CAA ASSURE and CAP 1753: Does UK Aviation Need a Penetration Test?

No. The CAA’s cyber security oversight process, CAP 1753, does not mention penetration testing. Where it asks for an audit, that audit checks your cyber self-assessment and is carried out by an ASSURE supplier or by the CAA, depending on your tier. A penetration test is a separate piece of work that aviation organisations and their suppliers commission for their own assurance.

Does CAP 1753 require a penetration test?

No. CAP 1753 sets out an eight-stage oversight process built around a self-assessment, a verification audit and a corrective action plan. The text of CAP 1753 does not mention penetration testing, so the document does not ask aviation organisations for one by name.

The CAA’s cyber security oversight page says its approach, the Cyber Security Oversight Process for Aviation, “is laid out in CAP 1753” and “consists of eight key steps”. The stages run from engagement and the nomination of cyber key roles, through system scoping and cyber assessment, to assessment verification, a corrective action plan, a certificate of compliance and ongoing oversight.

CAP 1753 says it is currently used to oversee the cyber security requirements in the Network and Information Systems Regulations 2018 and the National Aviation Security Programme. The CAA notifies each aviation organisation that it is in scope and assigns it a profile at the engagement stage.

What does the CAA actually ask for on audits and testing?

The CAA asks for a verification audit of your cyber self-assessment, not a penetration test. The audit route depends on your tier. In Tiers 1 and 2, CAP 1753 has the aviation organisation submit to and procure an ASSURE cyber audit. In Tier 3, the audit is undertaken by the CAA’s Cyber Oversight team.

For Tiers 1 and 2, CAP 1753 says the aviation body submits to and procures “an ASSURE cyber audit”. For Tier 1 it adds that, under exceptional circumstances, the CAA’s Cyber Security Oversight team may undertake an audit instead of, or in addition to, an ASSURE cyber audit. For Tier 3, the audit is undertaken by the CAA’s Cyber Oversight team. Tier 1 covers operators of essential services under the NIS Regulations. Tiers 2 and 3 cover directed UK aerodromes and directed UK air carriers.

On the self-assessment, CAP 1753 describes the Cyber Assessment Framework for Aviation as “an outcome-focused assessment against fourteen principles across four broad objectives”. The organisation fills in the fields, including references to evidence. That is the document the audit then verifies.

On testing, the scheme’s own rules draw a line. The ASSURE implementation requirements published by CREST say ASSURE Cyber Professionals must not “perform any type of testing (e.g. penetration testing) during an ASSURE Cyber Audit, unless otherwise explicitly agreed by the aviation organisation”. So an ASSURE audit does not include a penetration test by default.

What is ASSURE?

ASSURE is the CAA’s third-party audit model. The CAA’s ASSURE page says that if you are asked to have an audit under the model, you will need to select a supplier from the list of accredited suppliers and arrange the commercial and financial aspects of the audit yourself.

The same page says ASSURE suppliers are all accredited by one of two certifying bodies, CREST or IASME, and are subject to a continuous accreditation process. Each ASSURE Cyber Professional is accredited in one or more specialisms, and the page states that all of them “must be represented on an ASSURE audit”: cyber audit and risk management, technical cyber security experts, and industrial control systems and operational technology experts.

Who can carry out the test?

Aviation organisations can use a CREST-accredited company or an ASSURE provider, depending on what their requirement states. EJN Labs is CREST-accredited. If the requirement is an ASSURE cyber audit, use a supplier from the CAA’s accredited list. If it is a penetration test, use the accreditation that the document asking for the test names.

The two jobs are different, so a company can be right for one and not the other. An ASSURE audit verifies a self-assessment against the Cyber Assessment Framework for Aviation. A penetration test attacks specific systems to find exploitable weaknesses. Neither CAP 1753 nor the ASSURE page names a penetration testing accreditation, so the accreditation comes from your customer, your insurer or your own policy.

Two practical questions help. First, which legal entity holds the accreditation, and can you see it on the scheme’s own register. Second, if the same company is doing both an ASSURE audit and a test, how the two engagements are separated in the contract.

