Safety and Security of Cloud Computing

On the 19^th May 2026 the UK Civil Aviation Authority (CAA) published a Consultation on the proposed CAP 3254; Safety and Security of Cloud Computing (‘the consultation’).

Stakeholders across the aviation community including airport operators, ATM providers, UAS operators, and other aviation regulators responded constructively and in detail.

There was general support for the document’s intent, layout, and guidance. Some respondents asked for clearer proportionality on how this guidance applies, ensuring that it scales appropriately from small, single person operations to large, complex organisations.

Suggestions were provided from multiple respondents to include references to cloud security frameworks, aiding integration of security risk management that could influence safety while recognising the implementation of these frameworks needs to be proportionate to the organisation.

Overall, respondents supported the proposed information provided it remained consistent, proportionate, operationally focussed, and the wording provides clear risk-based guidance to assist in achieving regulatory outcomes.

The CAA has carefully considered all consultation responses received and thanks all contributors. The feedback largely was constructive, technically detailed, and informed by relevant operational experience.

A number of content additions and minor editorial changes were made as a result of feedback, but the guidance was largely published as consulted.