CS 25.795 Security considerations

Large Aeroplanes (CS-25) · CS-25 · EAR revision 26 Jan 2023

IRImplementing rule

CS 25.795Security considerations

(see AMC 25.795)

(a)Protection of flightdeck. If a secure flightdeck door is required by operating rules, the bulkhead, door, and any other accessible boundary separating the flight crew compartment from occupied areas must be designed to:

(1)Resist forcible intrusion by unauthorised persons and be capable of withstanding impacts of 300 Joules (221.3 footpounds) as well as a 1113 Newton (250 pound) tensile load on accessible handholds, including the doorknob or handle (See AMC 25.795(a)(1)); and

(2)Resist penetration by small arms fire and fragmentation devices by meeting the following projectile definitions and projectile speeds.

(i)Demonstration Projectile #1. A 9 mm full metal jacket, round nose (FMJ RN) bullet with nominal mass of 8.0 g (124 grain) and reference velocity 436 m/s (1,430 ft/s).

(ii)Demonstration Projectile #2. A .44 Magnum, jacketed hollow point (JHP) bullet with nominal mass of 15.6 g (240 grain) and reference velocity 436 m/s (1,430 ft/s). (See AMC 25.795(a)(2))

(b)Aeroplanes with a certificated passenger seating capacity of more than 60 persons or a maximum take-off weight of over 45 500 Kg (100 000 lb) must be designed to limit the effects of an explosive or incendiary device as follows:

(1)Flight deck smoke protection. Means must be provided to limit entry of smoke, fumes, and noxious gases into the flight deck. (See AMC 25.795(b)(1))

(2)Passenger cabin smoke protection. Except for aeroplanes intended to be used solely for the transport of cargo, means must be provided to prevent passenger incapacitation in the cabin resulting from smoke, fumes, and noxious gases as represented by the initial combined volumetric concentrations of 0.59% carbon monoxide and 1.23% carbon dioxide. (See AMC 25.795(b)(2))

(3)Cargo compartment fire suppression. An extinguishing agent must be capable of suppressing a fire. All cargo-compartment fire suppression-system components must be designed to withstand the following effects, including support structure displacements or adjacent materials displacing against the distribution system:

(i)Impact or damage from a 13 mm (0.5-inch) -diameter aluminium sphere travelling at 131 m/s (430 feet per second);

(ii)A 103 kPa (15 psi) pressure load if the projected surface area of the component is greater than 0,4 square meter (4 square feet). Any single dimension greater than 1,2 meters (4 feet) may be assumed to be 1,2 meters (4 feet) in length; and

(iii)A 15 cm (6-inch) displacement, except where limited by the fuselage contour, from a single point force applied anywhere along the distribution system where relative movement between the system and its attachment can occur.

(iv)Paragraphs (b)(3)(i) through (iii) of this paragraph do not apply to components that are redundant and separated in accordance with paragraph (c)(2) of this paragraph or are installed remotely from the cargo compartment. (See AMC 25.795(b)(3))

(c)An aeroplane with a certificated passenger seating capacity of more than 60 persons or a maximum take-off weight of over 45 500 Kg (100,000 lbs) must comply with the following:

(1)Least risk bomb location. Except for aeroplanes intended to be used solely for the transport of cargo, an aeroplane must be designed with a designated location where a bomb or other explosive device could be placed to best protect integrity of the structure and flight-critical systems from damage in the case of detonation. (See AMC 25.795(c)(1))

(2)Survivability of systems.

(i)Except where impracticable, redundant aeroplane systems necessary for continued safe flight and landing must be physically separated, at a minimum, by an amount equal to a sphere of diameter

(where H0 is defined under paragraph 25.365(e)(2) and D need not exceed 1,54 meters (5.05 feet). The sphere is applied everywhere within the fuselage-limited by the forward bulkhead and the aft bulkhead of the passenger cabin and cargo compartment beyond which only one-half the sphere is applied.

(ii)Where compliance with sub-paragraph (c)(2)(i) of this paragraph is impracticable, other design precautions must be taken to maximise the survivability of those systems. (See AMC 25.795(c)(2))

(3)Interior design to facilitate searches. Except for aeroplanes intended to be used solely for the transport of cargo, design features must be incorporated that will deter concealment or promote discovery of weapons, explosives, or other objects from a simple inspection in the following areas of the aeroplane cabin:

(i)Areas above the overhead bins must be designed to prevent objects from being hidden from view in a simple search from the aisle. Designs that prevent concealment of objects with volumes 0.33 cubic decimetre (20 cubic inches) and greater satisfy this requirement.

(ii)Toilets must be designed to prevent the passage of solid objects greater than 5 cm (2.0 inches) in diameter.

