1)

The following Attachment is inserted after Attachment 6-C: ‘ATTACHMENT 6-C2 VALIDATION CHECKLIST FOR THIRD COUNTRY EU AVIATION SECURITY VALIDATED REGULATED AGENTS Third country entities have the option to become part of an ACC3’s (Air cargo or mail carrier operating into the Union from a third country airport) secure supply chain by seeking designation as a third country EU aviation security validated Regulated Agent (RA3). An RA3 is a cargo handling entity located in a third country that is validated and approved as such on the basis of an EU aviation security validation. An RA3 shall ensure that security controls including screening where applicable have been applied to consignments bound for the European Union and the consignments have been protected from unauthorised interference from the time that those security controls were applied and until the consignments are loaded onto an aircraft or are otherwise handed over to an ACC3 or other RA3. The prerequisites for carrying air cargo or air mail into the Union (1) or Iceland, Norway and Switzerland are required by Regulation (EU) No 185/2010. The checklist is the instrument to be used by the EU aviation security validator for assessing the level of security applied to EU/EEA bound air cargo or air mail (2) by or under the responsibility of the entity seeking designation as an RA3. The checklist is to be used only in the cases specified in point 6.8.4.1(b) of the Annex to Regulation (EU) No 185/2010. In the cases specified in point 6.8.4.1(a) of that Annex, the EU aviation security validator shall use the ACC3 checklist. If the EU aviation security validator concludes that the entity has succeeded in complying with the objectives referred to in this checklist, a validation report shall be given to the validated entity. The validation report shall state that the entity is designated Third Country EU aviation security validated Regulated Agent (RA3). The RA3 shall be able to use the report in its business relations with any ACC3. Integral parts of the validation report shall include at least all of the following: (a) the completed checklist (attachment 6-C2 set out in the Annex to Regulation (EU) No 185/2010) signed by the EU aviation security validator and where applicable commented by the validated entity; (b) the declaration of commitments (Attachment 6-H2 set out in the Annex to Regulation (EU) No 185/2010) signed by the validated entity; (c) an independence declaration (Attachment 11-A set out in the Annex to Regulation (EU) No 185/2010) in respect of the entity validated signed by the EU aviation security validator. Page numbering, the date of the EU aviation security validation and initialling on each page by the validator and the validated entity shall be the proof of the validation report’s integrity. By default, the validation report shall be in English. Part 5 – Screening and Part 6 – High risk cargo or mail (HRCM) shall be assessed against the requirements of Chapters 6.7 and 6.8 of the Annex to Regulation (EU) No 185/2010. For those parts that cannot be assessed against the requirements of Regulation (EU) No 185/2010, baseline standards are the Standards and Recommended Practices (SARPs) of Annex 17 to the Convention on International Civil Aviation and the guidance material contained in the ICAO Aviation Security Manual (Doc 8973-Restricted). If the EU aviation security validator concludes that the entity has failed to comply with the objectives referred to in this checklist, the entity shall receive a copy of the completed checklist stating the deficiencies. Completion notes: (1) All parts of the checklist must be completed. Where no information is available, this must be explained. (2) After each part, the EU aviation security validator shall conclude if and to what extent the objectives of this part are met. PART 1 Identification of the entity validated and the validator 1.1. Date(s) of validation Use exact date format, such as 01.10.2012 to 02.10.2012 dd/mm/yyyy 1.2. Date of previous validation where applicable dd/mm/yyyy Previous RA3 registration number, where available AEO certificate/C-TPAT status/other certifications, where available 1.3. Aviation security validator information Name Company/Organisation/Authority Unique Alphanumeric Identifier (UAI) E-mail address Telephone number – including international codes 1.4. Name of entity Name Company number (e.g. commercial register identification number, if applicable) Number/Unit/Building Street Town Postcode State (where relevant) Country P.O. Box address, if applicable 1.5. Main address of organisation (if different from site to be validated) Number/Unit/Building Street Town Postcode State (where relevant) Country P.O. Box address, if