Compliance

Security standards, regulatory compliance, and accessibility requirements.

Scope

Security Standards

• PCI-DSS (Payment Card Industry)
• SOC 2 (Service Organization Controls)
• ISO 27001 (Information Security)

Regulatory Compliance

• DOT (US Department of Transportation)
• EU Passenger Rights (EU261)
• Aviation security regulations

Accessibility

• ADA (Americans with Disabilities Act)
• WCAG 2.1 (Web Content Accessibility)
• Section 508

Research Topics

• PCI-DSS scope and requirements
• SOC 2 Type II certification
• DOT consumer protection rules
• EU261 compensation rules
• WCAG 2.1 AA requirements
• Aviation security (TSA/ECAC)
• Accessibility testing tools
• Compliance automation

PCI-DSS Compliance

Scope Reduction Strategies

Full Scope:
└── Process, store, transmit card data

Reduced Scope (SAQ A):
├── Hosted payment pages (iframe)
├── Tokenization
├── No card data in airline systems
└── Redirect to payment provider

Remaining Scope:
├── Redirect page security
├── Token handling
└── Refund initiation

Requirements Summary

Compliance Path

SOC 2 Compliance

Trust Services Criteria

Report Types

• Type I: Controls at a point in time
• Type II: Controls over a period (6-12 months)

Common Controls

Security:
├── Access control
├── Network security
├── Encryption
└── Logging/monitoring

Availability:
├── Disaster recovery
├── Capacity planning
├── Incident management
└── SLAs

Processing Integrity:
├── Input validation
├── Error handling
├── Transaction logging
└── Reconciliation

DOT Consumer Protection

Key Regulations

Tarmac Delay Requirements

• 3-hour limit (domestic), 4 hours (international)
• Food, water, restrooms provided
• Medical emergencies addressed
• Option to deplane if safe

Denied Boarding Compensation

EU261 Compliance

Passenger Rights

Compensation Amounts

Exemptions

• Extraordinary circumstances
• Weather, ATC, security
• Strikes (external)
• Advance notice (>14 days)

Accessibility (WCAG 2.1)

Level AA Requirements

Perceivable:
├── Text alternatives for images
├── Captions for video
├── Sufficient color contrast (4.5:1)
└── Resize text to 200%

Operable:
├── Keyboard accessible
├── Skip navigation links
├── No time limits (or extendable)
└── Clear focus indicators

Understandable:
├── Clear language
├── Consistent navigation
├── Error identification
└── Labels for inputs

Robust:
├── Valid HTML
├── ARIA where needed
└── Compatible with assistive tech

Testing Approach

Priority Areas

1. Booking flow (high traffic)
2. Check-in process
3. Flight status
4. Manage booking
5. Customer service

Aviation Security

TSA Requirements (US)

• Secure Flight passenger data
• Checked baggage screening
• Employee background checks
• Access control systems

ECAC Requirements (EU)

• Passenger screening
• Baggage reconciliation
• Cargo security
• Airport security programs

Compliance Management

Continuous Compliance

Policy
  ↓
Controls
  ↓
Monitoring
  ↓
Evidence Collection
  ↓
Audit Readiness
  ↓
Remediation
  ↓
(repeat)

Tools