ADR.OR.D.007 Management of aeronautical data and aeronautical information

QUALITY MANAGEMENT SYSTEM FOR AERONAUTICAL DATA AND AERONAUTICAL INFORMATION PROVISION ACTIVITIES An aerodrome operator does not need to duplicate functions and activities in order to discharge the responsibilities related to the management of aeronautical data and aeronautical information provision activities. In this respect, the compliance monitoring may be used for the purposes of ensuring compliance with the relevant requirements for management of aeronautical data and aeronautical information provision activities.

SECURITY MANAGEMENT FOR AERONAUTICAL DATA AND AERONAUTICAL INFORMATION PROVISION ACTIVITIES

(a)The security management objectives should be:

(1)to ensure the security of aeronautical data and aeronautical information received, produced, or otherwise employed so that it is protected from interference, and access to it is restricted only to those authorised; and

(2)to ensure that the security management measures meet appropriate national, EU, or international requirements for critical infrastructure and business continuity, and international standards for security management, including:

(i)ISO/IEC 17799:2005 — Information technology — Security techniques — Code of practice for information security management;

(ii)ISO 28000:2007: — Specification for security management systems for the supply chain.

(b)Regarding the ISO standards, the relevant certificates issued by an appropriately accredited organisation, are considered as an Acceptable Means of Compliance.

INFORMATION SECURITY THREAT Information security threat may be any circumstance or event with the potential to adversely impact the operation, systems and/or constituents due to human action (accidental, casual or purposeful, intentional or unintentional, mistaken) resulting from unauthorised access, use, disclosure, denial, disruption, modification, or destruction of information and/or information system interfaces. This includes malware and the effects of external systems on dependent systems but does not include physical threats.