Key takeaways
- MROs hold three things criminals want: records that stop aircraft when unavailable, customer data, and trusted connections into airlines and OEMs.
- Integrity is the airworthiness risk. A maintenance record or a release certificate that has been altered, or forged, is a safety problem even if nothing was "hacked".
- Your suppliers are part of your attack surface. Ten questions and a contract clause cover most of the risk from most vendors.
- Hangar equipment, test benches and building systems should be on their own network. Segmentation is the cheapest control you are not using.
- Zero trust for a small shop means identity, MFA, least privilege and device health, not a product purchase.
Why MROs and suppliers are targets
Ransomware groups choose victims by two criteria: how much the outage hurts and how easy the entry is. A maintenance organization scores badly on both. Its maintenance-tracking system, technical records and parts inventory are what release aircraft; when they are encrypted, aircraft stay on the ground and customers call within hours, which is exactly the pressure an extortionist wants. Meanwhile the typical shop has a small IT function, shared workstations on the hangar floor, vendors with remote access to diagnostic equipment, and years of accumulated logins.
The second reason is position. An MRO sits between operators, OEMs, parts distributors and lessors, exchanging documents and connecting to portals on all sides. Compromise the MRO and you have a trusted route into everyone it works with. Boeing's 2023 disclosure that data had been stolen from its parts and distribution business, and the 2022 incident at Jeppesen that disrupted flight-planning services, show that the supply chain, not the flight deck, is where aviation's cyber incidents actually happen.
Regulators have noticed. In Europe, EASA Part-IS applies to Part-145 maintenance organizations and continuing-airworthiness management organizations, requiring an information security management system with a safety focus, incident reporting and integration with the safety management system. The frameworks guide covers how that fits with the standards your customers ask about.
Records integrity is an airworthiness problem
Most security conversations are about confidentiality and availability. In maintenance the property that matters most is integrity: is the record true? In 2023 the industry learned this the hard way when it emerged that a parts distributor had supplied engine components with falsified release documentation to airlines and maintenance providers around the world, forcing engine removals and inspections. No network was breached; the failure was that documents were trusted because they looked right.
Digital records make forgery easier and detection harder unless the system is designed for it. The practical questions for a small MRO:
- Who can change a record after it is signed? If the answer includes "any administrator" or "the vendor's support login", the record is not evidence.
- Is there an audit trail? Every change to a maintenance record, a component history or a release certificate should be logged with who, when and what, and the log should be protected from the same people who can edit the record.
- Are release documents verified, not just filed? Where the issuing authority or organization offers verification of certificates (electronic Form 1 or 8130-3, or a distributor's portal), use it, especially for rotables and life-limited parts from unfamiliar sources.
- Can you prove what the record said on a given date? Backups that are retained, immutable and restorable are what let you show a regulator or a customer that a record was not altered after the fact.
These are also the questions a Part-IS inspector, an airline auditor or an accident investigator will ask. Answering them once, in the design of your records system, is cheaper than answering them under pressure.
A lightweight vendor assessment
Enterprise vendor-risk programs run to hundreds of questions. A small shop needs the ten that matter, asked once a year of every vendor that touches your systems or your data: the maintenance-software provider, the parts platforms, the IT support company, equipment suppliers with remote diagnostics, and any cloud service holding records.
| # | Question | Why it matters |
|---|---|---|
| 1 | Do you enforce multi-factor authentication for your staff and for our accounts? | Stolen passwords are the main entry route. |
| 2 | How is remote access to our equipment or systems controlled, logged and switched off? | Standing vendor access is standing attacker access. |
| 3 | Where is our data stored, who can see it, and is it encrypted at rest and in transit? | You are accountable for it wherever it sits. |
| 4 | How quickly do you patch, and how would we hear about a vulnerability in your product? | Unpatched vendor software is the second entry route. |
| 5 | What is your backup and recovery objective for our data, and when did you last test it? | Your continuity depends on theirs. |
| 6 | Within how many hours will you tell us about an incident that affects our data or systems? | Your reporting clocks start when you know. |
| 7 | Do you hold any independent security assessment or certification (ISO 27001, SOC 2)? | A proxy for maturity; absence is not disqualifying, silence is. |
| 8 | Who at your company is accountable for security, and how do we reach them? | You need a name before the incident. |
| 9 | Do you subcontract any of this, and to whom? | Fourth parties are your risk too. |
| 10 | What happens to our data when the contract ends? | Records have retention obligations that outlive vendors. |
Put the answers in a folder, put the notification clause (question 6) and the data-return clause (question 10) in the contract, and re-ask the questions annually. Vendors that will not answer have told you something.