applicable 1.6. Nature of business – More than one business type may be applicable a) air cargo only b) air and other modes of transport c) freight forwarder with cargo premises d) freight forwarder without cargo premises e) handling agent f) others 1.7. Does the applicant …? a) receive cargo from another 3rd country regulated agent b) receive cargo from 3rd country known consignors c) receive cargo from 3rd country account consignors d) receive exempted cargo e) screen cargo f) store cargo g) other, please specify 1.8. Approximate number of employees on site Number 1.9. Name and title of person responsible for third country air cargo/air mail security Name Job title E-mail address Telephone number – including international codes PART 2 Organisation and responsibilities of the third country EU aviation security validated regulated agent Objective: No air cargo or air mail shall be carried to the EU/EEA without being subject to security controls. Cargo and mail delivered by an RA3 to an ACC3 or another RA3 may only be accepted as secure cargo or mail if such security controls are applied by the RA3. Details of such controls are provided in the following Parts of this checklist. The RA3 shall have procedures in place to ensure that appropriate security controls are applied to all EU/EEA bound air cargo and air mail and that secure cargo or mail is protected until being transferred to an ACC3 or another RA3. Security controls shall consist of one of the following: (a) Physical screening which shall be of a standard sufficient to reasonably ensure that no prohibited articles are concealed in the consignment; (b) Other security controls, part of a supply chain security process, that reasonably ensure that no prohibited articles are concealed in the consignment and which have been applied by another RA3, KC3 or AC3 designated by the RA3. Reference: Point 6.8.3. 2.1. Has the entity established a security programme? YES or NO If NO go directly to point 2.5. 2.2. Entity security programme Date – use exact format dd/mm/yyyy Version Is the security programme submitted and/or approved by the appropriate authority of the state of the entity? If YES please describe the process. 2.3. Does the security programme sufficiently cover the elements mentioned in the checklist (parts 3 to 9)? YES or NO If NO, describe why detailing the reasons 2.4. Is the security programme conclusive, robust and complete? YES or NO If NO, specify the reasons 2.5. Has the entity established a process to ensure that air cargo or air mail is submitted to appropriate security controls before being transferred to an ACC3 or another RA3? YES or NO If YES, describe the process 2.6. Has the entity a management system (e.g. instruments, instructions) in place to ensure that the required security controls are implemented? YES or NO If YES, describe the management system and explain if it is approved, checked or provided by the appropriate authority or another entity. If NO, explain how the entity ensures that security controls are applied in the required manner. 2.7. Conclusions and general comments on the reliance, conclusiveness and robustness of the process. Comments from the entity Comments from the EU aviation security validator PART 3 Staff recruitment and training Objective: To ensure the required security controls are applied, the RA3 shall assign responsible and competent staff to work in the field of securing air cargo or air mail. Staff with access to secured air cargo must possess all the competencies required to perform their duties and shall be appropriately trained. To fulfil that objective, the RA3 shall have procedures in place to ensure that all staff (permanent, temporary, agency staff, drivers, etc.) with direct and unescorted access to air cargo/air mail to which security controls are being or have been applied: (a) have been subject to initial and recurrent pre-employment checks and/or background checks, which are at least in accordance with the requirements of the local authorities of the RA3 premise validated; and (b) have completed initial and recurrent security training to be aware of their security responsibilities in accordance with the requirements of the local authorities of the RA3 premise validated. Note: — A background check means a check of a person’s identity and previous experience, including where legally permissible, any criminal history as part of the assessment of an individual’s suitability to implement a security control and/or for unescorted access to a security restricted area (ICAO Annex 17 definition). — A pre-employment check shall establish the person’s identity on the basis of documentary evidence, cover employment, education and any gaps during at least the preceding five years, and require the person to sign a declaration detailing any criminal history in all states of residence during at least the preceding 5 years (Union definition). Reference: Point 6.8.3.1. 