Build an airline security assessment across several airports by defining the aircraft operator's activities at each station, then examining the handovers with airports, handlers and other service providers. A common company procedure does not establish that every station has the same operating conditions or control performance.
Start with the airline's service and operating model: where it operates, what it carries, which activities it performs itself and which it contracts. The assessment needs a network view without losing the differences that matter locally.
This article uses an Australian regulatory context and focuses on assessment structure. It does not provide screening instructions, aircraft-security procedures or an approved transport security programme. Aviation security specialists must verify current requirements and the operator's approved arrangements.
Keep the aircraft operator's scope distinct
An airline and an airport share an operating environment, but they do not have identical responsibilities. The airline needs to understand its own activities and the controls on which it relies, including interfaces managed by others.
CISC's aircraft-operator security guidance addresses operator-specific security programmes and risk assessments relative to operations. Confirm applicability through the current official requirements and the operator's authorised compliance process; do not assume another participant's programme covers the airline's obligations.
Include relevant stations, aircraft-operation interfaces, staff, information and contracted services in the assessment boundary. Explain exclusions and where separate assessments provide necessary evidence.
For international operations, identify the relevant jurisdiction at each station. Do not transfer an Australian rule or approval to another country without verification. Maintain regulatory details in the operator's controlled compliance records rather than a generic public checklist.
Build a station profile before assigning ratings
For each station, record the operating pattern, airline presence, service providers, local decision authority and material dependencies. Note the source and date of the information.
Focus on differences that can change a control's operation: a staffed airline office versus reliance on a handler, regular versus infrequent operations, or a permanent arrangement versus a temporary change. Avoid assuming that station size alone determines risk.
Ask the station team to explain ordinary exceptions and disrupted operations. A procedure may work well on a normal departure while responsibilities become unclear during a delayed service or change of provider.
Protect sensitive operating information. The assessment's broad conclusions can be communicated without circulating detailed configurations, restricted procedures or vulnerabilities beyond authorised recipients.
Map handovers as decisions
Identify who requests an action, who authorises it, who performs it and who confirms completion. Use the approved operational arrangements as the starting point.
A contract naming a service does not answer every handover question. The airline may need evidence that the service was provided in the relevant operating condition, and a clear route for exceptions that the provider cannot resolve alone.
Ask what happens if the expected person is unavailable. A local manager may know the informal solution, but the assessment should establish whether the solution is authorised, resourced and maintainable.
Record a shared interface once at network level where the arrangement is common, then attach station-specific evidence and exceptions. This avoids copying identical prose while still making local limitations visible.
Worked example: a changed ground-handling arrangement
A fictional airline changes a service provider at one station. The assessment examines the transition without disclosing operational security procedures.
| Question | Evidence required | Assessment implication |
|---|---|---|
| Has responsibility for each relevant task been accepted? | Approved task allocation and receiving-provider confirmation | An unconfirmed allocation remains an open transition condition |
| Can the provider use current instructions? | Controlled issue record and appropriate demonstration of understanding | Receipt alone does not establish capability |
| Can exceptions reach an authorised airline decision-maker? | Confirmed contact and delegation arrangements under the relevant shift conditions | An unavailable decision route may require an interim operating decision |
| Can the airline verify service delivery? | Agreed evidence and a proportionate assurance plan | A contract alone is insufficient evidence of performance |
The resulting risk concerns a change in a specific interface. It is not a claim that outsourced handling is inherently inadequate or that every station needs the same staffing model.
Separate network risks from local findings
A network risk may involve a shared supplier, common information service or central decision process. Its consequence can extend across stations even where each local team appears well organised.
A local finding may concern a station-specific handover, unavailable evidence or a recent operational change. Keep its owner and treatment visible rather than averaging it into a network score.
Use common assessment criteria to support comparison, while retaining the scenario and assumptions. Identical ratings can conceal different causes and treatment needs. Conversely, different ratings may be reasonable where operating conditions and consequences differ.
When consolidating findings, ask which actions belong to the airline centrally, which belong to a station and which require agreement with another participant. Assign a coordinating owner for cross-party decisions without pretending that coordination transfers legal responsibility.
Verify controls without disrupting operations
Use authorised records, interviews and planned observations or exercises. Coordinate with the airport and other affected participants before any test that could affect operational activity or trigger a response.
Choose evidence proportionate to the question. A document review may establish the current responsibility allocation. Demonstrating an exception route may require a clearly labelled exercise involving the people who staff it.
State the conditions and limits of verification. Evidence from one station should not automatically be treated as proof that the same arrangement works everywhere. Decide where common evidence is valid and where local confirmation is necessary.
Prioritise decisions and change triggers
For material gaps, state the exposure, existing protection, required decision, owner and acceptance evidence. Where a necessary arrangement is unresolved, refer the operating decision to the authorised aviation and business leaders.
Set review triggers for new stations, changed service providers, altered operating patterns and incidents that challenge assumptions. Keep links to the controlled programme and compliance process current through the operator's established governance.
Use a common assessment process across stations, with a clear scope for local evidence and exclusions.
Your next action is to compare two stations with meaningfully different operating models. Trace the same important interface at each and identify which assumptions can be shared and which need local evidence.
The paid SRMBOK Enterprise Security Risk Assessment Template provides a worked enterprise-level report structure. Adapt it to network and station findings, retaining aviation-specific requirements and controlled procedures in their proper records; the template is not an airline security programme or regulatory approval.