Resources Categories
INDUSTRY FACT FILE · AVIATION & AEROSPACE
Industry Overview: Aviation and Aerospace in India
Who flies, handles, maintains and builds in India's aviation and aerospace sector, the aviation, data and cyber obligations that apply, who buys cybersecurity and why each type of organisation needs a distinct approach.
|
In this document 1. Why aviation cybersecurity matters now 2. The ecosystem at a glance 3. Categories of aviation and aerospace organisations 4. The aviation, data and cyber framework at a glance 5. Government, regulator and private participants 6. Who buys cybersecurity inside an airline, airport or aerospace company 7. Why each type of organisation needs a different approach 8. How Codec Networks works with aviation and aerospace companies |
|
Sector scope Sector: airlines, airport operators, ground handlers, MRO and engineering firms, aerospace manufacturers and suppliers, air cargo, and air navigation and airport technology providers. Primary service proposition: airport IT/OT assessment, passenger data security, SOC, supplier assurance and resilience. Railways, ports, logistics and hospitality have separate fact files. |
1. Why aviation cybersecurity matters now
India is one of the world's fastest-growing aviation markets. Domestic airlines carried about 16.54 crore passengers in 2024-25, up 7.6% on the previous year; Indian airports handled about 3.7 million tonnes of cargo in the same year; the UDAN regional connectivity scheme had operationalised more than 600 routes by August 2025; and defence and aerospace exports reached a record ₹23,622 crore in 2024-25. The Bharatiya Vayuyan Adhiniyam, 2024 replaced the ninety-year-old Aircraft Act on 1 January 2025. Behind those numbers sit a handful of large airline groups, airport operators running metro hubs under public-private partnerships alongside the Airports Authority of India, ground handlers, MRO and engineering firms, aerospace manufacturers and tier suppliers to global OEMs, air cargo terminals and the technology providers whose shared platforms the whole system runs on.
|
16.5 crore Domestic air passengers in India in FY25 |
4.5 m Air India passengers affected by the 2021 SITA breach |
3 hubs Heathrow, Brussels and Berlin check-in disrupted by one provider (2025) |
6 hours To report cyber incidents to CERT-In |
That system is tightly coupled and deeply digital. Passenger service systems, departure control and common-use check-in platforms are shared across airlines and airports; loyalty programmes hold stored value for millions of members; airport operations depend on baggage handling systems, building management, access control, CCTV, screening equipment and Wi-Fi; DigiYatra adds biometric entry; airlines fly with electronic flight bags and connected aircraft; MRO firms keep the maintenance records that certify airworthiness; and aerospace manufacturers hold export-controlled designs. Thousands of suppliers, from caterers to software vendors, connect to these systems. Transport is a critical sector under NCIIPC, and ICAO's Annex 17 Standard 4.9.1 asks every State to identify and protect its critical aviation ICT systems.
The incidents are concrete and recent. In 2021 a breach at passenger-processing provider SITA exposed data—names, dates of birth, passport and ticket details, frequent flyer and card data—of about 4.5 million Air India passengers registered over a decade. In May 2022 a ransomware attack at SpiceJet delayed and cancelled flights and left passengers waiting for hours. In August 2022 a configuration error in Akasa Air's login service exposed registered users' names, emails and phone numbers, which the airline self-reported to CERT-In. In August 2024 a Rhysida ransomware attack on the Port of Seattle shut check-in kiosks, baggage handling, displays and Wi-Fi at Seattle-Tacoma airport and exposed data on about 90,000 people. In July 2025 Qantas disclosed that 5.7 million customers' data had been taken from a third-party contact-centre platform. In September 2025 a cyber-related disruption to Collins Aerospace's MUSE common-use software stopped electronic check-in and bag drop at Heathrow, Brussels and Berlin, forcing manual processing and cancellations. In aerospace, LockBit leaked about 43 GB of Boeing data in November 2023 after a US$200 million demand was refused.
