Applicability of NIS2 to Aviation Manufacturing

ASD expresses concerns over the application of the NIS2 directive to its members in the aviation manufacturing sector, and argues that the existing regulatory framework, particularly Part IS (EU 2022/1645), already provides a robust structure for implementing cyber security measures in aircraft production.

ASD argues that subjecting its members to NIS2 imposes an unnecessary burden, leading to increased regulatory complexity and higher costs without a substantial enhancement in cyber security compared to Part IS. ASD notes that the scope of NIS2 does not align perfectly with the specificities of aircraft manufacturing, making it redundant and disproportionate.

Key points raised by ASD:

• Regulatory complexity: ASD highlights the existing oversight by EASA and Member State civil aviation authorities, stating that the application of NIS2 would introduce additional authorities, resulting in administrative burdens for its members.
• Part IS adequacy: Part IS, a sector-specific cyber security regulation, is deemed more comprehensive than NIS2 for critical entities, and ASD argues for its recognition as a lex specialis.
• Sector-specific risk assessment: ASD questions the lack of a sector-specific risk assessment justifying the inclusion of aircraft manufacturers under NIS2, asserting that safety impacts are adequately addressed in Part IS.
• Economic impact consideration: ASD argues that the low economic impact of a cyber security incident in the aviation sector does not justify the additional administrative controls introduced by NIS2.

ASD recommendations

• ASD urges the European Commission to formally recognise Part IS as the lex specialis for NIS2 where applicable to aviation manufacturers, emphasising the global nature of the aviation sector and the potential disadvantage to European manufacturers compared to their global competitors.