3.1. Is there a procedure ensuring that all staff with direct and unescorted access to secured air cargo/air mail is subject to a pre-employment check that assesses background and competence? YES or NO If YES, indicate the number of preceding years taken into account for the pre-employment check and state which entity carries it out. 3.2. Does this procedure include?  Background check  Pre-employment check  Check of criminal records  Interviews  Other (provide details) Explain the elements, indicate which entity carries this element out and where applicable, indicate the preceding timeframe that is taken into account. 3.3. Is there a procedure ensuring that the person responsible for the application and supervision of the implementation of security controls at the site is subject to a pre-employment check that assesses background and competence? YES or NO If YES, indicate the number of preceding years taken into account for the pre-employment check and state which entity carries it out. 3.4. Does this procedure include?  Background check  Pre-employment check  Check of criminal records  Interviews  Other (provide details) Explain the elements, indicate which entity carries this element out and where applicable, indicate the preceding timeframe that is taken into account. 3.5. Do staff with direct and unescorted access to secured air cargo/air mail receive security training before being given access to secured air cargo/air mail? YES or NO If YES, describe the elements and duration of the training 3.6. Do staff that accept, screen and/or protect air cargo/air mail receive specific job-related training? YES or NO If YES, describe the elements and durations of training courses. 3.7. Do staff referred to in points 3.5 and 3.6 receive recurrent training? YES or NO If YES, specify the elements and the frequency of the recurrent training 3.8. Conclusion: do the measures concerning staff recruitment and training ensure that all staff with access to secured air cargo/air mail have been properly recruited and trained to a standard sufficient to be aware of their security responsibilities? YES or NO If NO, specify reasons Comments from the entity Comments from the EU aviation security validator PART 4 Acceptance procedures Objective: The RA3 may receive cargo or mail from another RA3, a KC3, an AC3 or from an unknown consignor. The RA3 shall have appropriate acceptance procedures for cargo and mail in place in order to establish whether a consignment comes from a secure supply chain or not and subsequently which security measures need to be applied to it. An RA3 may maintain a database giving at least the following information for each regulated agent or known consignor that has been subject to EU aviation security validation in accordance with point 6.8.4.1, from which it directly accepts cargo or mail to be delivered to an ACC3 for carriage into the Union: (a) the company details, including the bona fide business address, (b) the nature of the business, excluding business sensitive information, (c) contact details, including those of the person(s) responsible for security, (d) the company registration number, if applicable, (e) where available, the validation report. Reference: Points 6.8.3.1 and 6.8.4.3. Note: An RA3 may only accept cargo from an AC3 as secure cargo, if this RA3 has designated this consignor itself as AC3 and accounts for the cargo delivered by this consignor. 4.1. When accepting a consignment, does the entity establish whether it comes from another RA3, a KC3, an AC3 or an unknown consignor? YES or NO If YES, how? 4.2. Does the entity establish and maintain a database containing information for each RA3, KC3 and AC3 from which it directly accepts air cargo or air mail to be delivered to an ACC3 for carriage into the Union? YES or NO If YES, specify the information included in the database. If NO, how does the entity know that cargo comes from another RA3, KC3 or AC3? 4.3. Does the entity designate consignors as AC3? YES or NO If YES, describe the procedure and the safeguards required by the entity from the consignor. 