The Aviation Security Regime and the Guarding Contract

Readiness note. This is a private training programme. It builds knowledge and readiness. It does not grant any official certificate, licence, or government recognition, and it does not create any affiliation with a regulator or an agency. On passing, learners receive a Record of Completion.

What this course is not. This is a knowledge course. It is not AVSEC training, not screener training and not an airport pass course. Your airport, your employer and the aviation security authority decide what training you must hold. It is also not security manager training or certification under any aviation security programme.

This module builds on module M4 (Buying and Running the Guarding Contract) and on unit A1 (Why Aviation Security Is Different) of Guard — Air.

Mission briefing

Your agency guards malls, factories and two hospitals. Now an airport operator has asked for a bid: forty guards, twenty-four hours a day, on "non-core security posts". Your sales head is pleased. Your operations head asks three questions. Which posts are we allowed to fill? Who will direct our guards? What happens on the first day of fog, when the airport wants fifteen more guards by noon?

An airport contract looks like any guarding contract. It is not. A regulator stands behind the client, and a security plan that you will never read in full decides what your guards may do.

Focus: before you price or sign, know the regime, your place in it, the limits of your scope, and how you will keep the posts filled on the worst day.

This module is general knowledge. It is not legal advice.

Learning objectives

By the end of this module, you will be able to:

• Describe the international baseline and the layers of national programmes, in outline.
• Compare how India, Australia, the European Union and the United Kingdom place a private agency.
• Say what an agency may be asked to do at an airport, and what it must refuse.
• Write the scope of an airport guarding contract so that it sits inside the regime.
• Plan manpower for 24-hour posts where every guard must be cleared, and plan for surge days.
• Build a continuity plan with the airport operator.

1. The regime in four layers

Aviation security is built in layers of documents. Each layer must fit the one above it.

1. The international baseline. Countries agreed the rules of civil flying in the Chicago Convention. Its Annex 17 deals with security. The International Civil Aviation Organization (ICAO) keeps it. The detailed guidance behind it is restricted, and this course does not use it.
2. The national programme. Each country names an authority and writes a national civil aviation security programme. Many countries also write a national training programme and a national quality control programme. These are not public in full.
3. Operator programmes. Each airport operator and each airline writes its own security programme and gets it approved or accepted by the authority.
4. Entity programmes and procedures. Other companies at the airport, such as cargo agents, caterers and ground handlers, have their own programmes or follow the operator's. Post orders are the last link.

Where are you? A guarding agency sits in layer 4, under an operator in layer 3. You will be given only the parts you need. European law says this in plain words: the authority makes the appropriate parts of the national programme available in writing on a "need to know" basis. Expect the same everywhere.

Three things follow.

• You cannot check the plan against the law yourself. You rely on the operator and the authority for that. What you can do is make sure your own part is written down, complete and current.
• Your procedures must not contradict the operator's programme. If your standard company procedure says one thing and the airport says another, the airport's programme wins on airport posts. Write an airport annex to your procedures.
• Programme extracts are protected information. Keep a list of the named people who hold a copy. Do not copy them into a tender for another client.

2. Four systems compared

The table is an outline, as checked on 8 October 2026. The India and Australia editions give their sources in a country note. The European and British rows are examples for comparison.

What the table teaches. The words differ, but the pattern is the same. A national authority sets the rules. An operator holds an approved programme. A private agency works inside that programme, on tasks the system allows, with staff who are vetted and trained as the system requires. Nowhere does a guarding contract by itself give an agency the right to do an aviation security task.

For any other country, find four things before you bid: the Act, the security rules or regulations, the authority's public pages for industry, and the airport's conditions for contractors. If you cannot find the rule that lets a private agency do the task in the tender, ask the airport operator in writing.

3. What an agency may do, and what it must refuse

Every system keeps some tasks for people with a special status. Unit A1 (Why Aviation Security Is Different) told guards this. As a manager you must know it at contract level.

Tasks that are commonly reserved (the list differs by country):

• Screening of passengers and their bags.
• Operating screening equipment.
• Search of aircraft.
• Carrying weapons.
• Control of entry into restricted areas, and the perimeter, in systems where a government force is responsible for them.
• Stopping, searching, detaining or removing people by legal power.
• Security controls on cargo and on stores for aircraft, in systems where only the company's own trained employees may apply them.

Tasks an agency is commonly given: queue support, watching doors and buildings, landside patrols, pass checks at outer points, guarding parked aircraft or work sites under direction, supporting the control room, and guarding cargo and catering buildings from the outside.