(iii)Life preservers or their storage locations must be designed so that tampering is evident. (See AMC 25.795(c)(3))

(d)Each chemical oxygen generator or its installation must be designed to be secure from deliberate manipulation by one of the following:

(1)By providing effective resistance to tampering;

(2)By providing an effective combination of resistance to tampering and active tamper-evident features;

(3)By installation in a location or manner whereby any attempt to access the generator would be immediately obvious; or

(4)By a combination of approaches specified in subparagraphs (d)(1), (d)(2) and (d)(3) of this paragraph. (See AMC 25.795(d))

[Amdt 25/9]

[Amdt 25/17]

[Amdt 25/18]

IR · CS 25.795 — CS-25 · ED Decision 2016/010/R · CS-25 Easy Access Rules · EAR revision 26 Jan 2023

AMCAcceptable means of compliance

Show the text

1.Purpose CS 25.795(d) requires each Chemical Oxygen Generator (COG) or its installation to be designed so that it meets one of several criteria. The means of compliance described in this AMC provides guidance to supplement the engineering and operational judgment that should form the basis of any compliance findings related to a COG installed on an aeroplane.

2.Definition of terms For this AMC, the following definitions apply:

(a)Access: The ability to manipulate the COG with the intent of making alterations for a purpose for which the COG was not originally designed. This includes gaining access to the area surrounding the COG.

(b)Activation: Release of the firing mechanism of the COG for the purpose of initiating the chemical reaction inside.

(c)Alteration: A change in the configuration of the COG once ‘access’ has been gained for the purpose of using the COG for a function other than the one it is intended for.

(d)Chemical Oxygen Generator (COG): A device that releases oxygen that is created from a chemical reaction.

(e)Immediately obvious: Where an attempt to gain ‘access’ to the COG would be readily recognised as suspicious (prior to gaining ‘access’). This would only be in locations with ‘unrestricted access’ that are ‘observable’.

(f)Intervention: The actions crew members must take to prevent damage to the aeroplane once an alert is activated indicating that the COG is being tampered with. The time it takes to intervene when the lavatory is occupied has not been determined; however, it can be assumed that it will take several minutes to resolve the issue.

(g)Observable: A crew member is able to see if a person attempts to gain ‘access’ to a COG installation during the course of the crew member’s normal duties.

(h)Tamper-evident feature: A unique feature that provides an active and obvious contemporaneous alert to crew members that someone is trying to gain ‘access’ to the COG and immediate crew ‘intervention’ is necessary.

(i)Tamper-resistance: The level of deterrence for gaining ‘access’ to the COG.

(j)Unrestricted access: An area of the cabin passengers can enter without overcoming locks or other mechanical closure means.

3.Related Certification Specifications (CSs) CS 25.795 Security considerations CS 25.1301 Equipment — Function and installation CS 25.1309 Equipment, systems, and installations CS 25.1322 Flight crew alerting CS 25.1450 Chemical oxygen generators

4.Compliance with CS 25.795(d)

(a)Acceptable means of determining if a COG or its installation is designed to be secure Several criteria may be used for determining if a COG installation is secure or has a security vulnerability. COG installations with a security vulnerability must include design features to prevent potential misuse of the COG. Figure 1, Criteria for Assessing an Installation, includes assessment criteria that can be used for determining if a COG installation has a security vulnerability. Table 1 includes guidance to assist in answering the questions in Figure 1. For installations identified as having security vulnerabilities, such as those for which the answers to the assessment statements in Figure 1 result in the answer to question number 4 being yes, the design should be changed. Alternatively, the COG can be replaced with an acceptable oxygen source that is not a security threat. Figure 1: Criteria for assessing an installation [Figure or form omitted from this preview — available in the Avioverse workspace library.]

Table 1: Assessment statement analysis

Question number	Notes and questions to assist with the assessment statement analysis
1.	Review the instructions for continued airworthiness. Review the drawing system. Inspect the aeroplane’s configuration.
2.	Can crew members observe the COG installation? Check the area where the COG is installed. Isolated areas such as galleys, lavatories, crew rests, enclosed occupied compartments, and lower lobe lavatory complexes are potential areas of concern and require further evaluation. Are crew members close to the COG installation during their normal duties? Are there physical barriers between the crew members and the area being evaluated? Is there significant distance between the crew members and the area being observed? How accessible is the COG? Is the COG installation surrounded by curtains? Curtained areas are also considered potential areas of concern and may require further evaluation.
3.	Are there locks on doors/access panels to prevent access? Are there tamper-resistant fasteners on panels? Are alarms or some other active alerting tamper indication method part of the installation’s design?
4.	Check if the COG can be compromised in place. Assess the vulnerability of the adjacent materials to contain the compromised device. Assess the ability of the compartment to contain the event. Check if the COG can be removed.

