chain. This includes but is not limited to
airspace users, airports and air navigation service providers.
The basis of all requirements in this European Standard is trust and cooperation between the parties
involved in Air Traffic Management.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 27000:2018, Information technology — Security techniques — Information security
management systems — Overview and vocabulary
ISO/IEC 27001:2013, Information technology — Security techniques — Information security
management systems — Requirements
ISO/IEC 27002:2013, Information technology — Security techniques — Code of practice for information
security controls
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 27000:2018 and the
following apply
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
• IEC Electropedia: available at http://www.electropedia.org/
• ISO Online browsing platform: available at http://www.iso.org/obp
3.1
air traffic management
functional system comprised of an aggregation of the airborne and ground-based functions (air traffic
services, airspace management and air traffic flow management) required to ensure the safe and
efficient movement of aircraft during all phases of operations
3.2
trust
situation where one party is willing to rely on the actions of another party
Note 1 to entry: Trust is more than what can be achieved by assurance. However, assurance represents a
supporting instrument to trust building
7

---------------------- Page: 9 ----------------------
oSIST prEN 16495:2018
prEN 16495:2018 (E)
4 Information security management in aviation
4.1 Structure of this European Standard
This European Standard is structured in line with ISO/IEC 27002. ISO/IEC 27002 is merely referenced
in all cases in which its measures can be applied without being amended or supplemented:
— in all cases in which the implementation of ISO/IEC 27002 measures requires supplementation
specific to aviation, this has been integrated directly in the respective section;
— implementation examples for specific application areas are described in Annex A (informative).
This relates to the following areas:
— security of information in web applications and web services;
— connections between multiple organisations /external connections;
— certificates / Public Key Infrastructure;
— identity Management.
4.2 Aviation specific requirements related to ISO/IEC 27001:2013
ISO/IEC 27001:2013 Requirements on 4.2 “Understanding the needs and expectations of interested
parties” are amended by a note:
Interested parties include other organizations with interfaces to the organization which involve
network connections and/or the exchange of data and/or information
ISO/IEC 27001:2013 Requirements on 5.3 “Organizational roles, responsibilities and authorities” are
amended as follows:
Top Management shall ensure seamlessness of information security management within the own
organisation including transorganisational processes.
ISO/IEC 27001:2013 Requirements on 6.1 ”Actions to address risks and opportunities” are amended by a
new section 6.1.4 “Information security risk information sharing”:
The organization shall assess the risk due to external network connections and/or the exchange of data
and/or information by:
a) Identifying information flows across external interfaces with other organizations
b) Including such flows and interfaces explicitly in the risk assessment described in 6.1.2
c) Seeking risk assessment and risk treatment information from the organization(s) sharing the
external interface and controlling the information which crosses it, as input to the risk assessment
d) Sharing appropriate risk assessment information created in 6.1.2 and risk treatment information
created in 6.1.3 with organizations which share the external interface
ISO/IEC 27001:2013 Requirements on 6.1.2c on “Information security risk assessment” are amended by a
3rd item:
Identify system interfaces with other organizations which involve network connections and/or the
exchange of data and/or information that may pose a risk to the organization
Add a reference to 27001:2013, 6.1.2 c) 3) to 6.1.2 d) 1) and 2)
8

---------------------- Page: 10 ----------------------
oSIST prEN 16495:2018
prEN 16495:2018 (E)
ISO/IEC 27001:2013 Requirement s on 7.4 “Communication” are refined by the following note
There will be a need for external communications with organizations with which the organization
shares data and/or information and/or network connections, as described in 6.1.4.
ISO/IEC 27001:2013 Requirements on 8.2 “Information risk assessment” are amended as follows:
The organization shall share appropriate risk assessment information with organizations with which it
shares data and/or information and/or network connections as described in 6.1.4.
ISO/IEC 27001:2013 Requirements on 8.3 “Information security risk treatment” are amended as follows:
The organization shall share appropriate risk treatment information with organizations with which it
shares data and/or information and/or network connections as described in 6.1.4.
5 Information Security policies
5.1 Management direction for Information security
5.1.1 Policies for information security
Additional Implementation guidance for ISO/IEC 27002:2013, 5.1.1
The policies for information security should be coordinated with the various security requirements in
other areas of aviation (e.g.: physical security of secure areas). The distinctions and mutual
dependencies between the individual areas should be documented in the policies or in separate
documents.
5.1.2 Review of the policies for information security
No additional information specific to aviation organisations for ISO/IEC 27002:2013, 5.1.2.
6 Organisation of information security
6.1 Internal organisation
6.1.1 Information security roles and responsibilities
Additional Implementation guidance for ISO/IEC 27002:2013, 6.1.1
The organisation should appoint a person responsible to serve as a point of contact for strategic
information security issues for third parties (e.g. for the planning and implementation of joint
measures, etc.).
6.1.2 Segregation of duties
No additional information specific to aviation organisations for ISO/IEC 27002:2013, 6.1.2.
6.1.3 Contact with authorities
Additional Implementation guidance for ISO/IEC 27002:2013, 6.1.3
The organisation should cooperate with the appropriate specialist and supervisory authorities,
particularly in the areas of IT security and prosecution, and with other critical infrastructures as well.
This includes contacts to authorities involved in critical infrastructure protection at the national and
European level.
9

---------------------- Page: 11 ----------------------
oSIST prEN 16495:2018
prEN 16495:2018 (E)
6.1.4 Contact with special interest groups
Additional Implementation guidance for ISO/IEC 27002:2013, 6.1.4
The organisation should establish an interface to other organisations
Contacts should also consider the needs and expectations of interested parties, in particular
organisations with which the organisation shares information security risks in terms of the creation or
contribution to aviation safety hazards and the management thereof.
The establishment of formal interfaces to critical organisations should be considered
The organisation should also be aware of the criticality of its services at a regional, national and
international level. It may therefore participate in associations and alliances as well as national and
international programs to provide comprehensive support to air safety.
Given the special nature of threats to
...