Certification evidence
Security risk assessment evidence review for DO-326A, DO-356A
This review is for avionics suppliers, OEMs, Engineering teams responsible for security risk assessment. It is triggered by sRA deliverable due under a security basis. EE checks attack-surface identification against the actual architecture, threat condition severity tied to safety failure conditions, security measures with verification evidence of effectiveness, plus the governing plan or application, against DO-326A, DO-356A. Discrepancies include missing source records, mismatched configuration, unsupported assumptions, or threat scope frozen at type certification while interfaces changed. Output includes Security risk assessment exception register, Claim to evidence map, Reviewer question list.
When this review is needed
- The team is preparing for sRA deliverable due under a security basis.
- Supplier records and applicant records must be reconciled.
- Program leads need to know which findings could block the next gate.
- A proposed means of compliance depends on evidence reuse, analysis, or rationale.
The problem
Reviewers need to reconstruct the path from final claim to source data. For security risk assessment, weak files usually show threat scope frozen at type certification while interfaces changed, then reveal revision drift or unclosed assumptions.
What gets reviewed
- Review attack-surface identification against the actual architecture against the configuration, installation, or claim under review.
- Compare threat condition severity tied to safety failure conditions against the configuration, installation, or claim under review.
- Trace security measures with verification evidence of effectiveness against the configuration, installation, or claim under review.
- Challenge residual risk acceptance rationale. against the configuration, installation, or claim under review.
What gets validated
- Pass check: attack-surface identification against the actual architecture must match the released configuration and the claimed means of compliance.
- Configuration check: threat condition severity tied to safety failure conditions must match the released configuration and the claimed means of compliance.
- Trace check: security measures with verification evidence of effectiveness must match the released configuration and the claimed means of compliance.
- Rationale check: residual risk acceptance rationale. must match the released configuration and the claimed means of compliance.
Evidence normally required
Common discrepancies
- Gap: threat scope frozen at type certification while interfaces changed.
- Mismatch: effectiveness asserted from vendor datasheets instead of verification.
- Unsupported claim: severity assignments that never consulted the FHA.
What is at stake
An unresolved gap can become a finding, a deferred submittal, or a narrower claim. Missing support for effectiveness asserted from vendor datasheets instead of verification often affects several records at once.
Move from findings to resolution
Identify gaps against the means of compliance.
How the work runs
Frame Security Risk
Confirm the exact event, affected file set, buyer role, and decision standard before any attack-surface identification against the actual architecture is treated as sufficient.
Trace Evidence Review
Walk the named evidence from index entry to source artifact and mark where the trail supports, conflicts with, or fails to answer the page-specific question.
Sort 356a Certification
Group exceptions by closure route: document retrieval, data correction, engineering disposition, authority response, or contractual decision.
Package Conditions Measures
Deliver the exception list, evidence map, and owner sequence in a form that can move directly into remediation, submittal cleanup, or transaction negotiation.
What the buyer receives
- Security risk assessment exception register
- Claim to evidence map
- Reviewer question list
- Closure action plan
Who uses the output
- security engineer assign closure actions from the exception register.
- safety engineer use the map to locate source evidence.
- certification liaison decide what can proceed and what must wait.
How the work fits into the transaction or program
Does the airworthiness security risk assessment identify the right threat conditions and prove the security measures are effective, per DO-326A with DO-356A methods. The evidence set centers on asset and attack-surface identification against the actual architecture, threat condition severity tied to safety failure conditions, security measures with verification evidence of effectiveness, and residual risk acceptance rationale. The likely weak points are threat scope frozen at type certification while interfaces changed, effectiveness asserted from vendor datasheets instead of verification, and severity assignments that never consulted the FHA. The output gives the security engineer a cleanup register for Security risk assessment before SRA deliverable due under a security basis.
Start with a single asset
Confirm requirements trace through verification.
Regulatory limits
This review is not an approval activity. Final findings, acceptance, installation approval, and airworthiness decisions remain with the responsible applicant, authorized representatives, and authorities.
What this review does not cover
- Authority negotiations as decision maker
- Compliance finding approval
- Test execution or article build
- Operator airworthiness release
Specific to this review
- Configuration identity matters because evidence from another baseline may prove a different article, load, or installation.
- A useful trail names the source record, revision, owner, and closure decision for each claim.
- The exception list separates document-control cleanup from gaps that need engineering substantiation.
- The finding pattern for this page is specific: threat scope frozen at type certification while interfaces changed changes the strength of the certification argument.
- The scope uses the Security Risk Assessment Evidence question as the control point, so the review stays tied to SRA deliverable due under a security basis and the buyer decision behind it.
- The evidence starts with Attack-surface identification against the actual architecture and follows Review 326a 356a Certification references until every exception has a source location and a reason code.
- The finding logic separates missing paperwork, conflicting status, stale revision data, and unsupported disposition because each class closes through a different owner.
- The timing matters for security engineer: the output is useful only if the unresolved items are visible before acceptance, submittal, handback, or negotiation pressure fixes the sequence.
- The boundary control keeps Threat Conditions Measures Hold questions in the records or certification lane and sends technical acceptance issues to the authorized people who own them.
- The handoff value comes from Security risk assessment exception register; it gives the next reviewer a precise map instead of another broad request for a better file.
Sources
RTCA. Airworthiness security process objectives for aircraft systems exposed to intentional unauthorized electronic interaction.
SAE International. Safety assessment methods (FHA, PSSA, SSA, FTA, FMEA) supporting development assurance level assignment.
Frequently asked questions
What makes this evidence review different from a general file audit?
The scope is tied to security risk assessment evidence and to the decision named in the request. A general audit can list weak records; this pass ranks the gaps by whether they block sra deliverable due under a security basis or can be closed later without changing the decision.
What evidence has to be available before this work starts?
The starting point is attack-surface identification against the actual architecture, the current status source, and any index or matrix that tells reviewers where the supporting artifact should live. Missing inputs are logged as findings rather than filled with assumptions.
Who decides whether an open item is acceptable?
The review explains what the evidence supports and gives security engineer a closure path. Acceptance remains with the buyer, operator, authority, delegated engineer, or authorized person responsible for the underlying airworthiness or certification decision.
Relevant glossary terms
Related pages
Where this fits
Talk to an engineer who has done this work
We will walk through your current state, the records or evidence involved, and a scoped first engagement.
Talk through the aircraft, records, evidence, deadline, and next useful step.