4.4. When accepting a consignment, does the entity establish whether its destination is an EU/EEA airport? YES or NO – explain 4.5. If YES – does the entity submit all air cargo or air mail to the same security controls when the destination is an EU/EEA airport? YES or NO If YES, describe the procedure 4.6. When accepting a consignment, does the entity establish whether it is to be regarded as high risk cargo and mail (HRCM) (see definition in part 6), including for consignments that are delivered by other modes of transport than by air? YES or NO If YES, how? Describe the procedure 4.7. When accepting a secured consignment, does the validated entity establish whether it has been protected from unauthorised interference and/or tampering? YES or NO If YES, describe (seals, locks, inspection, etc.) 4.8. Is the person making the delivery required to present an official identification document containing a photo? YES or NO 4.9. Is there a process in place to identify consignments that require screening? YES or NO If YES, how? 4.10. Conclusion: Are the acceptance procedures sufficient to establish that air cargo/air mail to an EU/EEA airport destination comes from a secure supply chain or needs to be subject to screening? YES or NO If NO, specify reasons Comments from the entity Comments from EU aviation security validator PART 5 Screening Objective: Where the RA3 accepts cargo and mail which does not come from a secure supply chain, the RA3 needs to subject these consignments to appropriate screening before it may be delivered to an ACC3 as secure cargo. The RA3 shall have procedures in place to ensure that EU/EEA bound air cargo and air mail for transfer, transit or unloading at an Union airport is screened by the means or methods referred to in Union legislation to a standard sufficient to reasonably ensure that it contains no prohibited articles. Where screening of air cargo or air mail is performed by or on behalf of the appropriate authority in the third country, the RA3 shall declare this fact and specify the way adequate screening is ensured. Note: Although point 6.8.3.2 allows applying ICAO standards as a minimum to implement the provisions of point 6.8.3.1 until 30 June 2014, the EU aviation security validation takes into account the EU screening requirements, even if the validation is performed before 1 July 2014. Reference: Point 6.8.3. 5.1. Is screening applied on behalf of the entity by another entity? YES or NO If YES, Specify the nature of these entities and provide details: — Private screening company — Government regulated company — Government screening facility or body — Other Specify the nature of the agreement/contract between the validated entity and the entity that applies the screening on its behalf. 5.2. What methods of screening are used for air cargo and mail? Specify, including details of equipment used for screening air cargo and air mail (e.g. manufacturer, type, software version, standard, serial number etc.) for all the methods deployed. 5.3. Is the equipment or method (e.g. explosive detection dogs) used included in the most recent EU, ECAC or TSA compliance list? YES or NO If YES, provide details If NO, give details specifying the approval of the equipment and date thereof, as well as any indications that it complies with EU equipment standards. 5.4. Is the equipment used in accordance with the manufacturers’ CONOPS (concept of operations) and is the equipment regularly tested and maintained? YES or NO If YES, describe the process 5.5. Is the nature of the consignment taken into consideration during screening? YES or NO If YES, describe how it is ensured that the screening method selected is employed to a standard sufficient to reasonably ensure that no prohibited articles are concealed in the consignment. 5.6. Is there a process for the resolution of the alarm generated by the screening equipment? (For some equipment (e.g. X-ray equipment), the alarm is triggered by the operator himself). YES or NO If YES, describe the process of resolving alarms to reasonably ensure the absence of prohibited articles. If NO, describe what happens to the consignment 5.7. Are any consignments exempt from security screening? YES or NO 5.8. Are there any exemptions that do not comply with the Union list? YES or NO If YES, detail 5.9. Is access to the screening area controlled to ensure that only authorised and trained staff are granted access? YES or NO If YES, describe 5.10. Is an established quality control and/or testing regime in place? YES or NO If YES, describe 5.11. Conclusion: Is air cargo/air mail screened by one of the means or methods listed in point 6.2.1 of Decision 2010/774/EU to a standard sufficient to reasonably ensure that it contains no prohibited articles? YES or NO If NO, specify reason Comments from the entity Comments from the EU aviation security validator PART 6 High Risk Cargo or Mail (HRCM) Objective: Consignments which originate from or transfer in locations identified as high risk by the Union or which appear to have been significantly tampered with are to be considered as high risk cargo and mail (HRCM). Such consignments have to be screened in line with specific