VisualPro Tech Brief
DO-178C Doesn't Cover Security
Now that DO-326A is an airworthiness requirement
Airworthiness Security | Integrated Safety-Security Certification | Industry Trend Brief
DO-326A / ED-202ADO-356ADO-355DO-178CARP4754A
01Overview (TL;DR) — The Gap That Was Left Deliberately
DO-178C (ED-12C in Europe), the benchmark for airborne software certification, and ARP4754A, the system development guideline, address safety. But those standards deliberately placed cybersecurity outside their scope. They were built for random failures and development errors, not for a malicious actor.
DO-326A/ED-202A — the Airworthiness Security Process Specification — fills that gap. The FAA and EASA adopted it as an acceptable means of compliance for airworthiness certification, making it effectively mandatory for aircraft, rotorcraft, engine, and propeller certification.
Worth noting: this is not “Cyber DO-178.” The source explicitly refutes that shorthand, describing DO-326A as a cyber add-on to ARP-4754A, partly equivalent to a “Cyber ARP-4761” and a “Cyber DO-178C.” It adds a new layer of man-made-failure protection on top of the traditional safety standards.
Airworthiness security is the sister to safety airworthiness — the same processes and principles apply.
02Why Now — Three Shifts Lifting Safety-Security Integration in Aviation
1The Regulation Settled — From Special Conditions to Standard RequirementsRegulation settled
Starting with the Boeing 787 certification in 2005, the FAA applied roughly 20 individual cybersecurity special conditions, then formalized the practice with policy statement PS-AIR-21.16-02 in February 2017. After AC 119-1 (2015), AC 20-140C (2016), and AC 120-76D (2017), EASA proposed the standards as official AMC across aircraft, rotorcraft, engines, and propellers, and the FAA signalled an advisory circular plus revisions to 14 CFR Parts 21/23/25/27/29/33/35. What used to be handled case by case has hardened into a standard requirement.
2E-Enabled Aircraft Created the Attack SurfaceAttack surface
DO-326A targets TCP/IP-based e-enabled systems: satellite communications, Ethernet routers connected to onboard servers and Wi-Fi, cellular devices, laptops and tablets, and ground networks such as VHF/AM, digital VHF datalinks, ACARS, and wireless bridges. Protection is not a single-layer job — it is required across multiple levels of abstraction: access points, transmitted data, systems, subsystems, and the code itself.
3Safety and Security Run on the Same Process SkeletonProcess symmetry
The DO-326A security risk assessment runs parallel to the safety Functional Hazard Assessment, and threat-level and severity determination plays a role similar to Design Assurance Level assignment. The source observes that “security overlaps with much of what has been done for many years in ensuring safety.” That is why security integration feels intuitive to teams experienced in safety-critical development — and why the two analyses need to meet inside one tool.
03DO-326A Comes Down in Seven Steps
The Airworthiness Security Process
| Step | What It Does | Deliverable |
|---|
| 1. Plan for security aspects of certification | Plans risk assessment, assurance-level assignment, security requirement capture | PSecAC |
| 2. Scope establishment | Identifies logical and physical assets requiring protection | Asset list, security perimeter |
| 3. Security risk assessment | Determines threat levels and severity degrees | Threat scenarios, risk ratings |
| 4. Decision gate | Evaluates whether risks require mitigation evidence | Mitigation decision rationale |
| 5. Security protection implementation | Decomposes high-level requirements into lower-level specifications driving design | Security requirement hierarchy |
| 6. Verification and validation | Tests the effectiveness of implemented protections | Test cases and results |
| 7. Certification evidence compilation | Consolidates all evidence into a summary | PSecAC summary |
Three Documents, Three Roles
| Document | Title | Role |
|---|
| DO-326A / ED-202A | Airworthiness Security Process Specification | The process skeleton — what must be done |
| DO-356A / ED-203A | Airworthiness Security Methods and Considerations | Stage-by-stage requirements and risk assessment detail — how to do it |
| DO-355 / ED-204 | Information Security Guidance for Continuing Airworthiness | Operations and maintenance — after entry into service |
Note DO-326A defines the process, DO-356A carries the methodological detail, and DO-355 covers operational security after entry into service. Certification planning has to place deliverables against the right document of the three.
04Safety and Security Processes Run in Parallel
The two processes do the same work in the same place — only the names differ.
| Security Activity (DO-326A) | Safety Counterpart | What They Share |
|---|
| PSecAC planning | PSAC (DO-178C certification software plan) | Position and role of the certification plan |
| Asset identification and scoping | System and item definition | The same architecture model |
| Security risk assessment | FHA (Functional Hazard Assessment) | Risk identification and classification procedure |
| Threat level and severity determination | DAL assignment | Setting rigor through an assurance level |
| Security requirement decomposition | Safety requirement decomposition | Requirement hierarchy and design allocation |
| Protection effectiveness V&V | Verification and testing | Requirement-to-test traceability |
| PSecAC summary | Compliance evidence package | Basis for audit response |
On the V-model it lands like this On the left side (requirements phase), step 2 scope identification and step 3 preliminary security risk assessment are performed, and requirements are captured in a PLM, ALM, or requirements management tool where they are decomposed and traceability is established. On the right side (verification phase), step 5 implements protections and step 6 validates their effectiveness, with results feeding the PSecAC document as certification evidence.
