ICAO Annex 17 - Aviation Security (AVSEC)

ICAO Annex 17 (Aviation Security) to the Convention on International Civil Aviation (Chicago Convention 1944) provides Standards and Recommended Practices (SARPs) for safeguarding international civil aviation against acts of unlawful interference. First adopted 22 March 1974 in response to growing aircraft hijackings. Currently in Edition 12 (effective 11 November 2024); regularly amended (most recent Amendment 18 effective 16 November 2023 + Amendment 19 in preparation). Adopted by ICAO Council under Chicago Convention Article 37 (international standards and recommended practices). Mandatory for 193 ICAO Member States (with filing of differences procedure for non-compliance). Chapter 1 (Definitions) establishes vocabulary for: Act of Unlawful Interference + Aircraft Security + Airside + Aviation Security + Cargo + Catering Stores + Certification + Designated Authority + Disruptive Passe

• Annex 17 applicability per State + operator + airport + cargo handler + edition currency
• Chicago Convention Article 37 compliance + filing of differences register
• Definitions glossary mapped to national legislation + operator programme + training material
• ICAO Doc 8973 Aviation Security Manual restricted access + authorised entity register
• Aviation Security convention family ratification + national implementing legislation

• Stale Annex 17 edition referenced (not Amendment 18/19 current)
• Filing of differences not done for non-compliance
• Definitions inconsistent between national programme + operator programme
• Doc 8973 Aviation Security Manual not accessible to security personnel
• Conventions ratified but not transposed to national criminal law

Chapter 2 establishes the general principles of aviation security. 2.1 Objectives - primary objective of each Contracting State is the safety of passengers + crew + ground personnel + general public (in all matters related to safeguarding against acts of unlawful interference with civil aviation); each State shall ensure that the safety of passengers + crew + ground personnel + the general public is the primary consideration in any aviation operations. 2.2 International Cooperation - each State shall cooperate with other States as required to maintain security of civil aviation + as appropriate to threat conditions; reciprocal arrangements + information sharing + technical assistance + capacity building; coordination with regional and global organisations (IATA + ACI + ECAC + EASA + FAA + national CAAs + national CSIRTs + INTERPOL + WCO); ICAO Universal Security Audit Programme (USAP) Co

• National programme stating safety of passengers/crew/ground/public as primary objective
• International cooperation agreements + USAP-CMA participation + audit response
• GASeP 5 Priority Outcomes implementation matrix + national action plan + KPI
• Aviation security information classification + handling + access control + transmission encryption
• Inter-agency coordination (national CAA + national CSIRT + INTERPOL + WCO + IATA) MoUs + exercises

• Operator efficiency or commercial priority over passenger/crew/ground safety
• USAP-CMA findings not addressed within timelines
• GASeP Priority Outcomes treated as aspirational not operational
• Sensitive aviation security info on uncontrolled email or removable media
• Inter-agency coordination only after incident, no proactive exercise

Chapter 2 establishes the risk-based approach to aviation security. 2.4 Threat Assessment and Risk Management - each Contracting State shall continually monitor and adjust the level of threat for civil aviation within its territory and shall establish and implement policies + procedures + measures to adjust elements of its NCASP accordingly + based on a security risk assessment; threat assessment evaluates intent + capability + targeting + relevance to civil aviation operations + insider threat + cyber + adversary tactics techniques and procedures; vulnerability assessment + consequence analysis + risk treatment + residual risk + monitoring. Coordinated with ICAO Doc 8973 Annex 17 Threat and Risk Methodology + national intelligence + INTERPOL + RAILPOL + WCO. 4.9 Cyber Threats to Critical Aviation Systems (Amendment 17 effective 16 November 2018 + Amendment 18 expansion) - each Contracti

• Threat assessment register + intelligence inputs + adjustment to NCASP measures + cycle
• Risk register per aviation operation + vulnerability + consequence + treatment + residual + monitoring
• Critical ICT systems inventory per operator + system criticality + interface + data classification
• Cyber risk treatment per ICT system + national CSIRT coordination + 24h reporting + IATA cyber framework
• Supply chain cyber due diligence + vendor assessment + SBOM + 2024-2025 readiness (AI + quantum + autonomous + drone)

• Threat assessment annual snapshot not continuous adjustment
• Risk treatment without treatment decision documentation (transfer/accept/mitigate)
• Critical ICT systems incomplete (missing connected legacy)
• Cyber risk only at corporate IT, not operational aviation systems
• Supply chain cyber excluded from 4.9 scope

Chapter 3 establishes the organisation of aviation security. 3.1 National Organisation - each Contracting State shall establish and implement a written National Civil Aviation Security Programme (NCASP) to safeguard civil aviation operations against acts of unlawful interference; NCASP covers safeguarding policy + objectives + organisation + appropriate authority + national aviation security committee + airport security programmes + aircraft operator security programmes + air traffic services provider security programmes + air carriers + cargo and mail operators + catering operators + cleaning operators + threat and risk assessment + quality control + training + adjustment to threat. 3.1.2 Appropriate Authority - each State shall designate an Appropriate Authority responsible for the development + implementation + maintenance of the NCASP; sufficient authority + competence + resources +