instructions. The RA3 shall have procedures in place to ensure that EU/EEA bound HRCM is identified and subject to appropriate controls as defined in the Union legislation. The ACC3 to which the RA3 delivers air cargo or mail for transportation shall be authorised to inform the RA3 about the latest state of relevant information on high risk origins. The RA3 shall apply the same measures, irrespective of whether it receives high risk cargo and mail from an air carrier or through other modes of transportation. Reference: Point 6.7. Note: HRCM cleared for carriage into the EU/EEA shall be issued the security status ‘SHR’, meaning secure for passenger, all-cargo and all-mail aircraft in accordance with high risk requirements. 6.1. Do staff responsible for performing security controls know which air cargo and mail is to be treated as high risk cargo and mail (HRCM)? YES or NO If YES, describe 6.2. Does the entity have procedures in place for the identification of HRCM? YES or NO If YES, describe 6.3. Is HRCM subject to HRCM screening procedures according to Union legislation? YES or NO If NO, indicate procedures applied 6.4. After screening, does the entity issue a security status declaration for SHR in the documentation accompanying the consignment? YES or NO If YES, describe how security status is issued and in which document 6.5. Conclusion: Is the process put in place by the entity relevant and sufficient to ensure that all HRCM has been properly treated before loading? YES or NO If NO, specify reason Comments from the entity Comments from EU aviation security validator PART 7 Protection of secured air cargo and mail Objective: The RA3 shall have procedures in place to ensure EU/EEA bound air cargo and/or air mail is protected from unauthorised interference and/or any tampering from the point of security screening or other security controls are applied or from the point of acceptance after screening or security controls have been applied, until loading or transferring to an ACC3 or another RA3. If previously secured air cargo and mail is not protected afterwards, it may not be loaded or transferred to an ACC3 or another RA3 as secure cargo or mail. Protection can be provided by different means such as physical (barriers, locked rooms, etc.), human (patrols, trained staff, etc.) and technological (CCTV, intrusion alarm, etc.). EU/EEA bound secured air cargo or mail should be separated from air cargo or mail which is not secured. Reference: Point 6.8.3.1. 7.1. Is protection of secured air cargo and air mail applied on behalf of the validated entity by another entity? YES or NO If YES, Specify the nature of these entities and provide details: — Private screening company — Government regulated company — Government screening facility or body — Other 7.2. Are security controls and protection in place to prevent tampering during the screening process? YES or NO If YES, describe Specify what kind(s) of protection(s) are put in place: — Physical (fence, barrier, building of solid construction, etc.) — Human (patrols etc.) — Technological (CCTV, alarm system, etc.) And explain how they are organised. 7.3. Is the secure air cargo/air mail only accessible to authorised persons? YES or NO If YES, describe Specify how all access points (including doors and windows) to identifiable and secured air cargo/air mail are controlled. 7.4. Are there procedures in place to ensure EU/EEA bound air cargo/air mail to which security controls have been applied are protected from unauthorised interference from the time it has been secured until its loading or is transferred to an ACC3 or another RA3? YES or NO If YES, describe how it is protected (physical, human, technological, etc.) Specify also if the building is of solid construction and what kinds of materials are used, if available. If NO, specify reasons 7.5. Conclusion: Is the protection of consignments sufficiently robust to prevent unlawful interference? YES or NO If NO, specify reason Comments from the entity Comments from EU aviation security validator PART 8 Documentation Objective: The security status of a consignment shall be indicated in the documentation accompanying the consignment, either in the form of an air waybill, equivalent postal documentation or in a separate declaration and either in an electronic format or in writing. The security status shall be issued by the RA3. Reference: Points 6.3.2.6(d) and 6.8.3.4. Note: the following security statuses may be indicated: — ‘SPX’, meaning secure for passenger, all-cargo and all-mail aircraft, or — ‘SCO’, meaning secure for all-cargo and all-mail aircraft only, or — ‘SHR’, meaning secure for passenger, all-cargo and all-mail aircraft in accordance with high risk requirements. 