Securing the future of ASSURE

The ASSURE scheme is based upon sound principles, as it uses the National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF). But the CAF for aviation is far more prescriptive. Where the NCSC CAF, which applies to critical national infrastructure, contains four objectives (A-D) with advisory statements under each, the CAF for aviation uses each of these statements as an objective with indicators of good practice marked against these.

Every outcome has multiple sub-category statements spanning A-D, and airports are required to carry out all the assessments for each and every critical system. This means that a tier two airport will typically have to complete these assessments 20-30 times to cover airside and landside critical systems such as radar, telecoms, CCTV, ground lighting, and network storage, which can take months.

In a bid to create some flexibility, the requirements are open to interpretation. Airports can even choose to disregard the statements altogether and demonstrate compliance using alternative methods of their choosing. For example, perhaps the system being assessed features advanced technology not reflected in the indicators of good practice. In this case, airports can use an alternative method to show they have met the outcome.

Unfortunately, this flexibility has created a certain amount of ambiguity, which has resulted in some inconsistency as to how the CAF is applied. While some organisations are being extremely thorough in evidencing their compliance, which is to be applauded, others are doing much less – diluting the value of the exercise.

Acceptable forms of evidence can take various forms. System documentation, manuals, reports, meeting minutes, and interviews with key personnel, are all admissable but teams must document both the process of achieving compliance as well as the outcome. They’ll need to identify what evidence to submit and liaise with one another to create/collate this information, which can prove logistically challenging. 

For these reasons, many choose to appoint a third-party assessor for the self-assessment stage as well as for the audit proper to ensure the correct evidence is generated and time (and costs) are kept under control.

Another issue that has arisen as a result of basing the scheme on the NCSC CAF is that it has revealed an IT bias. Assumptions are made that the systems being assessed are modern, connect to the internet and are designed with security in mind when in fact many airport systems could be over thirty years old with no internet connectivity. 

Radar systems, such as the Watchman, are a perfect example of a system that is classed as critical, but that actually have very little cyber functionality. Consequently, much of the criteria simply doesn’t apply but the process must still be followed and evidence provided. 

Once the evidence has been compiled, the organisation will need to select an independent assessor (a second assessor if the organisation has already used an ASSURE assessor during the self-assessment) who will carry out the audit. 

This should be performed using all the observations, evidence, controls, guidance, standards or good practice provided from the self-assessment against the indicators of good practice and used to deliver a verdict of ‘achieved’, ‘partially achieved’ or ‘not achieved’ with commentary on each CAF contributing outcome. Recommendations are then made for those areas deemed ‘partially achieved’ or ‘not achieved’ – forming the basis of a Corrective Action Plan, which is completed within an agreed timeframe.

Happily, it's common that even those organisations that have met the compliance requirements are still choosing to implement a comprehensive programme of works post-assessment to address issues, which shows the standard is not being viewed as a tick-box exercise.

To capitalise upon this enthusiasm, the ASSURE scheme now needs to adapt. It’s already built upon the sturdy foundations of the NCSC CAF and adheres to a number of aviation industry regulations or guidance. But it must become more relevant, focused and streamlined to ease workloads. We’d also like to see more of a narrative response required from the auditor in response to each of the 39 questions to give the organisation more information.

As with any new standard, there were always going to be teething issues when introducing ASSURE. There are processes in place to allow for review, with assessors required to undergo a ‘wash-up’ post-audit. This allows discussion at a high level of how the assessment went and so it is anticipated that this feedback will help shape the standard and its guidance, ensuring ASSURE can fulfil its potential in making aviation systems and processes more cyber secure.

Main image: