Airports: infrastructure to operate in degraded mode

IT Infrastructure · 4 min

When the shared check-in platform fails, the terminal depends on what was prepared beforehand. Learn how to map dependencies, size local capacity and rehearse the transition.

Airports: infrastructure to operate in degraded mode

TL;DR

Many airports use shared passenger processing platforms, creating dependencies on technology vendors.
The September 2025 incident affecting Collins Aerospace's MUSE platform caused check-in disruption, delays and cancellations at several European airports.
Degraded mode requires defined procedures, identified dependencies and operational alternatives that have been validated in advance.
Local standby capacity should be proportional to risk and depend on the systems, data, access and resources that are actually available.
Joint exercises between airports, airlines, ground handlers and vendors help validate contingency plans.

A vendor incident halted check-in at several airports

In aviation, many airports process passengers on common-use platforms. The same desk, kiosk or boarding gate can serve several airlines through software supplied by third parties. On the night of 19 September 2025, a ransomware attack affecting Collins Aerospace's MUSE platform disrupted electronic check-in, baggage processing and boarding operations at airports including Heathrow, Brussels and Berlin. Teams resorted to manual procedures, while passengers faced queues, delays and cancellations. The incident affected passenger processing systems, with no indication that air traffic control systems were compromised. For anyone managing IT at an airport, a ground handling company or an airline, the central question is this: what operational capacity can be maintained when a shared platform becomes unavailable?

The dependency is concentrated in a layer invisible to passengers

The common-use model has clear advantages: it reduces equipment duplication, allows desks to be shared between airlines and simplifies terminal management. On the other hand, it concentrates in a single shared platform functions that might otherwise rely on separate systems. When that platform fails, the impact can hit several operators, workstations, boarding pass printers and passenger-processing equipment at the same time. It is important to distinguish the scope of the incident: the unavailability of a check-in platform does not necessarily mean that airport security systems or air traffic control are affected. Even so, the interruption of an essential administrative function can cause queues, delays and cancellations. It is an example of the risk discussed in the article on SaaS resilience and vendor dependencies.

Degraded mode must be designed, not improvised

Operating in degraded mode means maintaining certain activities at reduced capacity, through procedures that have been defined and validated in advance. From an infrastructure standpoint, it is necessary to identify the components that remain available when the central platform fails, as well as the dependencies that may prevent the use of alternative solutions. Which systems can operate autonomously? Which data and authorisations remain accessible? Which manual procedures are permitted, and how do they fit with the airlines' own processes? An inventory that records the dependencies between applications, network and equipment helps answer these questions before the incident. Network segmentation can help limit the spread of certain security incidents, but it is not a substitute for having operational alternatives. Continuity also depends on the availability of the systems, data, access and procedures needed to deliver the service.

Local capacity should be proportional to risk

The capacity to be maintained locally should be assessed case by case. In some terminals, it may make sense to reserve workstations, independent connectivity and equipment prepared for alternative procedures, provided they are compatible with the airlines' systems and processes. In others, the solution may involve contingency mechanisms agreed with operators, including manual procedures or alternative applications. The choice between local and edge infrastructure or remote services depends on the criticality of the functions, connectivity, security requirements and integration capability. It is equally important to ensure that standby resources receive updates, are monitored and have the necessary data and authentication mechanisms. Contingency infrastructure that has not been tested may prove unusable precisely when it is needed.

Joint exercises reveal what plans hide

A contingency plan only proves its effectiveness when it is tested with the entities responsible for executing it. Periodic exercises should simulate the unavailability of shared platforms and involve, depending on the functions affected, the airport operator, airlines, ground handlers and technology vendors. They make it possible to assess the time needed to activate alternative procedures, identify missing equipment or access, and verify whether information reaches the right teams. The results should feed into runbooks with clear steps and identified owners, as well as the review of contractual agreements and communication mechanisms. In terms of the regulatory framework, the NIS2 Directive and the European information security requirements for aviation, known as Part-IS, may be relevant, depending on the entity, the activities carried out and the applicable regime. The specific obligations should be identified case by case.

Resilience depends on decisions made before the failure

Shared platforms will continue to offer operational advantages at airports used by multiple airlines. However, the efficiency of centralisation should be accompanied by an assessment of dependencies and of the consequences of service unavailability. The question is not how to ensure that all operations continue as normal in the face of any failure, but to determine in advance which ones can be maintained, for how long, with what capacity and through which procedures. The answer depends on the size of the terminal, the systems in use, the agreements between airports, airlines and ground handlers, and the responsibilities of each entity. Mapping dependencies, preparing alternatives proportional to risk and rehearsing the transition with the parties involved can reduce operational impact and improve response capability.