What should an aviation organisation test?

Test the systems that hold passenger, crew and payment data, and the connections between you and your partners. CAP 1753 says systems in scope are those where a loss of confidentiality, integrity or availability could result in the inability to deliver the essential service or essential functions, and that this may include systems run on your behalf by third party suppliers.

• Passenger booking and PNR systems. Check-in, name record stores and OTA or travel-agent booking channels, including access to other passengers’ records and fare tampering.
• Crew portal and rostering. Role separation between crew, crew scheduling and HR admin, and the integrity of duty-time records.
• Maintenance and engineering platforms. The record-keeping and sign-off systems, tested as platforms. We test the record-keeping platform, never a live aircraft system.
• Interline, GDS and OTA integrations. The APIs and data exchanges between airlines, distribution systems and partners. See API penetration testing.
• Airport and ground operations. Check-in kiosks, gate and boarding systems and baggage-handling backends shared between airline, airport and ground handlers.
• Cloud and mobile. AWS, Azure and GCP configuration, and passenger and crew apps.

What evidence do you hand back?

Hand back a dated report with the scope, the method, each finding with a severity score, and what has been fixed. CAP 1753 does not specify a format for penetration test evidence, so match the report to the question you were asked. A retest report shows which findings are closed.

Practice varies, so treat the following as practice rather than a rule. Where an organisation completes its Cyber Assessment Framework for Aviation return, it can reference a test report as one of its evidence documents. Where an airline or airport asks a supplier for security evidence, a summary letter naming the scope, the date and the testing company is often asked for, with the full report shared under a confidentiality agreement.

For passenger and payment data, the requirements are separate. Booking and payment platforms can fall under PCI DSS, and personal data brings in UK GDPR Article 32. See our guides to PCI DSS penetration testing cost and GDPR penetration testing.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for aviation

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated aviation service for airlines, airports, ground handlers and the aviation technology suppliers behind them. We test passenger booking and PNR systems, crew rostering portals, maintenance and engineering platforms, interline and GDS integrations, and airport ground operations systems.

The work is done by UK-based, CREST-certified testers. You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing. Retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. Testing is safe by default on production, with no denial of service, and out of hours slots are available.

Frequently Asked Questions

Does the CAA require a penetration test?

CAP 1753 does not mention penetration testing. It asks for a cyber self-assessment and a verification audit, carried out by an ASSURE supplier in Tiers 1 and 2 and by the CAA in Tier 3. Aviation organisations still commission penetration tests for their own assurance and when customers ask for them.

Is an ASSURE audit the same as a penetration test?

No. An ASSURE audit verifies a self-assessment. The implementation requirements for ASSURE say its Cyber Professionals are not to perform any type of testing, such as penetration testing, during an ASSURE audit unless the aviation organisation explicitly agrees. A penetration test is a separate engagement.

Does the testing company need to be CREST-accredited or an ASSURE provider?

Aviation organisations can use a CREST-accredited company or an ASSURE provider, depending on what their requirement states. EJN Labs is CREST-accredited. An ASSURE audit needs a supplier from the CAA’s accredited list. For a penetration test, use the accreditation named in the document that triggered the request.

Does CAP 1753 apply to aviation technology suppliers?

The CAA notifies aviation organisations that they are in scope. CAP 1753 says scoping may include systems and services operated on behalf of the organisation by third party suppliers. In our experience, suppliers are usually asked for security evidence by their aviation customer on the systems they run for them.

How often should an aviation organisation run a penetration test?

CAP 1753 sets no interval for penetration tests. It says the audit is undertaken initially and at further intervals as specified by the CAA. For testing, a common starting point is once a year and again after a significant change, but your customer, insurer or internal policy sets the interval that applies.

Get a quote for your estate

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Airlines, Airports and Aviation Suppliers, Best Penetration Testing Companies for UK Aviation, penetration testing for UK aviation, NIS Regulations and penetration testing, the NCSC Cyber Assessment Framework and penetration testing and winning transport operator contracts.