# Commission Implementing Regulation (EU) 2017/373 of 1 March 2017 laying down common requirements for providers of air traffic management/air navigation services and other air traffic management network functions and their oversight, repealing Regulation (EC) No 482/2008, Implementing Regulations (EU) No 1034/2011, (EU) No 1035/2011 and (EU) 2016/1377 and amending Regulation (EU) No 677/2011 (Text with EEA relevance), Division: ATM/ANS.OR.D.010 Security management

Extent: E+W+S+N.I.

(a)Air navigation services providers shall, as an integral part of their management system as required in point ATM/ANS.OR.B.005, establish a security management system to ensure:
(1)the security of their facilities and personnel so as to prevent unlawful interference with the provision of services;
(2)the security of operational data they receive, or produce, or otherwise employ, so that access to it is restricted only to those authorised.
(b)The security management system shall define:
(1)the procedures relating to security risk assessment and mitigation, security monitoring and improvement, security reviews and lesson dissemination;
(2)the means designed to detect security breaches and to alert personnel with appropriate security warnings;
(3)the means of controlling the effects of security breaches and to identify recovery action and mitigation procedures to prevent re-occurrence.
(c)Air navigation services providers shall ensure the security clearance of their personnel, if appropriate, and coordinate with the relevant civil and military authorities to ensure the security of their facilities, personnel and data.
(d)Air navigation services providers shall take the necessary measures to protect their systems, constituents in use and data and prevent compromising the network against information and cyber security threats which may have an unlawful interference with the provision of their service.

---
Source: https://www.legislation.gov.uk/eur/2017/373/annex/III/division/COMMON/division/4/division/3 (the official version)
Page: https://openlegislation.uk/eu-regulation-2017-373/annex-III/division-COMMON/division-4/division-3
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.