Regulation 14 Amendment of Annex 3 to Commission Regulation (EU) No 139/2014

(1)

Annex 3 (Part-ADR.OR) is amended as follows.

(2)

For point ADR.OR.D.007, substitute—

“ADR.OR.D.007 Management of aeronautical data and aeronautical information

(a)
As part of its management system, the aerodrome operator shall implement and maintain a quality management system covering the following activities:

(1) its aeronautical data activities;

(2) its aeronautical information provision activities.

(b)
The aerodrome operator shall, as part of its management system, establish a security management system to ensure the security of operational data it receives, or produces, or otherwise employs, so that access to that operational data is restricted only to those authorised.

(c)
The security management system of the aerodrome operator shall define the following elements:

(1) the procedures relating to data security risk assessment and mitigation, security monitoring and improvement, security reviews and lesson dissemination;

(2) the means designed to detect security breaches and to alert personnel with appropriate security warnings;

(3) the means of controlling the effects of security breaches and of identifying recovery action and mitigation procedures to prevent reoccurrence.

(d)
The aerodrome operator shall ensure the security clearance of its personnel with respect to aeronautical data security.

(e)
The aerodrome operator shall take the necessary measures to protect its aeronautical data against cyber security threats.”.