Rules for your bid team:

• Ask for the legal basis of each post. "Which rule or which part of the programme allows a contractor's guard on this post, and what training does it require?"
• Refuse a reserved task even if the client asks. A client under staffing pressure may ask your guards to "help at the machine" or "guard the gate alone tonight". If the system reserves the task, your guard commits the breach, and your agency is responsible for it.
• Refuse tasks outside the scope, in writing. Module M4 (Buying and Running the Guarding Contract) warned about guards on odd jobs. At an airport an odd job can be an offence.
• Do not advertise what you are not. Do not call your guards "aviation security officers" or "screeners" in sales material unless they hold that status in law.

4. Two lines of authority

On a Land site the client directs through the contract. At an airport there are often two lines.

• Operational direction: which checks, how strict, what changes today. In many systems the officer in charge of airport security gives this, not the client's commercial staff.
• Administrative supervision and the contract: numbers, hours, rosters, payment, service levels. The airport operator is responsible for these.

Write both lines into the contract and into the post orders (module AS1, Running an Airport Security Shift, shows supervisors how to use them). Then deal with the conflicts in advance.

• A direction that costs money. The officer in charge orders three more posts for a week. Who pays? Agree a mechanism: a written direction, a named person at the operator who confirms it, an agreed rate.
• A direction that clashes with the contract. Write in the contract that a lawful security direction from the authority or the officer in charge comes first, and that following it is not a breach of contract.
• A direction that seems unlawful or unsafe. Your supervisor raises it at once with the duty officer and with you. You raise it in writing with the operator. Guards do not carry out an unlawful or unsafe order (module S1, Leading a Shift).
• Records. Every direction that changes posts, numbers or checks is logged with time, name and wording.

5. Writing the scope

Module M4 (Buying and Running the Guarding Contract) listed what a scope of work covers. For an airport, add these.

Airport scope checklist (your own form):

1. Posts and legal basis. Each post, its hours, and the rule or programme part that allows a contractor's guard there.
2. Excluded tasks. A plain list of what your guards will not do.
3. Direction. Who directs security work on each post, and who confirms changes that cost money.
4. Programme extracts. Which parts you will be given, who holds them, how they are protected and returned.
5. Clearance and vetting. What the agency and each guard must hold before day one, who applies, and who pays (module AM2, Clearances, Programmes and Training Records).
6. Training before deployment. Which required training, where it is given, how long it takes, who pays for the days.
7. Passes. Who applies, how long it takes, the rules on return, and the charge for a lost pass (module AM2, Clearances, Programmes and Training Records).
8. Minimum cleared strength. The number of cleared guards you must keep, including reserve (section 6).
9. Surge. Triggers, numbers, notice time and rates (section 7).
10. Quality control. Your internal checks, the operator's audits and the authority's inspections, and how findings are closed (module AM3, Quality Control and the Insider-Threat Programme).
11. Reporting. What is reported to whom, and how fast. Which reports the operator makes to the authority and which you must make yourself.
12. Confidentiality. Security information, photographs, social media, and what happens to records at the end.
13. Sub-contracting. Normally none without written approval, because clearance attaches to a named company.
14. Continuity and exit. Section 8.

Penalties. Be careful with service-level penalties that punish honesty. A penalty for "each reported breach" teaches supervisors to stop reporting. Penalise an unfilled post or a false record. Do not penalise a true report.

6. Manpower when every guard must be cleared

Module M3 (Manpower, Rosters and the Cost of a Post) showed that a post is hours, not a person, and that a 24-hour post needs several guards once leave, rest days and training are counted. At an airport there is one more limit: you cannot send a reliever from another site. A guard without the clearance, the required training and the pass cannot stand on the post, however good the guard is.

So plan a cleared pool.

• Lead time. Add up the time for vetting, required training and the pass. Ask the operator for real figures from other contractors. Recruit that far ahead.
• Reserve. Keep more cleared guards than the roster needs. Size the reserve from your own leave, sickness and turnover figures, and from the lead time. A long lead time needs a bigger reserve.
• Turnover is the main risk. Each guard who leaves needs a replacement, and the replacement needs weeks of lead time. Pay, shift patterns, transport at night and decent rest places keep cleared guards (module M3, Manpower, Rosters and the Cost of a Post). Price them into the bid.
• Expiry dates. Passes and training run out. Keep one register for the contract and review it every week (module AM2, Clearances, Programmes and Training Records).
• Hours. Do not fill a shortage with double shifts for long. Tired guards miss checks (module S4, Rosters, Fatigue and Welfare). Report a shortage to the operator early, with numbers.
• Supervisors. They need the same clearances, and often more training. Plan their reserve too.

If the bid price cannot pay for the reserve, the price is too low (module M3, Manpower, Rosters and the Cost of a Post).

7. Surge on disruption days

Airports have days when everything changes at once: fog, storms, diverted flights, a strike by another company, a festival peak, a higher alert state, a large public event.

