DO-326A

Aviation Cybersecurity: airworthiness, avionics supplier verification, software integrity.


Region	International
Country or scope	International
Sector	Aerospace
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers DO-326A

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for DO-326A.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for DO-326A and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`DO326A-SCOPE` Security Scope Asset Identification	The airworthiness security process begins by identifying the assets within the security scope, requiring a complete enumeration of the software components in the certified system (DO-326A, security scope definition / asset identification)	Scan
`DO326A-CONFIG` Certified Configuration Traceability	Security assurance applies to a specific certified configuration, so every software component must record its exact version (DO-326A, security development and configuration identification)	Scan
`DO326A-SPEC` No Ambiguous Configurations	Airworthiness security assessment cannot be performed against floating or ranged versions; declared versions must be exact (DO-326A, configuration control expectations)	Scan
`DO326A-INT` Software Integrity Protection	Protection of aircraft systems against intentional unauthorised electronic interaction includes verifying that loaded software is authentic and unmodified, evidenced by integrity hashes (DO-326A, security measures against tampering; cf. field-loadable software integrity practice)	Scan
`DO326A-SUPP` Supplier Security Verification	Security risk assessment must cover software obtained from suppliers, requiring attribution of each component to its supplier for flow-down of security obligations (DO-326A, supply chain considerations in the security process)	Scan
`DO326A-EVID` Certification Evidence Identity	Airworthiness security evidence submitted for certification must be identifiable and dated so authorities can tie it to the approved design (DO-326A, security assurance documentation)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DO326A-4.1`	Conduct Airworthiness Security Risk Assessment
`DO326A-4.2`	Define Security Architecture for Avionics Systems
`DO326A-4.3`	Implement Security Controls Meeting IDAL Requirements
`DO326A-5.1`	Perform Security Verification Against Architecture
`DO326A-5.2`	Produce and Maintain the Airworthiness Security Plan
`DO326A-6.1`	Manage Ongoing Airworthiness Security Threats Post-Certification
`DO326A-6.2`	Coordinate Security Vulnerability Disclosure with Aviation Authorities
`DO326A-3.1`	Apply Security Process Assurance Commensurate with DAL

Policy templates

Written for DO-326A:

Airworthiness Cybersecurity Plan (DO-326A)
Avionics Cybersecurity Vulnerability Disclosure Policy (DO-326A)

And 22 from the standard set, adapted to DO-326A.