From the Act of Securitization to Organizational Capability: a Strategic Framework and Maturity Model Proposal for Cyber Risk Management in Aerospace Supply Chains (C-SCRM)
DOI:
https://doi.org/10.5902/2357797595382Keywords:
Securitization, Aerospace power, Cyber Supply Chain Risk Management, Maturity model, NISTAbstract
This article examines cybersecurity risk management in aerospace supply chains from a securitization perspective, arguing that digitalization has transformed the industrial base into critical infrastructure for national sovereignty. Drawing on the integration of Securitization Theory and Aerospace Power Theory, the Securitization and Aerospace Power Framework for Cyber Supply Chain Risk Management (SAPF-CSCRM) is proposed, grounded in the National Institute of Standards and Technology (NIST, 2022) framework and the Cybersecurity Capability Maturity Model (C2M2) by the Department of Energy (DOE, 2022). Within this architecture, the Aerospace Cyber Supply Chain Risk Management Maturity Model (AMM-CSCRM) functions as a maturity governance mechanism, articulating risk typologies, normative controls, and organizational capability levels. Empirical validation through the Jet Propulsion Laboratory (NASA/JPL) case study demonstrates that the absence of basic asset management controls undermines organizational maturity and nullifies investments in advanced security. The study concludes that digital sovereignty depends on structured governance and verifiable maturity in C-SCRM.
Downloads
References
AEROSPACE INDUSTRIES ASSOCIATION. Supply chain cybersecurity recommendations report. [S.l.]: Aerospace Industries Association, 2023. Disponível em: https://www.aia-aerospace.org/wp-content/uploads/Supply-Chain-Cybersecurity-Recommendations-Report.pdf. Acesso em: 24 jan. 2026.
AEROSPACE SUPPLY CHAIN RESILIENCY TASK FORCE. Aerospace supply chain resiliency task force report to Congress. [S.l.]: Federal Aviation Administration, 2024. Disponível em: https://gama.aero/wp-content/uploads/Aerospace-Supply-Chain-Resiliency-Task-Force-Report-FINAL.pdf. Acesso em: 24 jan. 2026.
BALZACQ, Thierry. Securitization Theory: How Security Problems Emerge and Dissolve. London & New York: Routledge, 2011.
BAMBER, Penny; GEREFFI, Gary. Costa Rica in the Aerospace Global Value Chain: opportunities for entry & upgrading. Durham: Duke University, Center on Globalization, Governance and Competitiveness, 2013. Disponível em: https://www.researchgate.net/publication/265333072_Costa_Rica_in_the_Aerospace_Global_Value_Chain_Opportunities_for_Upgrading. Acesso em: 1 jan. 2024.
BOYSON, Sandor. Cyber supply chain risk management: revolutionizing the strategic control of critical IT systems. Technovation, [S.l.], v. 34, n. 7, p. 342-353, jul. 2014. DOI: http://dx.doi.org/10.1016/j.technovation.2014.02.001. Disponível em: https://www.sciencedirect.com/science/article/abs/pii/S0166497214000194. Acesso em: 13 jan. 2026.
BRASIL. Comando da Aeronáutica. Concepção Estratégica: Força Aérea 100. Brasília, DF: Centro de Comunicação Social da Aeronáutica, 2018. Disponível em: https://www.fab.mil.br/Download/arquivos/FA100.pdf. