CAP 1850

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-06-06 CAA issues Issue 1 of CAP3120, its Cyber Security Enforcement Policy (first published February 2025)
2. 2024-05-02 CAP1753, the Cyber Security Oversight Process for Aviation, is reissued as Version 3
3. 2024-02-27 CAA publishes its Cyber Security Oversight Strategy 2024-26 (CAP2976)
4. 2020-08-19 CAP1850 Version 2 and CAP1849 Version 2 (critical systems scoping guidance) are published

1. 2020-08-19
   CAP1850 Version 2 RevisionCurrent

   Second publication of the guidance on completing the CAF for Aviation and the Statement of Assurance. source

2. —
   CAP1850 (first publication) Major version

   First publication of the Cyber Assessment Framework for Aviation guidance. source

Aviation organisations the CAA notifies as in scope, in three tiers: NIS operators of essential services and directed UK aerodromes and air carriers.

Regulations

CAP 1753 is used to oversee the cyber security requirements in the NIS Regulations 2018 and the National Aviation Security Programme (NASP). source

Tiers

Tier 1 is operators of essential services under the NIS Regulations; Tiers 2 and 3 are directed UK aerodromes and directed UK air carriers. source

Profiles

Each organisation is assigned a profile, developed with the NCSC, defining the objectives it is expected to meet, based partly on its assessed complexity. source

Scoping

Organisations scope the systems to be assessed using CAP1849, the Cyber Security Critical Systems Scoping Guidance. source

Framework

Adapted from the NCSC core CAF v3.0: fourteen principles across four objectives, broken into thirty-nine contributing outcomes with indicators of good practice. source

A self-assessment in the CAF for Aviation, verified by an ASSURE cyber audit, then a corrective action plan and a CAA Cyber Security Certificate of Compliance.

Self-assessment

The organisation completes the CAF for Aviation for each in-scope system, with references to evidence, and returns it to the CAA. source

ASSURE audit

The organisation procures an ASSURE cyber audit, initially and then at intervals the CAA specifies; significant scope changes may trigger an interim audit. source

Corrective action plan

Gaps between the assigned profile and the audit outcome go into a corrective action plan, which the CAA assesses within 60 days; progress is reported quarterly until closed. source

Certificate

After a signed Statement of Assurance, the CAA issues a Cyber Security Certificate of Compliance on completion of Stages 1 to 7. source

Changes

Changes to responsible persons, system scope, controls or the corrective action plan must be notified within 30 days. source

Engagement first, then the enforcement routes of each regulation; for NIS the DfT and CAA step up to monetary penalties only as a last resort.

Enforcement policy

CAP3120 sets out how the CAA Cyber Team responds to identified or suspected non-compliance with the cyber provisions of each regulation it oversees. source

NIS stepped approach

For NIS, the DfT and CAA as co-competent authorities use a stepped approach starting with advice and persuasion; a penalty is likely only in extreme cases. source

1. Guidance CAP1850 Cyber Assessment Framework (CAF) for Aviation
2. Guidance CAP1753 The Cyber Security Oversight Process for Aviation
3. Guidance CAP1849 Cyber Security Critical Systems Scoping Guidance
4. Guidance CAP2976 Cyber Security Oversight Strategy 2024-26
5. Guidance CAP3120 Cyber Security Enforcement Policy

1. UK NIS Regulations

   The NIS Regulations 2018 set the legal duties and penalties; the CAA uses the CAF for Aviation to oversee aviation operators of essential services under them.

2. NCSC

   The NCSC's core Cyber Assessment Framework, from which the CAA adapted the CAF for Aviation.

3. EASA Part-IS

   The EU aviation information security rules (Part-IS), rather than the UK CAA's oversight framework.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to CAP 1850 (RSS)