ANAC AVSEC Instructor - Aerodrome Operators (Instrutor AVSEC - Operador de Aeródromo - IOAD) cheat sheet

ICAO Annex 17 (Security) sets Standards (binding, with differences notified) and Recommended Practices; it is the legal baseline for national AVSEC regulation.

ICAO Doc 8973 (Security Manual) is guidance material: it explains how to implement Annex 17 but creates no obligation by itself.

Annex 17 core principles: each State designates an authority, adopts a National Civil Aviation Security Programme (NCASP), and ensures airport and operator programmes.

The Chicago Convention (Art. 44, Art. 26) and the Tokyo, Hague, Montreal and Beijing instruments establish jurisdiction and offences for unlawful interference.

National AVSEC regulation (e.g. the State's AVSEC law plus the NCASP) transposes Annex 17; operator documents must not be less stringent than the NCASP.

States notify ICAO of differences between their national practice and Annex 17 Standards; notified differences do not excuse operators from national rules.

Annex 17 obligations flow to operators via the Aerodrome Security Programme (ASP), which the competent authority approves and audits.

Security controls must be layered: no single measure is assumed sufficient, and the legal framework requires proportionate, risk-based measures.

Competent authority: sets policy, approves programmes, certifies or approves screeners, audits, and enforces; the operator implements at the aerodrome.

Aerodrome operator is accountable for the ASP, access control, perimeter, and coordination of all entities operating on the aerodrome.

An Aerodrome Security Committee (ASC) chaired by the operator coordinates police, carriers, ground handlers, and air traffic services.

The operator names a designated security manager with defined authority and resources to implement the ASP.

Airlines retain responsibility for screening of passengers/baggage where the State assigns it; the ASP defines the interface to avoid gaps.

The National Civil Aviation Security Committee coordinates State departments; the operator's ASC mirrors this at aerodrome level.

Roles must be documented in the ASP with named positions, not individuals, so accountability survives staff turnover.

The competent authority conducts audits and tests; the operator must have an internal quality-control and corrective-action process.

The ASP is a risk-based written programme: threat assessment, measures, responsibilities, resources, and review cycle.

Contingency plans cover bomb threats, hijack, sabotage, hostage situations, and unlawful intrusion, with defined command and communication lines.

Each contingency plan states triggers, decision authority, evacuation or shelter decisions, and recovery and return-to-service steps.

The ASP must define the aerodrome restricted area, sterilisation procedures, and the security restricted area boundaries.

Plans are tested through exercises (tabletop and live) and revised after exercises or real incidents.

The ASP must address interfaces with aircraft operators' security programmes and with law enforcement response.

Records of drills, exercises, and reviews are evidence of an effective programme in audits.

Contingency plans include media and family-assistance arrangements and preservation of evidence for investigation.

Access control is layered: identification, authorisation, authentication, and physical control at the point of entry.

The security restricted area (SRA) is where screened persons and cleared items are protected from unauthorised interference.

Airside/landside boundary and the SRA perimeter must be continuous, monitored, and patrolled where required.

Access permits are issued to persons with an operational need; the ASP states validity, display rules, and revocation.

Vehicle access requires separate authorisation, inspection, and escort when the vehicle is not permanently authorised.

Keys, codes, and electronic access media are controlled, recorded, and recovered on termination of employment.

Perimeter alarms and CCTV must have defined response procedures; an alarm without a response is not a control.

Sterilisation of the SRA precedes screening of departing traffic; the operator verifies no unauthorised items or persons remain.

Screening aims to prevent prohibited items from entering the SRA or the aircraft; it applies to persons, cabin and hold baggage, cargo, mail, and stores.

Screening methods include X-ray, walk-through and hand-held metal detectors, explosive trace detection, and physical search.

Random and unpredictable screening supplements systematic screening and is a required layer in many national programmes.

Cargo and mail require a secure supply chain: known consignor/regulated agent status, tamper-evident sealing, and documented chain of custody.

Screened items must be protected from unauthorised interference from the screening point to the aircraft.

Screeners must be certified, recurrently trained, and subject to competency assessment; certification is withdrawn for failure.

Prohibited items lists are set nationally; the operator must publish and enforce them at screening points.

Screening equipment requires calibration, routine testing with test pieces, and maintenance records.

Unlawful interference includes hijacking, sabotage, armed attack, bomb threat, and intrusion into the SRA.

First response: protect life, alert law enforcement and the competent authority, secure the scene, and preserve evidence.

The aerodrome emergency plan (AEP) and the ASP contingency plans must be interoperable and exercised jointly.

Bomb threat response follows a decision tree: evaluate credibility, search, evacuate or shelter, and declare all-clear only after search.

An incident command structure with a single accountable commander avoids conflicting instructions.

