TL;DR
A written airport resilience plan may not reveal what happens when several organisations need to respond at once. Testing a shared-service disruption together gives leaders evidence of whether the response can work in practice and where it needs attention. 6clicks brings together operational resilience testing evidence and activities, multi-framework compliance, third-party risk management, and continuous control monitoring to help organisations maintain defensible assurance and support the ongoing delivery of critical services.
Imagine a busy airport morning when a shared passenger-processing service becomes unavailable. The airport and its partners each have fallback plans that look reassuring on their own, but the disruption will not wait while everyone works out whether those plans fit together.
For an airport executive, this is where resilience becomes a practical leadership question: can the organisation and its partners make coordinated decisions when normal information and services are unavailable? The answer calls for evidence from testing the response where responsibilities meet, rather than relying on a completed checklist.
A disruption does not respect organisational boundaries
An August 2026 airport cyber-resilience assessment from OT-ISAC highlights the potential for a disruption at a shared provider to affect multiple organisations. It also notes that manual fallback may preserve operations at reduced throughput only when the necessary staffing and procedures have been exercised.
Return to the hypothetical outage. The airport’s manual procedure assumes that additional staff can be deployed quickly, while a partner’s plan relies on the same people for another task. Even if each team has rehearsed its own response, that conflict may remain invisible until they exercise it together.
The consequences reach the executive table when leaders must decide how much activity can continue safely and how to explain a reduced service to passengers. That decision depends on operational expertise as well as a realistic understanding of partner capabilities.
Run the scenario that makes assumptions visible
A useful exercise begins with a scenario that reflects a material dependency. Invite the people who would actually make decisions during the interruption, including relevant partners, and establish what "safe" reduced operations would look like. Ask who can authorise a change in capacity and how that decision would reach affected teams.
The scenario should make the pressure concrete. If a shared service is unavailable for several hours, participants need to establish which passenger processes can continue manually and how much capacity remains safe. They should also consider who can authorise changes to operations and how those decisions will reach partners if normal communication channels are affected.
The exercise should test how decisions pass between organisations, not just whether the technical service can be restored. Participants can explain the support they expect from their partners and how their response would change if that support did not arrive. Introducing a complication such as a staffing shortage can expose assumptions that a straightforward walkthrough might miss.
Record what participants observed, not merely who attended. If the exercise reveals that two parties expect different recovery times, an accountable owner can resolve the discrepancy and agree on when the revised arrangement will be tested. A change in provider or operating model is a reason to consider whether the earlier exercise still reflects reality.
For the CEO, the resulting report should make the decision visible: what could the organisation safely continue to do under the scenario, and which unresolved assumption might change that answer?
Airport resilience has a regulatory dimension
A joint exercise can do more than rehearse an operational response: it can produce evidence that helps an airport explain how its controls and recovery arrangements work in practice. Before deciding what evidence to retain, the airport should identify the requirements that apply to its own operations and understand where its partners have separate obligations.
Australia: the SOCI Act. The Security of Critical Infrastructure Act 2018 (SOCI Act) covers certain critical aviation assets within the transport sector. Applicable obligations depend on the asset and the organisation’s role and can include cyber incident reporting and notifying third-party providers that process or store business-critical data. Additional enhanced cyber security obligations may apply if an asset is designated a System of National Significance.
European Union: NIS2. The NIS2 Directive includes airport managing bodies and certain entities operating ancillary installations within airports in its transport sector scope. For covered entities, Article 21 addresses cybersecurity risk management measures including incident handling, business continuity and crisis management, supply-chain security, and assessing the effectiveness of those measures. The directive is implemented through national law, so organisations should confirm their status and requirements in each relevant Member State.
The connection to an airport exercise is tangible: a record of a fallback test, its findings, and the actions taken can help show how a relevant continuity or cybersecurity measure has been assessed. Neither the SOCI Act nor NIS2 makes every airport subject to the same obligations, and an exercise alone does not establish compliance or guarantee operational continuity.
Turn one exercise into an ongoing view of resilience
The value of an exercise can fade quickly when its findings and follow-up actions sit in separate files. With 6clicks, teams can bring this information together as part of their operational resilience programme, making it easier to review what happened and revisit the findings as dependencies change.
-
Centralised dashboards give leaders a view of controls and open gaps across the organisation, with supporting detail available when they need to look beyond a completion percentage.
-
Multi-framework mapping is automated across frameworks, so a control relevant to more than one requirement can be linked and its supporting work reused.
- Bring manual and automated control testing into one place. An airport could document a facilitated fallback exercise alongside automated tests of relevant cloud or identity controls.
- With intelligent evidence validation, Hailey can generate test-specific validation guides and analyse evidence to surface findings. Accountable reviewers remain responsible for deciding whether the evidence is sufficient and what needs follow-up.
- Connected compliance registers provide a structured way to link tests, evidence, assets, and controls. Teams can also create a custom register specifically for resilience testing activities. For each exercise, the register could capture the scenario, then track findings through to an assigned owner and a subsequent retest. This gives reviewers a clearer path from what happened during the exercise to the work that follows.
- Where a finding involves a supplier, it can feed into a built-in third parties register, where teams can track assessments and remediation.
Rather than making a plan look complete, this approach gives leadership a more reliable account of how the response worked in practice and where it needs to improve before a disruption occurs.
Frequently asked questions
It is an airport’s ability to prepare for disruption and support a safe, coordinated response and recovery. The practical approach depends on the service affected and the partners involved.
Separate plans can rely on different assumptions about staffing or coordination. A joint exercise can reveal whether those arrangements work together and what needs attention before a real disruption.
No. Australia’s SOCI Act applies to certain critical aviation assets, with obligations depending on the asset and the organisation’s role. NIS2 includes airport managing bodies and certain other airport-related entities in its transport-sector scope, but coverage and obligations must be checked under the relevant national implementation.
An exercise record should explain what was tested and who took part, then capture the decisions and observations that informed its findings. It should also show who owns follow-up actions and whether they have been retested. The evidence required for compliance depends on the organisation’s applicable obligations and controls.