And that is where the problem starts. If safety requirements live in the safety tool, security requirements in the security tool, and the architecture somewhere else — you model the same architecture twice, and neither analysis reaches the other. That is the classic path by which security-induced safety hazards go missing.
05How VisualPro Supports It
One Structure Tree, Five AnalysesShared structure
FMEA, FTA, HARA, TARA, and STPA share the same system structure database. Assets identified in DO-326A step 2 and the item definition used by safety analysis sit on the same tree, so the security risk assessment and the functional hazard assessment reference one model.
Cross-Analysis Traceability (Digital Thread)Core value
Security threat, countermeasure, security requirement, and verification item are linked in a single database, as are safety goal, FTA top event, failure mode, and safety requirement. Design changes and new threats propagate across the linked analyses, maintaining the living traceability certification review demands.
Standard-Conformant DeliverablesCertification evidence
ISO/SAE 21434 TARA, ISO 26262 HARA (ASIL), AIAG-VDA FMEA, and FTA in standard formats, with reports in Korean and English. Because every threat and risk item carries its analytical basis, the evidence destined for the PSecAC summary can be assembled directly from the analysis database.
MCP-Based AI Agent IntegrationAI integration
MCP (Model Context Protocol) support for FMEA, FTA, HARA, TARA, and STPA lets AI agents such as Claude communicate directly with VisualPro: candidate threat and hazard identification through draft scoring performed conversationally, while the analyst focuses on verification and judgment.
06Frequently Asked Questions (FAQ)
Q1Does DO-326A apply to military aircraft?
No. Military aircraft currently fall outside the scope of DO-326A; certification obligations apply to civil aviation under FAA and EASA oversight. Safety and security argumentation for military systems follows separate frameworks — MIL-STD-882E system safety, and in Korea schemes such as K-RMF. Presenting civil and military programs under one requirement set would be factually wrong, so the applicable framework has to be matched to the business domain.
Q2We already run DO-178C. How much does DO-326A add?
The process skeleton is largely shared. PSecAC occupies the same position as PSAC, the security risk assessment parallels the FHA, and the requirement decomposition and V&V structures correspond. The real burden is not learning a new method — it is adding an asset-and-threat perspective and linking its results traceably to the existing safety analyses, requirements, and tests. Running the two frameworks in separate tools is what makes that linkage cost escalate.
Q3Does ISO/SAE 21434 experience from automotive transfer to aviation?
The core reasoning transfers. Asset identification, threat scenario derivation, risk assessment, countermeasure derivation, and traceability form a flow shared by TARA and DO-326A. What differs is terminology (threat rating schemes, PSecAC deliverables), the regulator (FAA and EASA), and the presence of DO-355 covering the continuing airworthiness phase. It is closer to learning a new certification framework than a new methodology.
07Start Now (Next Step)
In aviation, safety and security already sit inside a single certification flow. Keep the two analyses in separate tools and files, and the cost lands at the moment you have to prove the connection between them. Start certification preparation that links safety and security on one structure, with VisualPro — proven in automotive, defense, robotics, and semiconductor programs.
Link safety and security on one structure — aviation certification preparation with VisualPro.
Sources — Military Embedded Systems, “Incorporating DO-326A security airworthiness into the software development life cycle”; Aviation Today, “How DO-326/ED-202 is becoming mandatory airworthiness” (regulatory timelines as stated at publication)
VisualPro & Demo Inquiries
DO-178C (ED-12C in Europe), the benchmark for airborne software certification, and ARP4754A, the system development guideline, address safety. But those standards deliberately placed cybersecurity outside their scope. They were built for random failures and development errors, not for a malicious actor.
DO-326A/ED-202A — the Airworthiness Security Process Specification — fills that gap. The FAA and EASA adopted it as an acceptable means of compliance for airworthiness certification, making it effectively mandatory for aircraft, rotorcraft, engine, and propeller certification.
Worth noting: this is not “Cyber DO-178.” The source explicitly refutes that shorthand, describing DO-326A as a cyber add-on to ARP-4754A, partly equivalent to a “Cyber ARP-4761” and a “Cyber DO-178C.” It adds a new layer of man-made-failure protection on top of the traditional safety standards.
The two processes do the same work in the same place — only the names differ.
And that is where the problem starts. If safety requirements live in the safety tool, security requirements in the security tool, and the architecture somewhere else — you model the same architecture twice, and neither analysis reaches the other. That is the classic path by which security-induced safety hazards go missing.
In aviation, safety and security already sit inside a single certification flow. Keep the two analyses in separate tools and files, and the cost lands at the moment you have to prove the connection between them. Start certification preparation that links safety and security on one structure, with VisualPro — proven in automotive, defense, robotics, and semiconductor programs.