Post-incident: report to the competent authority, conduct investigation support, and revise the ASP.

Communication with passengers and media is controlled through a designated spokesperson.

Return to normal operations requires verification that the SRA is sterile and controls are restored.

Human performance is affected by fatigue, workload, stress, and complacency; screening tasks are vigilance-intensive and degrade over time.

Security culture is measurable through reporting behaviour, rule adherence, and willingness to challenge unusual access.

Insider threat indicators include unexplained access attempts, unusual interest in security procedures, and financial or personal stress.

Need-to-know limits dissemination of security information; oversharing increases insider risk.

Just culture encourages reporting of errors without punishing honest mistakes, while deliberate violations remain sanctionable.

Team communication and briefings reduce error; handover procedures must be explicit.

Selection and vetting (background checks, references) are preventive controls against insider threat.

Reporting channels must be known, trusted, and protected for those who raise concerns.

Adult learners need relevance, autonomy, experience-based examples, and problem-centred tasks rather than lecture-only delivery.

Instructional design follows analysis, design, development, implementation, and evaluation (ADDIE).

Learning objectives must be observable and measurable (action verb plus condition plus standard).

Training needs analysis identifies gaps between required and current competence; the ASP defines required competencies.

Content is sequenced from simple to complex and aligned to assessment criteria.

Recurrent training refreshes skills and addresses regulatory changes; it is not a repeat of initial training.

Blended design combines theory with practical exercises, simulations, and on-the-job training.

Materials must be version-controlled and reviewed when regulations or procedures change.

Delivery methods (briefing, demonstration, guided practice, simulation, case study) are selected to match the objective.

Assessment must be valid (measures the objective), reliable (consistent across assessors), and fair.

Formative assessment informs learning; summative assessment certifies competence against defined standards.

Evaluation levels (reaction, learning, behaviour, results) measure training effectiveness beyond pass rates.

Instructor competency includes subject knowledge, facilitation skill, assessment skill, and professional conduct.

Instructors are themselves assessed and recurrently developed; their competence is documented.

Assessment records, pass standards, and remediation paths are retained as audit evidence.

Feedback must be specific, timely, and referenced to the standard, not to the person.

Instructor qualification requires documented subject competence, instructional competence, and assessment competence.

Instructor currency is maintained through delivery frequency, refresher training, and observation.

Quality assurance includes lesson observation, learner feedback, and review of assessment decisions.

Assessment decisions must be defensible: evidence, criteria, and judgement recorded.

Instructor must model security culture and compliance, since learner behaviour mirrors instructor norms.

Training records must demonstrate that all personnel meet the required competency before authorisation.

Non-conformities found in audits trigger corrective action with a defined owner and deadline.

Instructor standardisation meetings align assessment judgements across instructors.

The ASP interfaces with aircraft operator security programmes, ground handler procedures, and law enforcement response plans.

Contractors and concessionaires must be bound by the ASP through contract clauses and briefings.

Coordination with air traffic services is required for perimeter and airside incidents.

The operator coordinates screening responsibilities with carriers where the State assigns screening to airlines.

Joint exercises with police and emergency services test interfaces, not just internal procedures.

Information sharing is limited to need-to-know and protected in accordance with national rules.

Interface gaps are a common audit finding; the ASP must name the responsible party for each boundary.

Changes to one entity's procedures require review of the ASP interface.

Security equipment requires acceptance testing, routine performance testing, calibration, and maintenance records.

CCTV and access-control logs are retained for the period set by national regulation.

Records must be legible, retrievable, and protected from alteration.

Fault reporting and out-of-service procedures must be defined, with compensating measures.

Quality control includes covert and overt tests of screening and access control.

Test results are analysed for trends, not only for individual failures.

Equipment failure does not suspend the requirement; compensating controls apply until restoration.

Audit trails of access-control systems support investigation of insider incidents.

Risk equals likelihood multiplied by consequence; controls reduce one or both.

Threat assessment considers capability, intent, and opportunity of adversaries, including insiders.

Vulnerability assessment identifies gaps between threat and existing controls.

Risk treatment options are avoid, reduce, transfer, or accept, with acceptance documented by an accountable manager.

Risk assessment is reviewed when the threat level changes or after an incident.

National threat levels inform but do not replace aerodrome-level assessment.

Residual risk after controls must be acceptable to the accountable manager.

Risk registers record owner, treatment, and review date.

Compliance is demonstrated by evidence, not by assertion; the ASP and records are the evidence base.

Audits may be announced or unannounced; operators must provide access and cooperation.

Findings are classified by severity and require corrective action with owner and deadline.

Root-cause analysis distinguishes systemic from individual causes.

Corrective actions are verified for effectiveness, not merely closed.

Repeat findings indicate a failure of the quality system.

