Third-Party Vendor Risk in Aviation: A Practical Guide for Security and Compliance Teams
When Aviaso — a Swiss aviation fuel management and emissions software vendor — was compromised, the attackers gained a foothold in the systems of airlines across Europe. The incident was not a headline-grabbing ransomware attack but a quiet supply chain intrusion: exactly the type that is hardest to detect and most likely to persist unnoticed. EASA Part-IS and CAA CAP 1753 both explicitly require aviation operators to assess and manage third-party cybersecurity risk. This guide provides a practical framework for building a vendor risk programme that satisfies regulatory requirements and addresses the real supply chain threat landscape.
EASA Part-IS and CAA CAP 1753 both explicitly require aviation operators to assess third-party supply chain cybersecurity risk — making vendor risk management a regulatory obligation.
Step 1: Build a Complete Vendor Inventory
The first step in any aviation vendor risk programme is building a complete, current inventory of all third parties with system access or data processing roles. Most operators are surprised by how many vendors they find when they conduct a thorough inventory. Sources for vendor discovery include:
- IT asset management systems: Identify all software and SaaS services in use
- Network firewall logs: Outbound connections reveal cloud services and vendor connections not captured in asset management
- Finance/procurement records: All IT-related suppliers with active contracts
- HR: Contractors and consultants with system access
- OT maintenance contracts: Vendors with remote access to operational systems
- Data processing agreements: All entities with whom you have GDPR Article 28 DPAs
Step 2: Risk-Tier Your Vendor Population
Not all vendors pose the same risk. A risk tiering model for aviation typically distinguishes:
- Tier 1 (Critical): Vendors with OT/ICS network access, mass passenger data processing, or IT systems that if compromised would cause severe operational disruption (GDS providers, airline IT systems, ANSP software)
- Tier 2 (High): Vendors with significant IT system access, HR/payroll data, or access to multiple system types (IT managed service providers, cloud platform providers)
- Tier 3 (Medium): Vendors with limited, defined data access and no operational system integration (SaaS productivity tools, professional services with limited data exposure)
- Tier 4 (Low): Vendors with no system access and only anonymised or aggregate data (industry benchmarking services, research providers)
Step 3: Assess Vendor Security
Assessment depth should match risk tier:
- Tier 1: Security questionnaire + certification review (ISO 27001, Cyber Essentials, SOC 2) + penetration test report review + contractual right-to-audit
- Tier 2: Security questionnaire + certification verification + contractual security requirements
- Tier 3: Standardised security questionnaire + certification check
- Tier 4: Basic due diligence — legal entity check, data processing agreement if personal data involved
Step 4: Implement Contractual Controls
Vendor contracts must include security requirements proportionate to the risk tier:
- Data Processing Agreements (DPAs): Required under UK GDPR Article 28 for all data processors — must specify processing purpose, data categories, sub-processor obligations, and security measures
- Security requirements clause: Obligation to maintain specified security standards (e.g., ISO 27001 certification) and implement controls appropriate to the data/access provided
- Incident notification: Obligation to notify within 24–72 hours of any security incident affecting operator data or systems
- Right-to-audit: Right to assess vendor security controls with reasonable notice — critical for Tier 1 and 2 vendors
- Sub-processor approval: Vendors must obtain approval before engaging sub-processors with access to operator data
- Termination and data return: Obligation to return or destroy operator data on contract termination
Step 5: Ongoing Monitoring and Reassessment
Vendor risk assessment is not a one-time exercise. Ongoing monitoring should include:
- Continuous external monitoring: Tools like Panorays continuously assess vendor security posture from the outside — detecting exposed systems, certificate failures, and dark web exposure without vendor cooperation
- Periodic reassessment: Annual formal reassessment for Tier 1 and 2 vendors; 2–3 year cycle for Tier 3
- Incident-triggered reassessment: Any vendor security incident should trigger immediate reassessment regardless of normal cycle
- Contract renewal review: Every contract renewal is an opportunity to update security requirements to reflect the current threat landscape
Frequently Asked Questions
What is the minimum vendor risk programme that satisfies EASA Part-IS?
EASA Part-IS requires operators to identify and assess information security risks arising from their supply chain, implement appropriate controls for high-risk vendor relationships, and include supply chain risk in their ISMS risk assessment. At minimum, this requires a vendor inventory, a risk assessment for vendors with significant system access, and contractual security requirements for critical vendors. The level of formality required scales with the size and risk profile of the operator — a regional airline needs a simpler programme than a major hub carrier.
How do you manage vendor risk for legacy contracts without security clauses?
Many aviation operators have long-standing vendor relationships predating GDPR and modern cybersecurity requirements, with contracts that lack adequate security provisions. On renewal, insert updated security clauses. For contracts not due for renewal, consider: a formal letter requesting evidence of security measures; a mutual security addendum outside the main contract; or, for high-risk vendors, a security assessment conducted under existing right-to-audit provisions. The ICO's guidance makes clear that inadequate vendor contracts are a GDPR compliance failure — addressing legacy contracts should be a priority.
Automate your aviation vendor risk assessments
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.