DO-326A / ED-202A
RTCA DO-326A / EUROCAE ED-202A (2014), Airworthiness Security Process Specification: the process an applicant integrates with ARP 4754A to protect the airworthiness of aircraft, engines and propellers from intentional unauthorised electronic interaction. Seven steps (plan, security scope, security risk assessment, risk acceptability, security development, security effectiveness assurance, communication of evidence) in fourteen aircraft-level and system-level activities from the PSecAC to the PSecAC Summary, with threat conditions, threat scenarios, security measures and levels of threat assessed against the safety severity, and security assurance levels grading the assurance. Recognised by EASA AMC 20-42, FAA policy and the UK MAA; methods in DO-356A / ED-203A, in-service guidance in DO-355A / ED-204A. DO-326B / ED-202B, a limited update on change impact analysis, has since been completed.
DO-326A / ED-202A is a compliance framework from International (civil aviation; EASA, FAA, UK MAA and other authorities) with 7 domains and 22 controls. The largest domains are Step 3: Security risk assessment – DO-326A / ED-202A (9 controls), Step 5: Security development – DO-326A / ED-202A (5 controls), Step 6: Security effectiveness assurance – DO-326A / ED-202A (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Step 1: Plan for Security Aspects of Certification – DO-326A / ED-202A
| Code | Title |
|---|---|
| do-326a-ed-202a::PSecAC | Plan for Security Aspects of Certification |
Step 2: Security scope definition – DO-326A / ED-202A
| Code | Title |
|---|---|
| do-326a-ed-202a::ASSD | Aircraft Security Scope Definition |
| do-326a-ed-202a::SSSD | System Security Scope Definition |
Step 3: Security risk assessment – DO-326A / ED-202A
| Code | Title |
|---|---|
| do-326a-ed-202a::3.2.1 | Threat condition identification and evaluation |
| do-326a-ed-202a::3.2.2 | Threat scenario identification |
| do-326a-ed-202a::3.2.3 | Security measure characterisation |
| do-326a-ed-202a::3.2.4 | Level of threat evaluation |
| do-326a-ed-202a::4.2.1 | Change impact analysis for modifications |
| do-326a-ed-202a::ASRA | Aircraft Security Risk Assessment |
| do-326a-ed-202a::PASRA | Preliminary Aircraft Security Risk Assessment |
| do-326a-ed-202a::PSSRA | Preliminary System Security Risk Assessment |
| do-326a-ed-202a::SSRA | System Security Risk Assessment |
Step 4: Risk acceptability determination – DO-326A / ED-202A
| Code | Title |
|---|---|
| do-326a-ed-202a::S4.1 | Risk acceptability determination |
Step 5: Security development – DO-326A / ED-202A
| Code | Title |
|---|---|
| do-326a-ed-202a::4.3.1 | Security instructions for continued airworthiness |
| do-326a-ed-202a::ASAM | Aircraft Security Architecture and Measures |
| do-326a-ed-202a::ASOG | Aircraft Security Operator Guidance |
| do-326a-ed-202a::SSAM | System Security Architecture and Measures |
| do-326a-ed-202a::SSIG | System Security Integrator Guidance |
Step 6: Security effectiveness assurance – DO-326A / ED-202A
| Code | Title |
|---|---|
| do-326a-ed-202a::3.3.2.2 | Security effectiveness requirements |
| do-326a-ed-202a::ASV | Aircraft Security Verification |
| do-326a-ed-202a::SSV | System Security Verification |
Step 7: Communication of evidence – DO-326A / ED-202A
| Code | Title |
|---|---|
| do-326a-ed-202a::PSecAC-Summary | Plan for Security Aspects of Certification Summary |
What is DO-326A / ED-202A and who does it apply to?
DO-326A / ED-202A is a compliance framework from International (civil aviation; EASA, FAA, UK MAA and other authorities) with 7 domains and 22 controls. RTCA DO-326A / EUROCAE ED-202A (2014), Airworthiness Security Process Specification: the process an applicant integrates with ARP 4754A to protect the airworthiness of aircraft, engines and propellers from intentional unauthorised electronic interaction. Seven steps (plan, security scope, security risk assessment, risk acceptability, security development, security effectiveness assurance, communication of evidence) in fourteen aircraft-level and system-level activities from the PSecAC to the PSecAC Summary, with threat conditions, threat scenarios, security measures and levels of threat assessed against the safety severity, and security assurance levels grading the assurance. Recognised by EASA AMC 20-42, FAA policy and the UK MAA; methods in DO-356A / ED-203A, in-service guidance in DO-355A / ED-204A. DO-326B / ED-202B, a limited update on change impact analysis, has since been completed. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does DO-326A / ED-202A actually require?
DO-326A / ED-202A has 22 controls organised across 7 domains. The largest domains are Step 3: Security risk assessment – DO-326A / ED-202A (9 controls), Step 5: Security development – DO-326A / ED-202A (5 controls), Step 6: Security effectiveness assurance – DO-326A / ED-202A (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of DO-326A / ED-202A do I already cover?
DO-326A / ED-202A does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement DO-326A / ED-202A?
Start your DO-326A / ED-202A compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about DO-326A / ED-202A requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 22 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required