The competent authority may restrict operations pending correction.

Compliance monitoring is continuous, not only at audit time.

Evaluation uses reaction, learning, behaviour, and results data to judge programme effectiveness.

Pass rates alone are insufficient evidence of competence.

Learner feedback is one input; observation and incident data are stronger.

Training is revised when procedures, equipment, or regulations change.

Competency gaps identified in operations feed back into training needs analysis.

Records demonstrate that training occurred and that competence was assessed.

Continuous improvement cycles set measurable targets and review them.

Instructor performance data informs instructor development.

Throughput planning must balance queue time against screening quality; fatigue rises with sustained pressure.

Random selection of passengers for additional screening is documented and non-discriminatory.

Screening point layout separates screened from unscreened flows.

Hold baggage screening must be integrated with baggage reconciliation.

Prohibited items discovered are handled per national procedure, including law enforcement notification.

Screeners rotate tasks to manage vigilance decrement.

Supervision at screening points is continuous.

Incident and near-miss reporting at screening feeds quality control.

The AEP covers aircraft accidents and incidents; the ASP contingency plans cover security events; both must be interoperable.

The AEP defines the emergency operations centre, command structure, and communication channels.

Exercises are scheduled, recorded, and evaluated; lessons are implemented.

Mutual aid agreements with off-aerodrome services are documented.

Evacuation routes and assembly points must be known to all staff.

Media and family assistance arrangements are part of the plan.

Recovery and return-to-service steps are defined in advance.

Plan reviews are triggered by exercises, incidents, and organisational change.

Secure supply chain relies on known consignors and regulated agents with documented status.

Cargo must be protected from unauthorised interference from screening to loading.

Tamper-evident seals and chain-of-custody records evidence protection.

Screening methods for cargo include X-ray, explosive detection, and physical inspection.

Mail screening follows national rules and may differ from cargo rules.

Consignments from unknown sources require screening before loading.

Records of screening and custody are retained for the regulatory period.

Insider risk in cargo areas requires access control and supervision.

Vigilance decrement occurs within short periods; rotation and breaks are controls.

Fatigue impairs detection and decision-making; rostering must account for it.

Complacency arises when events are rare; unpredictable testing counters it.

Stress and pressure can cause shortcuts; supervision and just culture mitigate.

Communication errors at handover are a known failure mode.

Human error is normal; systems must be designed to detect and contain it.

Training should include error recognition and recovery.

Incident reports should capture human-factor contributors.

Security culture includes leadership commitment, shared values, and reporting behaviour.

Insider threat indicators include unusual access patterns and attempts to bypass procedures.

Vetting and background checks are preventive controls.

Need-to-know limits information exposure.

Reporting channels must be trusted and protected.

Just culture distinguishes error from violation.

Supervisors model compliant behaviour.

Insider incidents are investigated and lessons applied to the ASP.

Competency-based training defines what a person must be able to do, to what standard, under what conditions.

Learning objectives use observable verbs and explicit standards.

Task analysis identifies the steps and decisions of a job role.

Assessment criteria are derived from the objective, not from content coverage.

Scenario-based design reflects real aerodrome conditions.

Materials are version-controlled and reviewed on regulatory change.

Recurrent training addresses changes and refreshes skills.

Evaluation closes the design loop.

Validity: the assessment measures the intended objective.

Reliability: consistent results across assessors and occasions.

Fairness: no irrelevant advantage or disadvantage.

Formative assessment informs; summative assessment certifies.

Assessment evidence is recorded and retained.

Remediation paths are defined for those who do not meet the standard.

Evaluation levels measure reaction, learning, behaviour, and results.

Assessment decisions are defensible and documented.

Instructor competence includes subject knowledge, facilitation, assessment, and conduct.

Instructors are observed and assessed recurrently.

Instructors model compliance and security culture.

Feedback is specific, timely, and referenced to the standard.

Instructor standardisation aligns assessment judgements.

Instructor records evidence currency and development.

Instructors must not assess their own training without independent verification where required.

Professional conduct includes confidentiality and need-to-know.

National law and the NCASP set the minimum standards for the ASP.

The competent authority approves the ASP and audits compliance.

Operators must not apply measures less stringent than national requirements.

Differences notified to ICAO do not relieve operators of national obligations.

Enforcement includes findings, restrictions, and sanctions.

Records evidence compliance.

Changes to national rules trigger ASP review.

Operator obligations include coordination with all aerodrome entities.

Electronic access control supports authorisation, authentication, and audit trail.

Biometric or token authentication reduces credential sharing risk.

Access logs support investigation and audit.

Lost or stolen credentials require immediate revocation.

System failures require compensating controls.

Records are retained per national rules.

Alarm response procedures must be defined.

Periodic review of access rights prevents privilege creep.