The hangar network: IT, OT and everything with a plug
Maintenance facilities accumulate connected equipment: engine test cells, avionics test benches, borescopes with Wi-Fi, calibration tools, tyre and brake equipment with diagnostic ports, building automation, CCTV, and the tablet the technician uses for the manuals. Much of it runs old software that cannot be patched, and much of it was installed by a vendor who needed "temporary" remote access.
The control is segmentation. Put equipment and building systems on networks of their own, separate from the office and from the records systems, with only the specific connections they need. Guest Wi-Fi gets its own segment. Vendor remote access goes through a gateway you control, is switched on for a job and off afterwards, and is logged. Diagnostic laptops that plug into aircraft or equipment are dedicated to that purpose, not used for email. None of this requires new equipment beyond what a competent IT provider already has; it requires deciding that the hangar is not one flat network.
Zero trust, sized for a small shop
"Zero trust" is sold as a product category. As a principle it is simpler: do not trust a device or a person because of where they are on the network; trust them because of who they are, what device they are on, and what they need. For a maintenance organization of twenty to a hundred people it comes down to five practices.
- Individual identities with multi-factor authentication for everything: records systems, email, vendor portals, remote access. No shared "hangar" login.
- Least privilege. Technicians can sign their own work, not edit the component history; administrators have separate administrative accounts they do not use for email.
- Device health as a condition of access. Only managed, patched, protected devices reach the records system. A personal laptop on the guest Wi-Fi reaches the internet and nothing else.
- Segmentation, as above, so that one compromised device is one compromised device.
- Logging you can read. Who logged in, from where, and what they changed, kept somewhere the attacker cannot delete, and looked at occasionally.
Most of this is configuration of systems you already run. The cost is mostly the decision and a few days of an IT provider's time.
Where to start
| This month | This quarter | This year |
|---|---|---|
| MFA on the records system, email and every vendor portal. An offline backup of records, restored once. The ten vendor questions sent to your top five vendors. | Hangar, office, guest and equipment networks separated. Vendor remote access through a controlled, logged gateway. Audit logging on records confirmed and protected. A one-page incident plan with a manual-mode procedure for releasing aircraft. | Contract clauses for notification and data return with all vendors. A records-integrity review with your quality manager. If you hold an EASA approval, Part-IS compliance built on the same structure rather than as a separate exercise. |
Questions I get asked
Why would a criminal target a small MRO?
Because you hold three things they can monetize: records that stop aircraft flying when they are unavailable, customer and personnel data, and trusted connections into airlines and OEMs. Small shops are attacked because the same automated tools reach everyone.
How is record integrity an airworthiness problem?
A maintenance record or release certificate that has been altered or forged means the aircraft's condition is not what the paperwork says, whether or not anything was hacked. Access limits, logging, backups and signatures on records are airworthiness controls.
How do I assess a supplier's security without a long questionnaire?
Ten questions cover most vendors: who has access to your data, whether they use multi-factor authentication, how they back up and patch, how quickly they would notify you of an incident, which subcontractors they use, and how your data is returned at the end of the contract. Put the answers and a short security clause in the agreement.
What does zero trust mean for a hangar?
Not a product. Identity for every user and device, multi-factor authentication, least privilege, a device-health check before access, and segmentation so that test benches, building systems and office computers cannot reach each other.
How I can help
My security program and readiness assessment for maintenance organizations covers records integrity, vendor access, hangar networks and your regulatory obligations, with a prioritized risk register and a 90-day roadmap your own team can run. Add incident response and ransomware readiness if you want the manual-mode procedures and a tabletop exercise with your team.
Ask about an MRO assessment
Founder of Mevocopter Aerospace. Before aviation, he helped medical-device makers prepare Health Canada and FDA regulatory submissions, and worked in computer support and network security. Publications · ORCID
References
- Commission Delegated Regulation (EU) 2022/1645 and Commission Implementing Regulation (EU) 2023/203 (EASA Part-IS), and their applicability to Part-145 and Part-CAMO organizations.
- EASA and FAA communications (2023) on unapproved parts supplied with falsified release documentation; EASA Safety Information Bulletin on suspected unapproved parts.
- NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.
- NIST SP 800-207, Zero Trust Architecture.
- Center for Internet Security. CIS Critical Security Controls v8.1 (Controls 1, 5, 6, 11, 12 and 15).