For aerospace operations, ISO 27001 risk workshops work best when they are cross functional and aligned to the actual system landscape, not just the org chart. The exact participants depend on the scope of the workshop, but the following roles are typically required.
Core participants (almost always required)
- Information Security / CISO function: Facilitates the risk method, keeps alignment to ISO 27001, maintains the risk register structure, and ensures treatment options and control mapping are consistent with the ISMS.
- IT Operations: Represents enterprise infrastructure, networks, identity and access, backup/restore, and cloud or data center services that support engineering, MES, PLM, ERP, and QMS.
- OT / Manufacturing Systems Engineers: Represent control systems (PLCs, SCADA, DCS), industrial networks, HMIs, and integration with MES and test systems. They are essential for realistic assessment of downtime risk, patching constraints, and vendor limitations.
- Manufacturing / Operations Leadership: Brings understanding of production priorities, takt time constraints, maintenance windows, and the business impact of loss of availability, integrity, or traceability in the shop floor environment.
- Engineering / Product & Test Owners: Represent CAD/PLM, NC programming, test rigs, and model-based definition. They help evaluate risks around design data integrity, export-controlled data, and configuration changes that affect qualified processes.
- Quality / Compliance Representatives: Ensure that risk scenarios consider implications for nonconformance handling, records retention, traceability, regulated documentation, and how cybersecurity events intersect with quality and airworthiness obligations.
- ISMS Owner / Risk Manager: Maintains the overall ISO 27001 risk framework, ensures consistency across sites and programs, and checks that workshop outputs are usable for ongoing risk treatment, monitoring, and internal audits.
Participants based on scope and data sensitivity
- Program / Business Unit Leaders: Needed when the scope covers a major platform or key customer contract so impact scoring aligns with contractual, export, and schedule realities.
- Export Controls / Trade Compliance: Involved when the workshop covers ITAR/EAR or other controlled technical data, to quantify regulatory and data-handling risks accurately.
- Supply Chain / Supplier Management: Important if critical processes or data reside at suppliers (e.g., special processes, machining, assembly, testing) or depend on shared portals, EDI, or shared PLM/MES access.
- Facilities / EHS: Included when physical security, shared utilities, or environmental/health/safety systems affect or are affected by cyber events (e.g., building management systems, compressed air, or nitrogen supplies tied to production).
- Data Owners / Process Owners: Named owners for specific information assets (e.g., NC programs, FAI records, as-built/as-flown traceability, test data) so that asset value and tolerable downtime are not guessed by IT alone.
- Vendor or Integrator Representatives: Sometimes needed for proprietary MES/SCADA/PLM, legacy test stands, or cloud services when internal teams lack full visibility into technical limitations and realistic mitigations.
Who should not own the workshop alone
- IT or security alone should not run risk workshops without operations, engineering, and quality. This often leads to controls that look good on paper but are not deployable in a qualified aerospace production environment.
- Single-vendor perspectives should not dominate. Many aerospace plants run brownfield stacks with multiple MES, legacy test systems, and long-lived equipment. Risk decisions must reflect coexistence and integration constraints across all major systems.
Practical participation rules for brownfield aerospace plants
- Scope per workshop: Define the boundary first (e.g., “final assembly line and associated MES/PLM” or “engine test cells and data systems”). Invite only those who have accountability or deep knowledge within that boundary.
- Representation, not crowding: Aim for 8–15 active participants. Consolidate representation where possible (e.g., one senior OT engineer who can speak for several lines, one quality lead with delegated inputs).
- Include both business and technical views: Ensure every critical process area has at least one technical representative (who understands systems and constraints) and one business/process owner (who understands operational and contractual impact).
- Cover the full lifecycle: Because equipment and software live for decades, include voices who understand legacy qualification constraints, historical deviations, and planned modernization, not just new deployments.
- Ensure decision-making authority: At least some participants should be able to commit to risk acceptance, prioritization, or follow-up actions, or to bring decisions promptly to the correct governance body.
Role of governance and change control
- Change control boards (CCBs) or similar governance bodies should not all attend, but should receive outputs, as many risk treatments will require controlled changes to validated or qualified systems.
- Configuration management and document control teams should be consulted so that identified treatments (e.g., new procedures, updated work instructions) can be implemented with traceability across systems and sites.
How this differs from generic ISO 27001 workshops
- In aerospace manufacturing, availability and integrity of OT and quality records often carry higher operational risk than typical office IT services, so OT, quality, and engineering participation is not optional.
- Because plants run mixed legacy and modern systems, risk discussions must include people who understand integration, validation history, and why “rip-and-replace” or frequent patching may be impractical without requalification and significant downtime.
- Export controls and customer / regulatory obligations add stakeholders that are not present in most generic ISO 27001 contexts, particularly for handling controlled technical data and multi-national programs.