FAA Aircraft Systems Information Security Protection (ASISP)
The 'FAA Cybersecurity Framework for Aviation' is not a single FAA-published document but a DISTRIBUTED U.S. aviation cybersecurity policy stack maintained by the Federal Aviation Administration (FAA) covering: (a) AIRCRAFT cybersecurity airworthiness under 14 CFR Part 25 + Part 23/27/29 (Special Conditions historically + Notice of Proposed Rulemaking 2024 NPRM to codify cybersecurity as a standing airworthiness requirement); (b) ADVISORY CIRCULARS AC 119-1 (Cybersecurity for Operators), AC 25-21 (Aircraft Network Security Architecture), AC 23-XX series (general aviation), AC 27-XX series (rotorcraft); (c) RTCA / EUROCAE INDUSTRY STANDARDS DO-326A / ED-202A (Airworthiness Security Process Specification), DO-356A / ED-203A (Airworthiness Security Methods + Considerations), DO-355A / ED-204A (Information Security Guidance for Continuing Airworthiness), ARINC 811 (Aircraft Network Security Architecture); (d) AIR TRAFFIC MANAGEMENT cybersecurity through the FAA Cybersecurity Strategy + the National Airspace System (NAS) cybersecurity program; (e) AIRPORT cybersecurity coordinated with TSA + DOT cybersecurity initiatives; (f) UAS / DRONE cybersecurity under 14 CFR Part 107 + Remote ID rule + UAS Traffic Management (UTM); (g) SUPPLY CHAIN cybersecurity for aviation including alignment with CISA Cyber Performance Goals (CPGs) + NIST SSDF + Executive Order 14028; (h) FAA INTERNAL information security via FAA Order 1370.123A; (i) INDUSTRY COLLABORATION via the Aviation Cybersecurity Working Group (ACWG) + the Aviation Cyber Initiative (ACI) led by FAA + DOT + DHS / CISA + DOD. This corpus node tracks the framework at sector-application level; substantive technical requirements come from the underlying RTCA / EUROCAE standards (DO-326A family - copyrighted, needs_licensed_copy) + the FAA Advisory Circulars + the applicable 14 CFR airworthiness provisions. Status: referenced (distributed sector-application view of FAA aviation cybersecurity policy stack; substantive obligations live in the RTCA / EUROCAE standards + 14 CFR provisions + FAA ACs + FAA Strategy).
FAA Aircraft Systems Information Security Protection (ASISP) is a compliance framework from United States (FAA design approvals and operators) with 4 domains and 12 controls that map to 4 other frameworks. The largest domains are Proposed 14 CFR 33.28(n) and 35.23(f) with appendices A: engines and propellers – FAA Aircraft Systems Information Security Protection (ASISP) (4 controls), ASISP special conditions in force for transport category airplane certification (the three criteria) – FAA Aircraft Systems Information Security Protection (ASISP) (3 controls), Proposed 14 CFR 25.1319 and appendix H: transport category airplanes – FAA Aircraft Systems Information Security Protection (ASISP) (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
ASISP special conditions in force for transport category airplane certification (the three criteria) – FAA Aircraft Systems Information Security Protection (ASISP)
| Code | Title |
|---|---|
| faa-aircraft-systems-information-security-protection-asisp::SC.1 | SC.1 Isolation from or protection against unauthorized access |
| faa-aircraft-systems-information-security-protection-asisp::SC.2 | SC.2 Prevention of inadvertent and malicious changes and adverse impacts |
| faa-aircraft-systems-information-security-protection-asisp::SC.3 | SC.3 Procedures to maintain the cybersecurity protections |
Means of compliance and the operator's aircraft network security program – FAA Aircraft Systems Information Security Protection (ASISP)
| Code | Title |
|---|---|
| faa-aircraft-systems-information-security-protection-asisp::ANSP | ANSP Operator's aircraft network security program (AC 119-1A) |
| faa-aircraft-systems-information-security-protection-asisp::MOC | MOC Accepted means of compliance: the ASISP issue papers, AC 20-XXX and the RTCA standards |
Proposed 14 CFR 25.1319 and appendix H: transport category airplanes – FAA Aircraft Systems Information Security Protection (ASISP)
| Code | Title |
|---|---|
| faa-aircraft-systems-information-security-protection-asisp::25.1319(a)(1) | 25.1319(a)(1) Identify and assess security risks from all IUEI |
| faa-aircraft-systems-information-security-protection-asisp::25.1319(a)(2) | 25.1319(a)(2) Mitigate the security risks as necessary for safety, functionality and continued airworthiness |
| faa-aircraft-systems-information-security-protection-asisp::25.1319(a)(3) | 25.1319(a)(3) Instructions for continued airworthiness that maintain the protections |
Proposed 14 CFR 33.28(n) and 35.23(f) with appendices A: engines and propellers – FAA Aircraft Systems Information Security Protection (ASISP)
| Code | Title |
|---|---|
| faa-aircraft-systems-information-security-protection-asisp::33.28(n) | 33.28(n) Engine control, monitoring and auxiliary systems protected from IUEI |
| faa-aircraft-systems-information-security-protection-asisp::35.23(f) | 35.23(f) Propeller control, monitoring and auxiliary systems protected from IUEI |
| faa-aircraft-systems-information-security-protection-asisp::a33.3(a)(10) | a33.3(a)(10) Engine ICA: secure transfer of software and data |
| faa-aircraft-systems-information-security-protection-asisp::a35.3(a)(10) | a35.3(a)(10) Propeller ICA: secure transfer of software and data |
Your Compliance Coverage
If you comply with FAA Aircraft Systems Information Security Protection (ASISP), you already cover:
Maps to 4 other frameworks
Coverage is not the same as your position
This page shows what FAA Aircraft Systems Information Security Protection (ASISP) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is FAA Aircraft Systems Information Security Protection (ASISP) and who does it apply to?
