International and National Regulatory Framework for Air Cargo and Mail Security
The layered framework
Air cargo security sits inside a hierarchy of instruments. ICAO Annex 17 (Security) establishes the Standards and Recommended Practices (SARPs) that States must implement, including obligations on cargo, mail, and access control. Annex 9 (Facilitation) is the interface: its rules on customs, mail handling, and documentation interact with security controls, so a candidate must distinguish a security obligation from a facilitation obligation. Doc 8973 (Security Manual for Safeguarding Civil Aviation Against Acts of Unlawful Interference) is guidance, not a SARP; it explains how to build a programme rather than imposing a new legal duty. At national level, the State's civil aviation authority translates these into regulations, resolutions, and directives, which carry the actual legal force for operators.
Traps to expect
Questions often test the status of a document: Annex 17 is binding on States through the Convention; Doc 8973 is advisory. Another trap is the chain: Annex 17 sets the State obligation, the State sets the operator obligation, and the operator's security programme explains how it complies. Do not invert this. A further trap is confusing the State (which must have a national programme and oversight) with the operator (which must have an accepted security programme).
Rule of thumb
When a question asks "who is required to do X?", identify the level first: Convention/Annex (State), national regulation (State and its entities), accepted programme (operator). If the answer cites Doc 8973 as the source of a legal requirement, it is almost certainly wrong.
Worked example
A stem says a carrier must screen cargo because "Doc 8973 requires it." The correct reasoning is that the binding requirement flows from Annex 17 through national regulation; Doc 8973 only describes acceptable methods.