First response protects life, alerts authorities, secures the scene, and preserves evidence.

Reporting to the competent authority follows national timelines.

Incident command requires a single accountable commander.

Communication is controlled through a designated spokesperson.

Post-incident review identifies causes and corrective actions.

Lessons are incorporated into the ASP and training.

Records of incidents and responses are retained.

Return to service requires verification that controls are restored.

Equipment requires acceptance testing, routine testing, calibration, and maintenance records.

Test pieces verify detection performance.

Prohibited items lists are national and must be enforced at screening points.

Random screening supplements systematic screening.

Screened items are protected from interference to the aircraft.

Screeners are certified and recurrently assessed.

Supervision at screening points is continuous.

Near-miss reporting feeds quality control.

The SRA is where screened persons and cleared items are protected from interference.

Sterilisation precedes departure screening.

The operator verifies no unauthorised persons or items remain.

Boundaries are continuous, monitored, and patrolled where required.

Access permits are issued on operational need.

Vehicle access requires authorisation and inspection.

Keys and codes are controlled and recovered on termination.

Alarms require defined responses.

Plans cover bomb threats, hijack, sabotage, hostage, and intrusion.

Each plan defines triggers, decision authority, and actions.

Evacuation or shelter decisions are pre-defined.

Plans are exercised and revised.

Interfaces with law enforcement and carriers are defined.

Media and family assistance are addressed.

Evidence preservation is addressed.

Recovery and return-to-service steps are defined.

Quality control includes covert and overt tests.

Results are analysed for trends.

Corrective actions have owners and deadlines.

Effectiveness is verified, not merely closed.

Repeat findings indicate systemic failure.

Records evidence the quality system.

Training is revised on findings.

Continuous improvement sets measurable targets.

National threat levels inform aerodrome assessment.

Risk equals likelihood multiplied by consequence.

Controls reduce likelihood, consequence, or both.

Residual risk must be acceptable to the accountable manager.

Risk registers record owner, treatment, and review date.

Reviews are triggered by threat changes and incidents.

Insider threat is part of the assessment.

Risk acceptance is documented.

Records demonstrate training occurred and competence was assessed.

Records include objectives, standards, assessor, and result.

Records are retained per national rules.

Competency is demonstrated before authorisation.

Recurrent training is recorded.

Instructor competence is documented.

Records support audit and investigation.

Records are protected from alteration.

The ASP defines interfaces with police and emergency services.

Joint exercises test interfaces.

Response times and command structures are agreed in advance.

Information sharing is need-to-know.

Law enforcement handles criminal investigation; the operator preserves evidence.

Communication channels are defined and tested.

Mutual aid agreements are documented.

Post-incident reviews include all agencies.

All staff require security awareness training.

Reporting channels must be known and trusted.

Just culture encourages reporting.

Awareness includes insider threat indicators.

Awareness is refreshed recurrently.

Supervisors model compliant behaviour.

Reports are acted upon and feedback is given.

Awareness effectiveness is evaluated.

Delivery methods are selected to match the objective.

Demonstration and guided practice suit skill objectives.

Case studies suit decision-making objectives.

Simulation reflects real aerodrome conditions.

Questioning checks understanding and stimulates thinking.

Feedback is specific and referenced to the standard.

Group work develops communication and teamwork.

Delivery is adapted to learner experience.

Reaction measures learner perception.

Learning measures knowledge and skill gain.

Behaviour measures on-the-job performance.

Results measure operational outcomes.

Pass rates alone are insufficient.

Observation and incident data are strong evidence.

Evaluation informs redesign.

Targets are measurable and reviewed.

Assessment criteria derive from objectives.

Evidence is recorded.

Judgements are consistent across assessors.

Remediation is defined.

Assessment is fair and non-discriminatory.

Practical assessment reflects operational conditions.

Assessment decisions are defensible.

Records support audit.

The ASC is chaired by the operator.

Membership includes police, carriers, handlers, and ATS.

The ASC coordinates implementation of the ASP.

The ASC reviews incidents and findings.

The ASC coordinates exercises.

Minutes evidence coordination.

Interfaces and gaps are addressed.

Changes trigger review.

Vetting is a preventive control against insider threat.

Background checks cover identity, criminal record, and employment history per national rules.

Vetting is recurrent.

Access is granted only after vetting.

Records evidence vetting.

Adverse findings trigger review of access.

Contractors are vetted to the same standard.

Vetting supports need-to-know controls.

Supervision at screening points is continuous.

Throughput planning balances queue time and quality.

Rotation manages vigilance decrement.

Layout separates screened and unscreened flows.

Random selection is documented and non-discriminatory.

Prohibited items are handled per national procedure.

Near-miss reporting feeds quality control.

Equipment faults trigger compensating controls.