This document provides guidance based on EN ISO/IEC 27002:2017 applied to organisations supporting civil aviation, with a focus on air traffic management operations. This includes, but is not limited to, airspace users, airports and air navigation service providers. Not included are activities of the organisations that do not have any impact on the security of civil aviation operations like for example airport retail and service business and corporate real estate management. The basis of all guidance in this document is trust and cooperation between the parties involved in Air Traffic Management.