Airport access control sits under two overlapping layers of authority: the international baseline set by ICAO, and the national enforcement carried out by GACA. For an airport operator in Saudi Arabia, understanding how those two layers relate - and what each actually requires at the access-control level - is the difference between a system that merely restricts doors and one that satisfies an aviation security audit. Our airports industry page covers the broader security picture; this article focuses on the access-control and credentialing requirements specifically.
Key takeaways
- ICAO sets the international baseline through Annex 17; GACA implements and enforces it at Saudi airports.
- Security restricted areas must be established based on a documented risk assessment, with identification systems safeguarding access.
- Anyone gaining unescorted access to a restricted area needs a background check before access is granted, and at recurring intervals afterward.
- Movement of both personnel and vehicles within restricted areas is expected to be supervised, not just gated at entry.
1GACA and ICAO: How the Two Relate
The International Civil Aviation Organization sets global aviation standards through its Annexes; Annex 17 covers security specifically - safeguarding civil aviation against acts of unlawful interference. The General Authority of Civil Aviation is Saudi Arabia's national regulator, responsible for issuing, updating and enforcing regulations that implement those international standards at Saudi airports, and for conducting the checks that verify compliance. In practice, an access control system built for a Saudi airport needs to satisfy GACA's specific regulatory requirements, which in turn are built on the ICAO Annex 17 baseline.
2What Annex 17 Requires for Restricted Areas
Annex 17 requires that security restricted areas be established at airports based on a security risk assessment - not applied uniformly to every zone regardless of actual risk - and that identification systems be in place specifically to safeguard those areas. This means the access control design has to start from a documented risk assessment of the airport's layout, not from a generic template applied to every facility.
3Credentialing and Background-Check Workflows
Chapter 3's quality-control provisions require background checks before a person implements security controls, gains unescorted access to a security restricted area, or accesses sensitive aviation security information - and those checks must recur at intervals set by the appropriate authority. Anyone found unsuitable during a recurring check must lose that access immediately, which means the credentialing system needs to support fast revocation, not just initial issuance. This is a materially different requirement from typical enterprise access control, where credential reviews are often annual rather than continuous.
4Layered Airport Security in Practice
Airport access control operates in visible layers: landside areas open to the public, airside areas requiring a credential, and security restricted areas requiring both a credential and, per Annex 17, a documented background check. Vehicle and personnel movement within restricted areas needs active supervision, not just a badge check at the perimeter - our HID Aero controller platform supports the kind of granular, zone-by-zone credentialing this layered model requires, tied to a single identity record per Annex 17's continuous-verification expectation.
Getting Airport-Grade Access Control
Start with the risk assessment: Annex 17 explicitly requires restricted areas to be based on one, so the access control design should follow from that document, not precede it.
Build for continuous, not one-time, credentialing: a system that only checks background at initial badge issuance does not satisfy the recurring-check requirement. Confirm your platform supports scheduled re-verification and fast revocation.
Supervise movement, not just entry: restricted-area compliance covers ongoing personnel and vehicle movement, so pair access control with active monitoring rather than treating the badge reader as the only control point.
Frequently Asked Questions
ICAO (the International Civil Aviation Organization) sets international standards, including Annex 17 for aviation security. GACA (the General Authority of Civil Aviation) is Saudi Arabia's national regulator, responsible for implementing and enforcing those international standards, including access control and credentialing, at Saudi airports.
Annex 17 requires that security restricted areas be established based on a risk assessment, that identification systems safeguard those areas, and that anyone gaining unescorted access to a restricted area undergo a background check before access is granted and at recurring intervals afterward.
They apply specifically to personnel implementing security controls or requiring unescorted access to security restricted areas or sensitive aviation security information. Movement of both personnel and vehicles within restricted areas is expected to be supervised regardless.
Build Access Control That Meets Aviation Security Standards
Tektronix Technologies designs zone-based access control and credentialing systems for airport operators across Saudi Arabia, built around GACA and ICAO Annex 17 requirements. Explore our airports industry approach, review the HID Aero controller, or talk to a specialist about your facility's compliance requirements.