The guidance applies to initial and amended type certificates and supplemental type certificates for aircraft, aircraft systems and engine and propeller systems connecting to internal or external data networks and services: field loading of software, maintenance laptops, airport and airline gatelinks, public networks, wireless aircraft sensors, cellular networks, USB devices, satellite communications, portable electronic devices and electronic flight bags, and GPS and SBAS digital data. Aeronautical databases and ACARS are outside it only where data security and integrity checks are in place; otherwise the security risk assessment and mitigation must account for those links. The software loading function, with its support systems and procedures, should detect any anomaly in loading, and a security risk analysis is needed for new data loading systems and major modifications to existing ones, alongside 25.1309, 33.28 and 35.23 software assurance (AC 20-115D) and the flight bag ACs 20-173A and 120-76D.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.