Transport

Aviation

An airport is a small city run by OT that passengers never see: baggage, fuel, lights, boarding bridges and air conditioning.

AirportsAirside systemsFuel and ground operations
Talk to an advisor For product makers

How the process runs

From kerb to runway

Passengers and bags move through the terminal while aircraft are guided to stands, fuelled and turned around. Each step depends on systems owned by different companies sharing one site.

  1. Stage 1: Terminal

    HVAC, lighting, lifts, escalators and access control run the building.

    Control systems
    Building management systemAccess controlLifts and escalators

  2. Stage 2: Baggage

    Bags are checked in, screened and sorted to the right flight.

    Control systems
    Baggage handling PLCsHold baggage screeningSortation control
    Challenge3

  3. Stage 3: Stands and gates

    Aircraft are guided to stands and connected to bridges, power and air.

    Control systems
    Passenger boarding bridgesVisual docking guidanceGround power and air

  4. Stage 4: Airfield

    Runway and taxiway lights guide aircraft day and night.

    Control systems
    Airfield ground lighting controlConstant current regulators
    Challenge3

  5. Stage 5: Fuel

    Fuel farms and hydrant systems deliver fuel to aircraft.

    Control systems
    Fuel farm SCADAHydrant controlTank gauging

  6. Stage 6: Airport operations

    The operations centre coordinates flights, stands, gates and resources.

    Control systems
    Airport operational databaseFlight information displaysCommon-use check-in
    Challenge2
Across every stage

Attackers rarely go straight for a controller. They travel through these shared systems, so this is where we look first.

Many companies on one siteShared networksVendor support contractsLinks to airline systems
Challenges14

For product makers

Building systems for airports?

Airport systems are built by specialist makers, and the rules reach them through the CRA, the Machinery Regulation and their customers' own obligations.

What makers build
  • Baggage handling systems
  • Passenger boarding bridges
  • Airfield lighting control
  • Fuel and hydrant control
  • Airport operations software
What customers and regulators ask of the product
EU Cyber Resilience Act

Airport equipment and software sold in the EU need CE marking under the CRA from 11 December 2027. Products certified under EASA rules are outside it.

EU Machinery Regulation 2023/1230

Due to apply from 20 January 2027 for baggage systems, boarding bridges and other machines.

NIS2 and EASA Part-IS

Airport operators must manage supply chain risk, so their security requirements now reach suppliers.

Where product makers start
EU CRA ComplianceGap to conformity assessmentIEC 62443-4-1 SDLC CertificationYour way of working, audit-proofIEC 62443-4-2 CSA CertificationThe features your product is missing

For plant owners

Where it gets hard, and how we tackle it

We start from how your process runs, fix what matters most first, and use what you already own wherever we can.

  1. Across every stage

    Many companies, one site

    The airport operator, airlines, ground handlers, fuel companies and concessionaires share buildings and often networks. A weak link anywhere can reach systems it should not.

    How we tackle it

    We map who owns what and who connects where, then set boundaries and rules for each party.

    Risk Assessment
  2. 06 Airport operations

    Shared suppliers become shared outages

    In September 2025, ransomware at Collins Aerospace disrupted check-in at Heathrow, Brussels and Berlin at the same time. The airports were not breached; a common supplier was. Source: RTX filing

    How we tackle it

    We identify single-supplier dependencies and plan how to operate without them: manual fallback, clear roles, and a response you have practised.

    Incident Response TTX
  3. 02 Baggage04 Airfield

    Baggage and airfield lighting cannot fail

    A baggage system outage strands bags within hours, and an airfield lighting failure can close a runway at night.

    How we tackle it

    Zone-based design and passive monitoring for baggage and airfield systems, with every change tested before it goes live.

    Cybersecurity Solutions
  4. Across every stage

    Aviation rules now cover cyber

    EASA Part-IS has applied to EU aerodrome operators since 16 October 2025, and ICAO Annex 17 asks states to ensure operators protect their critical systems.

    How we tackle it

    We build the programme and the evidence: risk assessment, controls, incident response and reporting that meet Part-IS, NIS2 and your national rules.

    Cybersecurity Program

Where plant owners usually start

Three ways in

01Gap AssessmentRapid maturity review02Risk AssessmentIEC 62443 / NIST, detailed findings03Incident Response TTXPrepare for the D-day

Rules and standards

What applies in aviation

  • IEC 62443International

    Zones and conduits for baggage, airfield lighting, fuel and building systems.

  • ICAO Annex 17, Standard 4.9.1International

    States must ensure operators identify their critical systems and data and, based on risk, protect them from unlawful interference.

  • EASA Part-ISEuropean Union

    Information security management for aerodrome operators since 16 October 2025, and for most other approved organisations since 22 February 2026.

  • NIS2European Union

    Covers airport managing bodies, air carriers and air traffic control.

  • CERT-In Directions, 2022India

    Cyber incidents must be reported to CERT-In within 6 hours.

Talk to RelyBlue

Operating in aviation?

An honest conversation about your OT environment. No sales pressure, no fear tactics.

  • You talk to a senior advisor, never a salesperson