A surge plan answers six questions:

1. Triggers. What event, declared by whom, starts the plan?
2. Numbers. How many extra cleared guards, on which posts?
3. Notice. How fast must they arrive? Be honest. Agree a figure you can meet at 03:00.
4. Call-out. A current list of cleared off-duty guards, with phone numbers, kept by the duty manager. Who calls, and in what order?
5. Limits. Maximum hours for each guard, rest before the next shift, transport and food.
6. Authority and cost. Who at the operator may ask for surge, and at what rate?

Surge guards are still cleared guards. A surge is not a reason to post a person without the pass or the training. If the plan cannot give the numbers, say so to the operator at once. The officer in charge may then change the posts. That is their decision to make, and an honest answer lets them make it.

Test the call-out list twice a year. Phone every number.

8. Continuity planning with the airport operator

Module M11 (Site Emergency and Crisis Planning) covered emergency and crisis planning for a site. Here the question is narrower: what could stop your agency from filling its airport posts, and what happens then?

Agree the minimum posts. Ask the operator which of your posts must be filled in all cases and which may be dropped or handed back for a time. Only the operator and the officer in charge can decide this. Write it down.

Exercise it. Take part in the airport's exercises. Once a year, run a desk exercise of your own: "At 05:00, eleven of the forty guards on the morning shift do not arrive. What do we do in the first hour?"

Tell early. The worst continuity failure is silence. An operator can deal with a gap that it hears about at 04:00. It cannot deal with one that it finds at 06:00.

What you do / What you never do

Worked example

The people, aircraft and places in this example are invented.

Northgate Security is asked to bid for forty posts at Lakeside Airport. Operations head Ms Sen reads the tender with the checklist in section 5.

Post 17 is described as "assist at staff screening point, including operating the walk-through detector when airport staff are on break". Ms Sen writes to the operator: "Please confirm the legal basis for a contractor's guard to operate screening equipment, and the training required. Without it we will price Post 17 as queue support only, and list equipment operation as an excluded task." The operator replies that equipment is operated only by its own certified screeners. The post is rewritten.

The operator tells her that vetting, required training and the pass take about ten weeks together. With her own turnover figures, Ms Sen sizes a reserve of cleared guards and prices it. Her bid is not the cheapest.

She adds a surge clause: the airport duty manager may call for up to ten extra cleared guards, with four hours' notice, at an agreed rate. She adds one line on penalties: none for a reported breach, a penalty for an unfilled post or a false record.

Northgate loses the first round on price. Three months later the cheapest bidder cannot fill its night posts, and the operator comes back.

Activity — read the tender

Use a real or imagined airport tender.

1. For three posts in the tender, write the question you would send the operator about the legal basis and the required training.
2. Write your list of excluded tasks for your country.
3. The lead time for a cleared guard is ten weeks. Your turnover is two guards a month on a forty-guard contract. How does that change the reserve you would keep, compared with a lead time of two weeks? Explain in words.
4. Write the six answers of a surge plan for a day of fog.
5. List the three events most likely to stop your agency from filling its posts. For each, write what the operator should hear from you, and when.

There is no single right answer. Check that no post depends on a reserved task, that both lines of authority are written down, and that the operator would hear about a gap before it opens.

Key points

• The regime has layers: international baseline, national programmes, operator programmes, entity procedures. An agency sits at the bottom and sees only its own part.
• India, Australia, the European Union and the United Kingdom use different words for the same pattern: authority, approved programme, vetted and trained people.
• Some tasks are reserved by law. Ask for the legal basis of every post, and refuse reserved tasks in writing.
• Write both lines of authority into the contract: operational direction and administrative supervision.
• The scope names excluded tasks, clearances, training, passes, minimum cleared strength, surge, quality control, reporting and exit.
• You cannot send a reliever from another site. Keep and price a cleared reserve.
• A surge plan states triggers, numbers, notice, call-out, limits and cost. Surge guards are still cleared guards.
• Plan continuity with the operator: minimum posts, renewal calendar, exit. Tell early.

Where to go next

• Module M4 (Buying and Running the Guarding Contract): the base for this module. Module M3 (Manpower, Rosters and the Cost of a Post) and module M11 (Site Emergency and Crisis Planning) are used here.
• Unit A1 (Why Aviation Security Is Different): what guards are told about the regime.
• Module AS1 (Running an Airport Security Shift): how supervisors use the two lines of authority.
• Module AM2 (Clearances, Programmes and Training Records): the paperwork behind a cleared guard.

Conclusion

You have completed this module. You can now describe the regime in outline, compare four systems, keep your scope inside the law, write an airport contract with two lines of authority, and plan the cleared strength, surge and continuity that an airport needs.

The next module is AM2 (Clearances, Programmes and Training Records).

Complete the Learning Check for this module before you move on.