1. Information Security Governance

MRO-PRO maintains a structured information security management framework aligned with the principles of ISO/IEC 27002:2022.

Our security framework establishes clearly defined responsibilities, documented operating procedures and regular reviews to ensure that security remains an integral part of our business operations.

Key elements include:

• Defined information security roles and management accountability.
• Documented policies and operational security procedures.
• Risk identification, assessment and mitigation.
• Security awareness and personnel responsibilities.
• Supplier security management and contractual safeguards.
• Annual internal security audits and continuous improvement.

Our security framework is reviewed at least annually and whenever significant changes occur to our systems, operations or regulatory obligations.

Standards alignment: Our controls are structured around ISO/IEC 27002:2022. MRO Professional Consulting Ltd does not currently hold formal ISO/IEC 27001 certification.

2. Cloud Infrastructure & Data Protection

MRO-PRO operates within a secure cloud infrastructure hosted by Amazon Web Services (AWS).

Our infrastructure is designed to protect customer information through multiple layers of security, combining network isolation, access restrictions, encryption and continuous monitoring.

Security measures include:

Cloud infrastructure security

Our application infrastructure operates within controlled AWS environments, incorporating network segmentation, managed security services and restricted administrative access.

Data encryption

Sensitive information is protected through encryption at rest and in transit, using established encryption standards and secure key management practices.

Access controls

Access to internal systems and customer information is restricted to authorised personnel according to their responsibilities and legitimate business requirements.

Environment segregation

Development, testing and production environments are logically separated, with controlled access and deployment processes designed to protect operational systems.

Monitoring and threat detection

Infrastructure and application activity is monitored using security logging, automated alerts and threat detection capabilities.

These measures support the confidentiality, integrity and availability of information entrusted to MRO-PRO.

3. Identity & Access Management

MRO-PRO applies strong identity and access management controls across its applications and supporting infrastructure.

Our approach incorporates:

• Individual user identities and authentication credentials.
• Multi-factor authentication for web application access.
• Role-based access permissions.
• Controlled administrative privileges.
• Secure mobile application authentication.
• Monitoring and auditing of system access.
• Defined procedures for granting, reviewing and revoking access.

MRO-PRO customers retain responsibility for managing authorised users within their own organisations, supported by administrative controls available within the platform.

Shared user credentials are prohibited under our contractual security requirements.

4. Secure Software Development

Security is integrated throughout the MRO-PRO software development lifecycle.

Our development processes incorporate established secure coding principles, version control, automated security testing and controlled deployment procedures.

These include:

Secure development practices

Source code is maintained within controlled repositories, with access restricted to authorised development personnel.

Automated security testing

Development pipelines incorporate security checks, including static application security testing, dependency scanning and secrets detection.

Controlled releases

Software changes are subject to review, testing and approval before deployment to production environments.

Vulnerability management

Identified vulnerabilities are assessed, prioritised and addressed through documented remediation and change management processes.

Environment protection

Development and testing activities are segregated from production operations to reduce the risk of unauthorised changes or disruption.

This structured approach supports the continued security and reliability of the MRO-PRO platform as new functionality and enhancements are introduced.

5. Independent Security Testing & Assurance

MRO-PRO maintains a programme of security testing, internal review and continuous improvement.

Our security assurance framework includes:

• Annual penetration testing by independent CREST-accredited security testing providers.
• Automated vulnerability and dependency scanning.
• Review and remediation of identified security findings.
• Annual internal security audits.
• Documented corrective and preventative actions.
• Periodic reviews of security controls and operational procedures.

Security findings are assessed and tracked through established management processes to support effective remediation and ongoing improvement.

Relevant security assurance documentation may be made available to customers upon request, subject to applicable confidentiality requirements.

6. Business Continuity & Data Resilience

MRO-PRO recognises the operational importance of maintaining reliable access to aviation maintenance information.

Our infrastructure and operational procedures incorporate measures designed to support service availability, data protection and recovery following disruptive events.

These include:

Automated backups

Customer information and supporting infrastructure are protected through documented backup and retention arrangements.

Infrastructure resilience

Our cloud architecture incorporates redundancy and availability controls designed to reduce the impact of infrastructure failures.

Disaster recovery

Documented business continuity and disaster recovery procedures establish responsibilities and processes for responding to significant service disruptions.

Monitoring and incident response

Operational monitoring, alerting and incident management procedures support the identification, investigation and resolution of service interruptions.

Backup, recovery and business continuity arrangements are reviewed as part of our information security governance framework.

7. Privacy & Personal Data Protection

MRO Professional Consulting Ltd is committed to processing personal information lawfully, fairly and transparently in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR).

MRO-PRO processes information necessary to support the operational and administrative requirements of its aviation maintenance customers.

Depending on the services used, this may include personal identification details, professional contact information, user account information, operational records and information associated with maintenance activities.

Our approach to personal data protection incorporates:

• Collection and processing for defined business purposes.
• Access restricted to authorised individuals.
• Appropriate technical and organisational security measures.
• Encryption and secure information handling.
• Data retention and deletion procedures.
• Confidentiality obligations for authorised personnel and suppliers.
• Procedures supporting applicable data subject rights.

Where MRO-PRO processes personal information on behalf of its customers, the respective responsibilities of the parties are governed by applicable contractual and data protection arrangements.

Individuals wishing to raise a personal data enquiry may contact:

[email protected]

Requests relating to customer-managed user accounts may require verification or authorisation by the relevant customer organisation.

8. Security Incident Management

MRO-PRO maintains documented procedures for identifying, assessing, reporting and responding to information security incidents.

These procedures establish responsibilities for incident classification, investigation, containment, remediation and subsequent review.

Security incidents and relevant preventative actions are recorded and reviewed to support accountability, regulatory compliance and continuous improvement.

Suspected security incidents or vulnerabilities may be reported to:

[email protected]

9. Our Security Commitment

Information security is an ongoing responsibility.

As technology, operational requirements and cyber threats evolve, MRO-PRO continues to review and improve its security controls, development practices and supporting infrastructure.

Our commitment is to maintain a secure, resilient and professionally managed software platform that supports the operational and compliance requirements of the aviation maintenance industry.