Aviation, transport and logistics

Safety-regulated operations, dense operational technology in airports, ports and terminals, and interdependence with government systems, ground handlers and freight partners that few operators have mapped end to end.

SECTOR PACK ADDS: Regulation, loss scenarios, indicators and control emphasis
SCENARIOS IN THIS PACK: 6 quantifiable loss scenarios
BUILT ON: The same control library and the same five pillars

What makes this sector different

The platform does not change. The regulation, the scenarios and the emphasis do.

Safety regulators are now cyber regulators. Civil aviation and maritime authorities set cyber requirements alongside the national regime.
Dense operational technology. Baggage systems, terminal operating systems, cranes, fuel and access control run on estates never designed to be governed as IT.
Deep interdependence. Ground handlers, freight forwarders, customs and immigration systems sit inside the same operational flow.
Disruption is immediately visible. An outage becomes public within minutes, so the reputational component of loss is unusually front-loaded.
Passenger data crosses borders by design. Transfer obligations are structural rather than occasional.

Regulation and standards in scope

Indicative, and additional to the market pack for the jurisdictions you operate in. Applicability is confirmed per client during scoping.

Civil aviation authority cyber requirements
Maritime and port authority requirements
NCA ECC-2:2024
NCA OTCC-1:2022
UAE Information Assurance Standards
IEC 62443
ISO 22301
NCEMA 7000
UK NCSC CAF
UK GDPR and DPA 2018
PCI DSS 4.0

Market packs by jurisdiction

Loss scenarios in the sector pack

Each arrives with FAIR parameters and calibration guidance, so it can be quantified in USD rather than described.

Terminal or baggage system outage

Operational technology failure with immediate passenger impact and a public consequence within the hour.

Ground handler or partner compromise

An incident at a partner inside the operational flow, disrupting service without touching your systems.

Passenger data breach

Cross-border personal data exposure with obligations in several jurisdictions simultaneously.

Port operating system disruption

Cargo movement halted, with contractual penalties and national economic visibility.

Precautionary operational restriction

Operations curtailed because segregation from a compromised corporate estate could not be demonstrated quickly.

Access control system failure

Physical and logical security converging in a safety-regulated environment.

How quantification works

Where the emphasis falls

Operational technology and partner dependencies in the asset and supplier masters; safety-regulator requirements alongside the national pack in Comply; and short impact tolerances with rehearsed crisis communication in Withstand.

How sector packs sit in the architecture · How it reaches the business

Talk through your sector position

We will walk the regulation that applies to you, the scenarios worth quantifying first, and what a realistic first ninety days looks like.

Book a working session