In India the obligations are layered. CERT-In's Directions require cyber incidents to be reported within six hours and ICT logs to be retained for 180 days, and its 2025 audit policy guidelines expect risk-based independent audits that include OT; NCIIPC protects notified transport systems; DGCA and BCAS implement ICAO safety and security standards, including Annex 17's cybersecurity provisions, through the national programmes; listed airlines and airport companies disclose cyber incidents quarterly under SEBI's LODR Regulations; and the DPDP Act and Rules will govern passenger, crew, loyalty and biometric data, with most obligations taking effect in May 2027. EU-facing operators face a second layer: EASA Part-IS requires information security management systems at aerodromes and design and production organisations from October 2025 and at air operators and maintenance organisations from February 2026, and alliance partners, lessors, insurers and OEMs audit their counterparties' cybersecurity.
|
Key takeaway In aviation, cybersecurity is operational continuity, passenger trust and safety assurance in one. The shared platforms, the airport systems, the suppliers connected to them and the passenger data they hold must be protected together—and the manual fallback must be rehearsed before it is needed. |
2. The ecosystem at a glance
Figure 1: India's aviation and aerospace ecosystem.
3. Categories of aviation and aerospace organisations
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Airlines |
Scheduled, regional and cargo carriers operating fleets, networks, crew and loyalty programmes |
Listed and private groups, government-linked carriers |
DGCA; BCAS; CERT-In; SEBI LODR (listed); DPDP; PCI DSS via acquirers |
|
Airport operators |
Metro hubs under PPP, AAI airports, greenfield airports |
AAI, listed and private infrastructure groups, joint ventures |
AAI Act and AERA; BCAS; CERT-In; NCIIPC where notified; SEBI LODR (listed) |
|
Ground handlers and airport services |
Ramp, passenger, baggage, fuelling, catering and security screening services |
Specialist handlers, airline subsidiaries, AAI arms |
BCAS; DGCA ground handling rules; CERT-In; customer contracts |
|
MRO and engineering firms |
Line and base maintenance, engine and component shops, records |
Airline subsidiaries, independent MROs, OEM joint ventures |
DGCA CAR-145 approvals; EASA Part-IS for EU approvals; CERT-In |
|
Aerospace manufacturers and suppliers |
Airframe and engine components, defence aerospace, systems and software |
Public-sector majors, listed and private suppliers to global OEMs |
DGCA design and production rules; export controls; OEM contracts; CERT-In; NCIIPC where notified |
|
Air cargo and express |
Cargo terminals, freighter operations, customs handling |
Airport cargo arms, integrators, logistics groups |
Customs and ICEGATE; BCAS regulated agent regime; CERT-In; DPDP |
|
Air navigation and airport technology providers |
Air traffic management, communications, navigation, surveillance, common-use platforms, airport IT |
AAI and global and Indian technology vendors |
NCIIPC where notified; ICAO standards; customer contracts; CERT-In |
|
Business aviation and new entrants |
Charter operators, drones, advanced air mobility |
Private operators and start-ups |
DGCA; Drone Rules 2021; CERT-In; DPDP |
4. The aviation, data and cyber framework at a glance
|
Instrument or expectation |
What it means for aviation and aerospace companies |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications—airport OT and shared platforms included—with closure of findings |
|
NCIIPC (IT Act Section 70A) |
Transport is a critical sector; systems notified as protected systems—more likely at major airports, air navigation and national platforms—carry additional duties |
|
ICAO Annex 17 (Standard 4.9.1 and Recommended Practice 4.9.2) |
States identify critical aviation ICT systems and data on a risk basis and apply protective measures; security by design, supply-chain security and remote-access protection recommended; implemented in India through DGCA and BCAS programmes |
|
Bharatiya Vayuyan Adhiniyam, 2024 and aviation rules |
Civil aviation law in force from 1 January 2025 covering design, manufacture, maintenance, operation and security of aircraft; BCAS administers the national civil aviation security programme—confirm current security rules |
|
SEBI LODR Regulations (listed companies) |
Cyber security incidents, breaches and loss of data disclosed in the quarterly corporate governance report since July 2023 |
|
DPDP Act 2023 and DPDP Rules 2025 |
Notice, consent, safeguards, retention and breach intimation for passenger, crew, loyalty, biometric and employee personal data; most obligations from May 2027 |
|
EASA Part-IS (EU 2022/1645 and 2023/203) |
Information security management systems for aerodromes and design and production organisations from 16 October 2025 and for air operators, maintenance organisations and authorities from 22 February 2026—relevant to EU approvals and partners |
|
Partner, lessor, insurer and OEM requirements |
Alliance and codeshare security questionnaires, lessor and insurer conditions, OEM supplier security and export-control requirements; ISO/IEC 27001 and IEC 62443 as reference standards; PCI DSS for card payments |
|
How these apply Aviation obligations depend on your licences and approvals; cyber and data obligations are cross-sector and depend on listing status and notifications; Part-IS and partner requirements depend on where you operate and with whom. Confirm against the official instruments and your contracts. |
5. Government, regulator and private participants
- The Ministry of Civil Aviation sets policy; DGCA regulates safety, airworthiness and approvals; BCAS regulates aviation security; AAI operates airports and air navigation services; AERA regulates tariffs at major airports.
