CAA ASSURE Cyber Security Audit

ASSURE Cyber Security Scheme process

The Cyber security Oversight Process for Aviation is covered in CAP 1753 and consists of the six key steps outlined below:
1. Engagement
2. Critical systems scoping
3. Cyber self-assessment for aviation
4. ASSURE Cyber Audit
5. Provisional Statement of Assurance; and
6. Final Statement of Assurance and Letter of Compliance

The CAA Cyber Oversight team will assess the applicability of each step with you during the initial engagement phase and each step will be discussed, agreed and determined. The CAA will base this discussion on several factors including the assessment of cyber security risk, your organisation’s complexity and any regulatory requirements that apply. 

If deemed applicable by the CAA, you will need to procure cyber audit services from an accredited ASSURE Cyber Supplier such as LRQA. Your organisation will be required to make the following available:
•    Completed Critical Systems Scoping Template;
•    Completed Critical system scoping diagrams;
•    Completed CAF for Aviation for all in-scope systems; and
•    All necessary supporting evidence.

Following the self-assessed ASSURE Cyber Audit, our ASSURE Cyber Professionals will review and evaluate the ASSURE-specific areas of the CAF for Aviation and issue an ASSURE Audit Report to you detailing:
•    A validated opinion of ‘achieved’, ‘partially achieved’ or ‘not achieved’ with associated commentary against each CAF for Aviation contributing outcome.
•    Recommendations where ‘partially achieved’ or ‘not achieved’ contributing outcomes have been identified. You may use this to update your Corrective Action Plan section of the CAF for Aviation.

At LRQA, we have a complete range of accredited ASSURE Cyber Professionals across the three specialism areas.  As well as being an accredited ASSURE Cyber Supplier, we have extensive experience working in the aviation industry on cyber security assessments and audits, threat hunting and penetration testing exercises as well as PCI DSS engagements. 

We can also provide proactive, actionable guidance and advice on the technical aspects of IT/OT systems as well as researching legacy or niche elements and developing capability and organisational cyber strategy.

Why work with us?