Cyber Security Awareness Training under EU Regulation 11.2.8
What is the 11.2.8 Training under EU Regulation 2015/1998?
The training according to Chapter 11.2.8 of EU Regulation 2015/1998 is a mandatory security briefing focused on cybersecurity for specific personnel working in the aviation sector. Its goal is to protect critical information and communication systems (CICS) from unauthorized access and cyber threats.
Who is required to take this training?
The training is mandatory for individuals with:
- Physical access to critical aviation IT systems (Group I / Category a)
- Electronic access or administrative privileges to such systems (Group II / Category b)
- Responsibilities for security configuration or system hardening (Group III / Category c)
Typical employers include:
- Air cargo handlers
- Airlines and airports
- IT service providers in aviation
- Known consignors, regulated agents
Why was this training introduced?
Aviation is a high-value target for cyberattacks. With increasing digitalization, the risk of data breaches, system failures, or targeted attacks is growing. The 11.2.8 training was introduced to ensure a baseline level of cybersecurity awarenessacross all relevant personnel.
Training Content
Content varies by group but typically includes:
- Cybersecurity basics
- Password protection and access controls
- Phishing and social engineering
- Incident response behavior
- Mobile device protection
- Network security (for admins)
