ICAO Annex 17 Cybersecurity: What the 2022 Amendment Means for Aviation Security

What the ICAO Annex 17 Cybersecurity Amendment Requires

The 17th Amendment to Annex 17 adds cybersecurity provisions requiring ICAO contracting states to:

• Establish a national aviation cybersecurity framework or programme
• Identify critical aviation information and communications systems requiring protection
• Define responsibilities for cybersecurity across the aviation ecosystem (regulatory authorities, airports, airlines, ANSPs)
• Establish processes for reporting and responding to cybersecurity incidents affecting aviation
• Promote information sharing among aviation stakeholders on cyber threats and incidents
• Require aviation operators to implement cybersecurity measures proportionate to the threats they face

How ICAO Annex 17 Translates Into UK Obligations

The UK, as an ICAO contracting state, is obligated to implement Annex 17 standards through its National Aviation Security Programme (NASP). The CAA, as the UK's competent authority for aviation security, translates ICAO standards into UK regulatory requirements through CAP publications and the NIS Regulations framework. CAP 1753 (CAA Cyber Security Strategy) reflects ICAO Annex 17 cybersecurity provisions and establishes the UK's implementation approach. Aviation operators should read CAP 1753 requirements as the UK expression of ICAO Annex 17 cybersecurity obligations.

Critical Systems Covered by Annex 17 Cybersecurity Provisions

ICAO identifies the following as critical aviation information and communication systems requiring cybersecurity protection:

• Air Traffic Management (ATM) systems — including radar, communications, and flight data processing
• Aircraft communications systems — ACARS, SATCOM, ADS-B
• Airport operational systems — baggage handling, passenger processing, security screening systems
• Passenger Reservation Systems (PRS) and Departure Control Systems (DCS)
• Safety management and maintenance systems — airworthiness records, maintenance tracking
• Navigation infrastructure — instrument landing systems, VOR, DME
• Ground-to-air and ground-to-ground communications

Cybersecurity Information Sharing Under ICAO

Annex 17 emphasises information sharing as a core pillar of aviation cybersecurity. ICAO's Aviation Information Sharing and Analysis Centre (AISAC) provides a global platform for sharing threat intelligence among aviation stakeholders. In the UK, the CAA coordinates with the NCSC's Transport sector team and participates in the European Aviation Crisis Coordination Cell (EACCC) for cross-border incident response. Aviation operators are encouraged — and in some cases required under NIS — to participate in national information sharing mechanisms.

Frequently Asked Questions