• NCASP document + national legislation + Appropriate Authority signature + scope
• Appropriate Authority designation order + organisational chart + resourcing + independence statement
• NASC charter + membership + meeting minutes + decisions + inter-agency MoUs
• Airport + aircraft + ATS + cargo + catering operator security programme + Appropriate Authority approval
• Programme testing + drills + audits + review cycle + revision history

• NCASP exists but not approved by senior government or not aligned with current threat
• Appropriate Authority subordinate to operator (independence compromised)
• NASC not meeting regularly or only after incident
• Operator programme generic not site-specific + threat-relevant
• Programme review skipped beyond 12 months

Chapter 3 also establishes quality control + training requirements. 3.4 Quality Control - each State shall establish and implement a National Quality Control Programme to ensure that NCASP measures are effective; programme includes: audits (planned + announced) + inspections (planned + announced or unannounced) + surveys (assessment of need + procedure compliance) + tests (covert testing of security measures); reports + findings + corrective action + closure + escalation; assessment of operators + airports + cargo + catering + ATS + air carriers compliance. 3.4.3 Audits + Inspections + Surveys + Tests - independent quality control personnel + qualified + trained + competence + impartiality + access to all operations + protected from retaliation. 3.4.5 Certification of Screeners - screeners (passenger + cabin + hold baggage + cargo + catering + supplies) shall be certified per national pr

• National Quality Control Programme document + cycle + audit calendar + tools
• Quality control personnel qualification + independence + access authority + protection
• Screener certification programme + initial + recurrent + integrity testing + records per individual
• ASTP curriculum + role-based + competency-based + delivery + assessment + records
• Covert test reports + findings + remediation + closure + lessons learned + ICAO ATC certified

• Quality control programme paper-only (no actual audits or tests)
• Quality control personnel reports to operator (independence compromised)
• Screener certification at hire only (no recurrent + integrity)
• ASTP role-specific weak (generic awareness only)
• Covert test findings not actioned (closure overdue)

Chapter 4 establishes preventive security measures starting with access control + personnel security. 4.1 Measures Relating to Access Control - each State shall establish + implement measures to prevent unauthorised persons + vehicles + items from gaining access to airside areas + security restricted areas (SRAs); identification of persons authorised to access airside + SRAs through aviation security identification card (ASIC) or equivalent + photo + name + employer + access privilege + expiry + revocation; biometric or PIN access controls for SRAs; vehicle access controls + screening + escort; access boundary protection + perimeter fencing + gates + lighting + CCTV + monitoring + intrusion detection; ramp + boarding bridge + jet bridge + tarmac. 4.2 Measures Relating to Personnel - each State shall ensure that persons implementing security controls are subject to background check before

• Airside + SRA access control infrastructure + perimeter + CCTV + intrusion detection
• ASIC issuance procedure + photo + biometric + revocation + audit register
• Background check programme + initial + periodic + adverse event + criminal + intelligence vetting
• Insider threat programme + behavioural observation + continuous evaluation + reporting
• Visitor + contractor + escort policy + log + supervisor accountability

• Perimeter breaches due to inadequate fencing or CCTV gaps
• ASIC over-issued (too many persons with SRA access)
• Background check at hire only (no periodic re-investigation)
• Insider threat programme absent or only on US-flagged carriers
• Visitor/contractor unescorted in SRA after initial entry

Chapter 4 establishes cargo + mail + catering + stores + supplies security. 4.5 Measures Relating to Cargo + Mail + Other Goods - each State shall establish measures to ensure cargo + mail and other goods carried by aircraft are subjected to appropriate security controls to detect prohibited articles + explosive devices; secure supply chain approach (preferred): Regulated Agent + Known Consignor + Account Consignor + Authorised Economic Operator (AEO) + WCO SAFE Framework Authorised Economic Operator; Regulated Agent (RA3 in EU + equivalent) + Known Consignor (KC) responsible for screening + tamper-evidence + chain of custody; cargo screening per applicable to flight type (passenger + all-cargo + courier) + risk-based + 100 percent for passenger flights of high-risk origin; screening methods: X-ray + Explosive Detection Systems Cargo (EDS-C) + Explosive Trace Detection (ETD) + Canine Exp

• Regulated Agent + Known Consignor + AEO + WCO SAFE certification + supply chain validation
• Cargo screening methods register per origin + risk + combination of X-ray + EDS-C + ETD + canine + physical
• 100 percent cargo screening evidence for passenger flights of high-risk origin + records
• Catering + cabin stores + cleaner supplier KYC + insider threat + tamper-evident + delivery audit
• Chain of custody documentation + ULD seals + GPS tracking for high-risk/value/sensitive cargo