FAA Aircraft Systems Information Security Protection (ASISP) is a compliance framework from United States (FAA design approvals and operators) with 4 domains and 12 controls. The 'FAA Cybersecurity Framework for Aviation' is not a single FAA-published document but a DISTRIBUTED U.S. aviation cybersecurity policy stack maintained by the Federal Aviation Administration (FAA) covering: (a) AIRCRAFT cybersecurity airworthiness under 14 CFR Part 25 + Part 23/27/29 (Special Conditions historically + Notice of Proposed Rulemaking 2024 NPRM to codify cybersecurity as a standing airworthiness requirement); (b) ADVISORY CIRCULARS AC 119-1 (Cybersecurity for Operators), AC 25-21 (Aircraft Network Security Architecture), AC 23-XX series (general aviation), AC 27-XX series (rotorcraft); (c) RTCA / EUROCAE INDUSTRY STANDARDS DO-326A / ED-202A (Airworthiness Security Process Specification), DO-356A / ED-203A (Airworthiness Security Methods + Considerations), DO-355A / ED-204A (Information Security Guidance for Continuing Airworthiness), ARINC 811 (Aircraft Network Security Architecture); (d) AIR TRAFFIC MANAGEMENT cybersecurity through the FAA Cybersecurity Strategy + the National Airspace System (NAS) cybersecurity program; (e) AIRPORT cybersecurity coordinated with TSA + DOT cybersecurity initiatives; (f) UAS / DRONE cybersecurity under 14 CFR Part 107 + Remote ID rule + UAS Traffic Management (UTM); (g) SUPPLY CHAIN cybersecurity for aviation including alignment with CISA Cyber Performance Goals (CPGs) + NIST SSDF + Executive Order 14028; (h) FAA INTERNAL information security via FAA Order 1370.123A; (i) INDUSTRY COLLABORATION via the Aviation Cybersecurity Working Group (ACWG) + the Aviation Cyber Initiative (ACI) led by FAA + DOT + DHS / CISA + DOD. This corpus node tracks the framework at sector-application level; substantive technical requirements come from the underlying RTCA / EUROCAE standards (DO-326A family - copyrighted, needs_licensed_copy) + the FAA Advisory Circulars + the applicable 14 CFR airworthiness provisions. Status: referenced (distributed sector-application view of FAA aviation cybersecurity policy stack; substantive obligations live in the RTCA / EUROCAE standards + 14 CFR provisions + FAA ACs + FAA Strategy). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does FAA Aircraft Systems Information Security Protection (ASISP) actually require?
FAA Aircraft Systems Information Security Protection (ASISP) has 12 controls organised across 4 domains. The largest domains are Proposed 14 CFR 33.28(n) and 35.23(f) with appendices A: engines and propellers – FAA Aircraft Systems Information Security Protection (ASISP) (4 controls), ASISP special conditions in force for transport category airplane certification (the three criteria) – FAA Aircraft Systems Information Security Protection (ASISP) (3 controls), Proposed 14 CFR 25.1319 and appendix H: transport category airplanes – FAA Aircraft Systems Information Security Protection (ASISP) (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of FAA Aircraft Systems Information Security Protection (ASISP) do I already cover?
FAA Aircraft Systems Information Security Protection (ASISP) maps to 4 other compliance frameworks. The top mapping partners are EU NIS2 Directive - Transport Sector Requirements (11% coverage), EASA Part-IS - Information Security in Aviation (7% coverage), ICAO Annex 17 - Aviation Security (AVSEC) (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement FAA Aircraft Systems Information Security Protection (ASISP)?
Start your FAA Aircraft Systems Information Security Protection (ASISP) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about FAA Aircraft Systems Information Security Protection (ASISP) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 12 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 704 frameworks.
Get Started Free →Free forever — no credit card required