GRCLibrary.ai

Annex

UK AEO-S IT and Cybersecurity Requirements

In the UK Authorized Economic Operator (AEO) programme, HMRC tests applicants against the security and safety criteria (UK HMRC AEO security and safety criteria handbook, section 11.1). That Border Force administers the programme is not confirmed by a held source, and the trade facilitation benefits the programme grants are not recorded in the handbook's section 11. The WCO AEO Compendium (2020) United Kingdom entry lists no benefits and names its programme "AEO (European Union Programme)"; the benefits the Compendium's European Union entry lists under the Union Customs Code are not confirmed for the current UK programme. Confirm both with HMRC before relying on them. Under the AEO-S (Authorized Economic Operator Security and Safety) criteria, the applicant's procedures are to be documented and made available for HMRC during the audit of the AEO criteria (section 11.1), its security and safety risk assessment is to address, among other areas, its computer system, accounting records and documents (section 11.2), and it must be able to produce documentation showing the measures and controls it has put in place (section 11.3). The handbook's section 11 does not name cybersecurity or IT security controls; the IT security measures the held handbook names sit under the record keeping criterion, which section 1.4 lists among the AEO-S criteria: appropriate information technology security measures to protect computer systems from unauthorized intrusion and to secure documentation and data (section 8.1), with detail under back-up, recovery, fallback and archiving (section 8.9), protection of computer systems (section 8.10), access rights procedures (section 8.11) and documentation security (section 8.12). The mapping of each control below to those sections is the organization's own; where no held section names a control, as with multi-factor authentication and encryption, this annex treats it as the organization's own scoping of the criteria, to be confirmed with HMRC. This annex defines the organization's IT and cybersecurity controls relevant to AEO-S compliance and maps them to the corresponding GRC library documents.

Type
Annex
Version
1.0.6
Date
2026-11-07
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Compliance: Logistics Sector
Review frequency
Annual and upon material regulatory or framework change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • AEO programme context
  • IT and cybersecurity controls mapping for AEO-S
  • Organization's AEO self-assessment
  • References
  • Document history

Related documents