• Regulated Agent oversight only at certification (no continuous monitoring)
• Cargo screening single method (no combination per ICAO methodology)
• 100 percent passenger flight cargo screening slipping at peak
• Catering supplier KYC weak (only at contract, no continuous)
• Tamper-evident seal not verified at receiving

Chapter 4 establishes passenger + baggage screening requirements. 4.3 Measures Relating to Passengers + Cabin Baggage - each State shall establish measures to ensure originating passengers of international flights + their cabin baggage are screened + prevented from carrying prohibited articles or substances aboard aircraft (per ICAO Doc 8973 prohibited items list); screening at airport entrance to secure area + walk-through metal detector + X-ray of cabin baggage + body scanner + Explosive Trace Detection (ETD) + pat-down + behavioural detection; transfer/transit passengers screening per State arrangement; rescreening on first port of entry from State without equivalent screening; selectees + Secondary Security Screening Selection (SSSS); special category (diplomatic + state + escorted criminal). 4.4 Measures Relating to Hold Baggage - each State shall establish measures to ensure that o

• Passenger + cabin baggage screening procedures + WTMD + X-ray + AIT + ETD + behavioural detection + pat-down
• Hold baggage 100 percent EDS screening + reconciliation + no unaccompanied + transfer arrangements
• Selectee + SSSS process + criteria + screening pathway + denied boarding
• EDS performance + ECAC CEP certification + maintenance + calibration + image quality + algorithm updates
• Transit/transfer screening + first port rescreening + equivalency assessments + multilateral arrangements

• Cabin baggage X-ray relying solely on operator visual interpretation (no automated threat detection)
• Hold baggage 100 percent slipping during peak periods
• Selectee/SSSS process bypassed for VIPs
• EDS performance not periodically verified (CEP certification expired)
• Transit screening not done despite source State equivalency unverified

Chapter 4 also addresses special categories + weapons + in-flight security. 4.5 Measures Relating to Special Categories - each State shall establish appropriate special security controls for: diplomatic persons + State officials + escorted criminals + deportees + extradition + asylum seekers + unaccompanied minors + reduced mobility passengers + medical + animals; diplomatic immunity considerations + Vienna Convention; State aircraft. 4.6 Measures Relating to Weapons - prohibited articles list per ICAO Doc 8973 (firearms + explosives + incendiary + chemical + biological + nuclear + radiological + electroshock + cutting + sharp + clubs + tools + flammable); weapons carried by law enforcement + State officials only with prior notification + authorisation + State arrangements + secure container + ammunition; sky marshal arrangements; CBRN material screening + customs cooperation. 4.7 In-Fli

• Special category passenger procedures + diplomatic + escort + criminal + UM + RM + medical + Vienna Convention
• Weapons carriage authorisation + sky marshal coordination + secure container + notification
• IFSO programme + covert + armed + trained + coordinated + bilateral arrangements + custody
• Cockpit door reinforcement certification + intrusion-resistant + secondary barrier + procedure + crew training
• Prohibited articles list per current ICAO Doc 8973 + national supplements + signage + training

• Special category procedures stale (not adjusted to new arrangements)
• Weapons carriage permission documented in air not on ground (mismatch at gate)
• IFSO coordination with cabin crew unclear (cabin crew don't know IFSO presence)
• Cockpit door reinforcement certification expired or door procedure deviation
• Prohibited articles list stale (e-cigarette + lithium battery rules outdated)

Chapter 5 establishes management of response to acts of unlawful interference. 5.1 Contingency Plans - each State + airport operator + aircraft operator + ATS provider + cargo operator + catering shall develop and implement contingency plans + procedures + resources + training for response to acts of unlawful interference (hijacking + bombing + sabotage + assault + hostage taking + drone incursion + cyber attack + chemical/biological/radiological incident + active shooter + insider attack); coordination with national emergency response + emergency operations centre (EOC); aircraft hijack + ground emergency + airport closure; tabletop + functional + full-scale exercises annual minimum; family assistance + medical + psychological. 5.2 Notification - each State shall promptly notify ICAO + other States + agencies of acts of unlawful interference per Doc 8973 + ICAO Chronology of Acts of Unl

• Contingency plans per scenario (hijack + bomb + sabotage + hostage + drone + cyber + CBRN + insider) + resources
• Annual exercise programme + tabletop + functional + full-scale + multi-stakeholder + after-action report
• Notification procedures + ICAO + INTERPOL + State coordination + 24/7 contacts + communication template
• Investigation coordination + Annex 13 alignment + evidence preservation + chain of custody + criminal/civil
• Family assistance plan + medical + psychological + media coordination + post-incident review + lessons learned

• Contingency plans missing cyber + drone + insider scenarios
• Annual exercise tabletop only (no functional + full-scale)
• Notification delayed beyond 1 hour to ICAO + INTERPOL
• Investigation rushed without Annex 13 protocols (evidence lost)
• Family assistance plan only on paper (no team trained)