Canadian Aviation Security Regulations, 2012 (SOR/2011-318)

DIVISION 8Airport Security Programs

Overview

Marginal note:Division overview

453 This Division sets out the regulatory framework for promoting a comprehensive, coordinated and integrated approach to airport security. The processes required under this Division are intended to facilitate the establishment and implementation of effective airport security programs that reflect the circumstances of each aerodrome.

Interpretation

Marginal note:Processes and procedures

454 For greater certainty, any reference to a process in this Division includes the procedures, if any, that are necessary to implement that process.

Airport Security Program Requirements

Marginal note:Requirement to establish and implement

• 455 (1) The operator of an aerodrome must establish and implement an airport security program.

• Marginal note:Program requirements

  (2) As part of its airport security program, the operator of an aerodrome must

  • (a) define and document the aerodrome-related security roles and responsibilities assigned to each of the operator’s employee groups and contractor groups;

  • (b) communicate the information referred to in paragraph (a) to the employees and contractors in those groups;

  • (c) have a security policy statement that establishes an overall commitment and direction for aerodrome security and sets out the operator’s security objectives;

  • (d) communicate the security policy statement in an accessible manner to all persons who are employed at the aerodrome or who require access to the aerodrome in the course of their employment;

  • (e) establish and implement a process for responding to aerodrome-related security incidents and breaches in a coordinated manner that is intended to minimize their impact;

  • (f) establish and implement a security awareness program that promotes a culture of security vigilance and awareness among the following persons:

    • (i) persons who are employed at the aerodrome,

    • (ii) crew members who are based at the aerodrome, and

    • (iii) persons, other than crew members, who require access to the aerodrome in the course of their employment;

  • (g) assess risk information and disseminate it within the operator’s organization for the purpose of informed decision-making about aviation security;

  • (h) establish and implement a process for receiving, retaining, disclosing and disposing of sensitive information respecting aviation security in order to protect the information from unauthorized access;

  • (i) identify sensitive information respecting aviation security and receive, retain, disclose and dispose of sensitive information respecting aviation security in a manner that protects the information from unauthorized access;

  • (j) disclose sensitive information respecting aviation security to the following persons if they have been assigned aerodrome-related security roles and responsibilities and require the information to carry out those roles and responsibilities:

    • (i) persons who are employed at the aerodrome, and

    • (ii) persons who require access to the aerodrome in the course of their employment;

  • (k) have a current scale map of the aerodrome that identifies all restricted areas, security barriers and restricted area access points; and

  • (l) document how the operator achieves compliance with the aviation security provisions of the Act and the regulatory requirements that apply to the operator.

• Marginal note:Other program requirements

  (3) The following also form part of the airport security program:

  • (a) the security official referred to in section 425;

  • (b) the aerodrome security personnel training referred to in sections 426 and 427;

  • (c) the security committee or other working group or forum referred to in section 458;

  • (d) if applicable, the airport security risk assessment referred to in section 461;

  • (e) if applicable, the strategic airport security plan referred to in section 466;

  • (f) the menu of additional safeguards referred to in section 472;

  • (g) the emergency plan referred to in section 474; and

  • (h) the security exercises referred to in sections 475 and 476.

Marginal note:Documentation

• 456 (1) The operator of an aerodrome must

  • (a) keep documentation related to its menu of additional safeguards and any amendment to it for at least five years;

  • (b) if applicable, keep documentation related to its airport security risk assessment and any review of it for at least five years;

  • (c) if applicable, keep documentation related to its strategic airport security plan and any amendment to it for at least five years; and

  • (d) keep all other documentation related to its airport security program for at least two years.

• Marginal note:Ministerial access

  (2) The operator of the aerodrome must make the documentation available to the Minister on reasonable notice given by the Minister.

Marginal note:Requirement to amend

457 The operator of an aerodrome must amend its airport security program if the operator identifies, at the aerodrome, an aviation security risk that is not addressed by the program.

Security Committee

Marginal note:Security committee

• 458 (1) The operator of an aerodrome must have a security committee or other working group or forum that

  • (a) advises the operator on the development of controls and processes that are necessary at the aerodrome in order to comply with the aviation security provisions of the Act and the regulatory requirements that apply to the operator;

  • (b) helps coordinate the implementation of the controls and processes that are necessary at the aerodrome in order to comply with the aviation security provisions of the Act and the regulatory requirements that apply to the operator; and

  • (c) promotes the sharing of information respecting the airport security program.

• Marginal note:Terms of reference

  (2) The operator of the aerodrome must manage the security committee or other working group or forum in accordance with written terms of reference that

  • (a) identify its membership; and

  • (b) define the roles and responsibilities of each member.

• Marginal note:Records

  (3) The operator of the aerodrome must keep records of the activities and decisions of the security committee or other working group or forum.

Requirements that Apply only if an Amendment to Schedule 3 or a Ministerial Order is made: Airport Security Risk Assessments and Strategic Airport Security Plans

Marginal note:Application

• 459 (1) Subject to section 460, sections 461 to 471 apply to the operator of an aerodrome if

  • (a) the Governor in Council makes an aviation security regulation adding an asterisk in Schedule 3 after the International Civil Aviation Organization (ICAO) location indicator of the aerodrome; or

  • (b) the Minister makes an order stating that sections 461 to 471 apply to the operator.