- MeitY and CERT-In set cyber obligations; NCIIPC protects notified transport systems; SEBI governs listed-company disclosure; the Data Protection Board will enforce the DPDP Act.
- ICAO sets international standards including Annex 17; EASA applies Part-IS to EU approvals; IATA and alliances set industry practices and partner expectations.
- Airline groups, airport operators and handlers run the operation; public-sector and private aerospace manufacturers build aircraft, engines and components for Indian and global programmes.
- Shared platform providers—passenger service, departure control, common-use check-in, GDS and messaging—connect every airline and airport, and concentrate risk.
- MRO firms, caterers, fuel suppliers, IT vendors and thousands of other suppliers hold access, data or operational dependencies and are the most common path into aviation systems.
6. Who buys cybersecurity inside an airline, airport or aerospace company
|
Stakeholder |
What they care about |
What they buy |
|
Board, CEO and CFO |
Operational continuity, passenger trust, disclosure, insurance |
Board advisory, resilience programmes, crisis exercises |
|
CIO and CISO |
Platform and OT security, audits, partner questionnaires |
Assessments, audits, SOC, GRC programmes |
|
COO, airport and station operations |
Check-in, baggage, airside and terminal continuity |
Airport IT/OT assessments, fallback rehearsals |
|
Head of security (AVSEC) |
BCAS programme, access control, CCTV, screening systems |
OT and physical-security system assessments |
|
Engineering, maintenance and flight operations |
Records integrity, EFBs, OEM links, dispatch systems |
MRO and operations system reviews |
|
Digital, loyalty and customer teams |
Apps, loyalty fraud, contact centres, customer data |
App and API testing, ATO testing, privacy programmes |
|
Procurement and partnerships |
Provider, handler and supplier risk |
Supplier and platform assurance programmes |
|
Legal, compliance and company secretarial |
CERT-In, DPDP, SEBI, Part-IS and contracts |
Gap assessments, incident records, disclosure support |
7. Why each type of organisation needs a different approach
|
Organisation type |
Highest-consequence risk |
Starting point for assurance |
|
Airline |
Passenger data breach at a provider; loyalty fraud; dispatch outage |
Provider assessments, app and ATO testing, resilience, SOC |
|
Airport operator |
Ransomware across baggage, BMS and access control; shared platform outage |
Airport IT/OT assessment, segmentation, fallback rehearsal |
|
Ground handler |
Being the supplier that stops the airport; staff device compromise |
Baseline assessment, access controls, questionnaire readiness |
|
MRO or engineering firm |
Maintenance record tampering or loss; Part-IS gaps |
Records system review, ISMS readiness, backups |
|
Aerospace manufacturer or supplier |
Design data theft; ransomware halting deliveries to OEMs |
Data classification, segmentation, OEM assurance, SOC |
|
Air cargo operator |
Customs and cargo system fraud; terminal outage |
Credential controls, portal testing, continuity |
|
Platform or technology provider |
Being the single point of failure for many airports |
Secure SDLC, resilience engineering, customer assurance |
8. How Codec Networks works with aviation and aerospace companies
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For aviation and aerospace companies we deliver airport IT/OT assessments covering baggage, BMS, access control, CCTV, kiosks and common-use platforms using operations-aware methods, passenger data security and DPDP programmes across providers and loyalty systems, 24x7 aviation SOC, supplier and platform assurance programmes, operational resilience with rehearsed manual fallback, airline app and API testing and crisis exercises—connected from finding to closure and mapped to ICAO Annex 17, ISO/IEC 27001, IEC 62443 and CERT-In expectations.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. Obligations differ by licence, approval, listing status, operations and partners; confirm them against the official CERT-In, MeitY, Ministry of Civil Aviation, DGCA, BCAS, NCIIPC, SEBI, ICAO and EASA instruments and your partner and lessor contracts.