LegalizeRegulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 (Text with EEA relevance)
Landside security; Passengers and cabin baggage; Staff and crew; Access control; Hold baggage; In-flight supplies; Airport supplies; Aircraft protection on the ground; Aircraft in-flight security measures; Cargo and mail; Air Traffic Control; Digital information and technologies; Unmanned aircraft system(s) (UAS) / Unmanned aerial vehicle (UAV) / Remotely-piloted aircraft system(s) (RPAS); Stand-off weapon (MANPADs etc.); Lasers; Aviation security information; General Aviation/Aeroclubs
Effect or potential effect on security ([^E0009]):
Any other comment/proposal/information ([^E0010]):
Contact (email, telephone number):
Appendix V
Common classification of security occurrences and incidents ([^E0011])
| Class [^E0012] | Category [^E0013] |
|---|---|
| Landside security | Discovery or use of vehicle-borne improvised explosive device (IED) or improvised incendiary device (IID) |
| Discovery or use of person-delivered IED/IID | |
| Armed attack | |
| Unattended/suspicious items (also applicable airside) | |
| Chemical, biological and radiological (CBR) attack | |
| Damage to critical infrastructure/vulnerable points | |
| Suspicious behaviour | |
| Unplanned disruptions, including bomb threat or hoax | |
| Passengers and cabin baggage | Discovery or use of prohibited item/IED/IID |
| Deficiency in the security checkpoint screening process | |
| Mixing of screened and unscreened passengers | |
| Suspicious behaviour | |
| Staff and crew | Deficiency in the security checkpoint screening process |
| Discovery or use of prohibited item/IED/IID | |
| Sabotage | |
| Insider bypassing security controls | |
| Deliberate attempt to circumvent vetting / background check regime | |
| Access control | Breach or attempted breach of perimeter |
| Unauthorized access to security restricted area (SRA) or other controlled area (non-staff) | |
| Unauthorized/unescorted access within SRA (staff) | |
| Suspicious behaviour of staff | |
| Deficiency in the access control system | |
| Deficiency in the ID pass issuing system | |
| Deficiency in the vehicle access control system including application of security controls and/or screening of occupants and vehicles | |
| Hold baggage | Discovery or use of prohibited item/IED/IID |
| Deficiency in protecting screened hold baggage | |
| Evidence of tampering of screened hold baggage | |
| Deficiency in the hold baggage screening (HBS) system or process (including passenger baggage reconciliation) | |
| Deficiency in the process of transportation of dispatched weapons | |
| In-flight supplies | Unauthorized access to in-flight supply facility |
| Deficiency in protecting secure supplies | |
| Evidence of tampering of secured in flight supplies | |
| Deficiency in applying security controls | |
| Discovery or use of prohibited item/IED/IID | |
| Airport supplies | Unauthorized access to facility |
| Deficiency in protecting secure supplies | |
| Evidence of tampering of secured airport supplies | |
| Deficiency in applying security controls | |
| Discovery or use of prohibited item/IED/IID | |
| Aircraft protection on the ground | Unauthorized passenger on the aircraft |
| Unauthorized staff on the aircraft | |
| Deficiency in the aircraft security search/check | |
| Deficiency in aircraft protection measures, including where aircraft are parked overnight | |
| Discovery or use of prohibited item/IED/IID in the aircraft cabin or hold | |
| Aircraft in-flight security measures | Unruly passenger (to be considered for level 3 and 4 (see ICAO Aviation Security Manual) only to be reported) |
| Deficiency in the cockpit door process/protection | |
| Discovery or use of prohibited item/IED/IID | |
| CBR attack | |
| Hijacking in flight | |
| Bomb threat in flight | |
| Cargo and mail | Unauthorized access to cargo screening facility |
| Deficiency in the screening process | |
| Discovery or use of prohibited item/IED/IID | |
| Deficiency in protecting secured cargo | |
| Evidence of tampering of secured cargo | |
| Deficiency in the acceptance process | |
| Suspicious activity | |
| Do Not Load notification under PLACI schemes | |
| Air Traffic Control | Armed attack against air traffic control (ATC) facility |
| Destruction or damage of air navigation aids | |
| Unauthorized access | |
| Digital information and technologies | Attack against aircraft system(s) |
| Attack against air traffic management (ATM) system(s) | |
| Attack against airport system(s) | |
| Attack against other critical systems and data | |
| Unmanned aircraft systems (UAS) | Unauthorized incursion into controlled airspace |
| Unmanned aerial vehicle (UAV) | Near miss/Encounter with aircraft in flight |
| Remotely-piloted aircraft system (RPAS) | Strike/Collision with aircraft in flight |
| Sighting from aircraft/airport | |
| Unmanned aerial vehicle (UAV) caused threat against aircraft | |
| UAV caused threat against airport infrastructure | |
| UAV caused threat against passengers | |
| Stand-off weapon (MANPADs etc.) | Attack on aircraft or airport facility |
| Reported sighting | |
| Lasers | Attack on aircraft or airport facility |
| Reported sighting | |
| Suspicious activity | |
| Aviation security information | Deficiency in protecting sensitive aviation security information |
| Loss of integrity and availability of information systems | |
| General Aviation/Aeroclubs | Unauthorized access |
| Discovery of prohibited item/IED/IID |
Class: describes the topic the security incident would refer to, such as ‘access controls’, ‘hold baggage’ or ‘cargo/mail’. The chosen identifiers are already commonly used in ICAO Annex 17 and the Aviation Security Manual (Doc 8973) and are expected to be easy for entities to refer to and relevant for authorities to make assessments.
Category: indicates a more specific description of the security incident involved. The categories differ per class as the possible security incidents vary depending on which aviation security process they relate to. For instance, the class ‘aircraft protection on the ground’ includes the category ‘deficiency in the aircraft security search/check’, whereas the class ‘hold baggage’ includes the category ‘deficiency in protecting screened hold baggage’. There would also be a category ‘other’ for those incidents that may be too rare to justify a separate category, or which may be considered a new threat or vulnerability. However, this option should only be used when none of the other categories seems suitable.
[^E0001]: OJ L 240, 24.8.1992, p. 1.
[^E0002]: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (OJ L, 2024/1689, 12.7.2024, ELI: http://data.europa.eu/eli/reg/2024/1689/oj).
[^E0003]: For the purposes of the template, ‘occurrence’ will cover aviation security occurrences and incidents.
[^E0004]: In case the exact date and time cannot be established.
[^E0005]: If different from the date of occurrence.
[^E0006]: Name and possibly IATA/ICAO code of the airport, as well as the area where the occurrence is observed.
[^E0007]: Name of natural person reporting may be left out.
[^E0008]: Such as notifying local law enforcement and/or airport authorities of the situation.
[^E0009]: To determine from the reporter’s perspective, how the level of aviation security is affected.
[^E0010]: This section may include further desirable information from the reporter, for instance, as regards Preliminary risk assessment; Action(s) to limit the effect on aviation security; Remedial action(s) (where applicable); and Status of the file within the company (where applicable).
[^E0011]: Appendix V may also serve as a tool to categorise security data and support the development of definitions of relevant occurrences.
Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.
This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence.
EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.