• Marginal note:Minister’s authority

  (2) The Minister is authorized to make orders stating that sections 461 to 471 apply to operators of aerodromes listed in Schedule 3.

Marginal note:Transition

• 460 (1) Sections 461 and 462 do not apply to the operator of an aerodrome until the day that is 10 months after the earlier of

  • (a) the day on which an aviation security regulation adding an asterisk in Schedule 3 after the International Civil Aviation Organization (ICAO) location indicator of the aerodrome comes into force, and

  • (b) the day on which a ministerial order stating that sections 461 to 471 apply to the operator comes into force.

• Marginal note:Transition

  (2) Sections 466 and 468 do not apply to the operator of an aerodrome until the day that is 22 months after the earlier of

  • (a) the day on which an aviation security regulation adding an asterisk in Schedule 3 after the International Civil Aviation Organization (ICAO) location indicator of the aerodrome comes into force, and

  • (b) the day on which a ministerial order stating that sections 461 to 471 apply to the operator comes into force.

Marginal note:Airport security risk assessments

461 The operator of an aerodrome must have an airport security risk assessment that identifies, assesses and prioritizes aviation security risks and that includes the following elements:

• (a) a threat assessment that evaluates the probability that aviation security incidents will occur at the aerodrome;

• (b) a criticality assessment that prioritizes the areas, assets, infrastructure and operations at or associated with the aerodrome that most require protection from acts and attempted acts of unlawful interference with civil aviation;

• (c) a vulnerability assessment that considers the extent to which the areas, assets, infrastructure and operations at or associated with the aerodrome are susceptible to loss or damage and that evaluates this susceptibility in the context of the threat assessment; and

• (d) an impact assessment that, at a minimum, measures the consequences of an aviation security incident or potential aviation security incident in terms of

  • (i) a decrease in public safety and security,

  • (ii) financial and economic loss, and

  • (iii) a loss of public confidence.

Marginal note:Submission for approval

462 The operator of an aerodrome must submit its airport security risk assessment to the Minister for approval, and must submit a new airport security risk assessment to the Minister within five years after the date of the most recent approval.

Marginal note:Requirement to consult

463 The operator of an aerodrome must consult its security committee or other working group or forum when the operator is

• (a) preparing its airport security risk assessment for submission to the Minister for approval; and

• (b) conducting a review of its airport security risk assessment.

Marginal note:Airport security risk assessment — annual review

• 464 (1) The operator of an aerodrome must conduct a review of its airport security risk assessment at least once a year.

• Marginal note:Airport security risk assessment — other reviews

  (2) The operator of the aerodrome must also conduct a review of its airport security risk assessment if

  • (a) a special event that is scheduled to take place at the aerodrome could affect aerodrome security;

  • (b) the operator is planning a change to the physical layout or operation of the aerodrome that could affect aviation security at the aerodrome;

  • (c) an environmental or operational change at the aerodrome could affect aerodrome security;

  • (d) a change in regulatory requirements could affect aerodrome security;

  • (e) the operator identifies, at the aerodrome, a vulnerability that is not addressed in the assessment, or the Minister identifies such a vulnerability to the operator; or

  • (f) the Minister informs the operator that there is a change in the threat environment that could result in a new or unaddressed medium to high risk.

• Marginal note:Equivalency

  (3) For greater certainty, a review conducted under subsection (2) counts as a review required under subsection (1).

• Marginal note:Documentation

  (4) When the operator of the aerodrome conducts a review of its airport security risk assessment, the operator must document

  • (a) any decision to amend or to not amend the assessment or the operator’s risk-management strategy;

  • (b) the reasons for that decision; and

  • (c) the factors that were taken into consideration in making that decision.

• Marginal note:Notification

  (5) The operator of the aerodrome must notify the Minister if, as a result of a review of its airport security risk assessment, the operator amends the assessment

  • (a) to include a new medium to high risk; or

  • (b) to raise or lower the level of a risk within the medium to high range.

Marginal note:Approval

465 The Minister must approve an airport security risk assessment submitted by the operator of an aerodrome if

• (a) the assessment meets the requirements of section 461;

• (b) the assessment has been reviewed by an executive within the operator’s organization who is responsible for security;

• (c) the operator has considered the advice of its security committee or other working group or forum;

• (d) the operator has considered all available and relevant information; and

• (e) the operator has not overlooked an aviation security risk that could affect the operation of the aerodrome.

Marginal note:Strategic airport security plans

466 The operator of an aerodrome must establish a strategic airport security plan that

• (a) summarizes the operator’s strategy to prepare for, detect, prevent, respond to and recover from acts or attempted acts of unlawful interference with civil aviation; and

• (b) includes a risk-management strategy that addresses the medium to high aviation security risks identified and prioritized in the operator’s airport security risk assessment.

Marginal note:Requirement to consult

467 The operator of an aerodrome must consult its security committee or other working group or forum when establishing its strategic airport security plan.