(b)Installation of tamper-resistant features Tamper-resistant design features can be used, in whole or in part, to make a COG installation secure. There are different types of tamper-resistant design features, and their functionality largely depends on the installation. The principal benefit of tamper-resistance is to delay exploitation of the COG as a weapon. However, it is not likely that an existing COG installation that can be accessed from within the lavatory could be modified with tamper-resistant design features sufficient to prevent a successful attack. This is because typical measures of tamper-resistance, such as special tools and fasteners, could likely be overcome given enough time. These measures are normally used as one of several layers of security. Thus, the reliance on such measures is only one element of the security system.

(1)A tamper-resistant installation employs multiple elements, which may include:

(i)the COG’s location;

(ii)the method of mounting;

(iii)physical protection (through shielding or mechanical isolation of key components); and

(iv)internal design.

(2)Eliminating access to the COG is the most straightforward way to make the COG tamper-resistant. Typically, this can be done by placing the COG in a location where significant disassembly of the cabin interior would be required to gain access. For example, the COG for a lavatory could be located so that the entire lavatory module would have to be removed to access the COG. However, the installer should also consider the ramifications on maintenance when this approach is used.

(c)Installation of tamper-evident features

(1)For COGs that can be accessed from isolated compartments, such as lavatories, some form of active tamper-evidence (for example, an alert) would be needed in addition to the installation of tamper-resistant features. This is necessary so that the time to intervene and stop the attack is less than the time required to carry out the attack. In this case, passive tamper-evident features, such as a tamper-evident seal, are not effective because they provide an after-the-fact notification of tampering. The effectiveness of a tamper-evident system depends on intervention; it cannot be assumed that the alarm by itself would inhibit the attack.

(2)Once an alert is activated indicating that the COG is being tampered with, actions by crew members and other available, authorised responders are necessary to prevent catastrophic damage to the aeroplane. Therefore, there is a critical relationship between the tamper-evidence system and the training and capability of the crew to respond. To be most effective, crew training should be accomplished prior to the alarm feature being deployed into the fleet. The time needed to successfully respond to the alarm may be several minutes and depends on several factors. The time available to respond to a threat and intervention times are functions of not only the design features but also of many complex and human factor-dependent variables that are difficult to define. These variables include but are not limited to the individual capabilities and numbers of flight attendants/authorised responders relative to the terrorists/accomplices, as well as the extensiveness of the training received.

(3)In order to be effective, the alerting system must itself be resistant to tampering. Otherwise, the entire concept of using the early notification to crew could be nullified and the COG accessed without impediment.

(d)System safety considerations The applicant should consult AMC 25.1309 for guidance on compliance with CS 25.1309.

(e)Hazard classification. Failure of tamper-resistant or tamper-evident features should be considered major.

(f)System performance when installed A tamper-evidence system installed for compliance with CS 25.795(d) is intended to notify crew members that someone is trying to gain access to a COG. The system should provide aural and visual warnings to immediately notify crew members so that they can provide direct response in a timely manner. For example, visual indication should be provided so that crew members can identify which COG location is being tampered with while performing their normal duties. Aural alerts should be distinct from other alerts and clearly audible to the crew members expected to respond to the alert. If an alert is provided to the flight crew, the alert should be presented in accordance with CS 25.1322.

5.Areas that are immediately obvious For COG installations located where any attempt to access would be immediately obvious, additional safety measures are not required. Immediately obvious areas include the main passenger cabin and other areas where occupants are always present. While some measure of tamper-resistance is encouraged for these locations, none is required to meet CS 25.795(d). Private compartments (such as a lavatory) or visually divided sections of larger cabin areas are assessed independently. The ‘immediately obvious’ criterion applies to the specific location of each COG installation, not simply the general area in which it is located. In addition, the installation should be evaluated under all conditions that may exist during a flight. So, for example, if tampering would be immediately obvious except when a curtain is pulled to provide privacy, the installation should be evaluated based on the curtain being arranged in a way that most conceals the installation. As with tamper-evident designs, crews should be made aware that tampering with any COG is a safety risk, and any necessary information should be incorporated into the training programmes.

[Amdt 25/17]

AMC · AMC 25.795(d) — CS-25 · ED Decision 2015/019/R · CS-25 Easy Access Rules · EAR revision 26 Jan 2023

All rules in SUBPART D – DESIGN AND CONSTRUCTION

Consolidated from the EASA Easy Access Rules (revision 26 Jan 2023, extracted 17 Aug 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.

Ask Metis about CS 25.795 →

Metis opens with Avioverse in October 2026 · request early access.