8.1. Does the entity specify in the accompanying documentation (e.g. air waybill) the status of the cargo and how this was achieved? YES or NO If NO, explain 8.2. Conclusion: Is the documentation process sufficient to ensure that cargo or mail is provided with proper accompanying documentation which specifies the correct security status? YES or NO If NO, specify reason Comments from the entity Comments from EU aviation security validator PART 9 Transportation Objective: Air cargo and air mail must be protected from unauthorised interference or tampering from the time it has been secured until its loading or is transferred to an ACC3 or another RA3. This includes protection during transportation to the aircraft, otherwise to the ACC3 or to another RA3. If previously secured air cargo and mail is not protected during transportation, it may not be loaded or transferred to an ACC3 or another RA3 as secure cargo. During transportation to an aircraft, an ACC3 or another RA3, the RA3 is responsible for the protection of the secure consignments. This includes cases where the transportation is undertaken by another entity, such as a freight forwarder, on its behalf. This does not include cases whereby the consignments are transported under the responsibility of an ACC3 or another RA3. Reference: Point 6.8.3. 9.1. How is the air cargo/air mail conveyed to the ACC3/another RA3? (a) Validated entity’s own transport? YES or NO (b) Other RA3’s/ACC3’s transport? YES or NO (c) Contractor used by the validated entity? YES or NO 9.2. Is the air cargo/air mail tamper evidently packed? YES or NO If YES, how 9.3. Is the vehicle sealed or locked before transportation? YES or NO If YES, how 9.4. Where numbered seals are used, is access to the seals controlled and are the numbers recorded? YES or NO If YES, specify how 9.5. If applicable, does the respective haulier sign the haulier declaration? YES or NO 9.6. Has the person transporting the cargo been subject to specific security controls and awareness training before being authorised to transport secured air cargo and/or air mail? YES or NO If YES, please describe what kind of security controls (pre-employment check, background check, etc.) and what kind of training (security awareness training, etc.). 9.7. Conclusion: Are the measures sufficient to protect air cargo/air mail from unauthorised interference during transportation? YES or NO If NO, specify reasons Comments from the entity Comments from EU aviation security validator PART 10 Compliance Objective: After assessing the nine previous parts of this checklist, the EU aviation security validator has to conclude if its on-site verification confirms the implementation of the security controls in compliance with the objectives listed in this checklist for the EU/EEA bound air cargo/air mail. Two different scenarios are possible. The EU aviation security validator concludes that the entity: (a) has succeeded in complying with the objectives referred to in this checklist. The validator shall provide the validated entity with the original of the validation report and state that the entity is designated EU aviation security validated 3rd country regulated agent; (b) has failed in complying with the objectives referred to in this checklist. In that case, the entity is not authorised to deliver secured air cargo or mail for EU/EEA destination to an ACC3 or another RA3. It shall receive a copy of the completed checklist stating the deficiencies. In general, the EU aviation security validator has to decide if cargo and mail handled by the validated entity is treated in such a way that at the moment it is delivered to an ACC3 or another RA3 it may be deemed to be secure to be flown to the EU/EEA in accordance with the applicable Union regulations. The EU aviation security validator has to keep in mind that the assessment is based on an overall objective-based compliance methodology. 10.1. General conclusion: Assessment (and notification) (highlight the one that applies) If it is a ‘PASS’ the entity will be considered designated as a 3rd country EU aviation security validated regulated agent (RA3). Pass/Fail Where the overall assessment is a fail, list below the areas where the entity fails to achieve the required standard of security or has a specific vulnerability. Also, advice on the adjustments needed to achieve the required standard and thus to pass. Comments from EU aviation security validator Comments from the entity Name of the validator: Date: Signature: ANNEX List of persons and entities visited and interviewed Providing the name of the entity, the name of the contact person and the date of the visit or interview. Name of entity Name of contact person Date of visit/interview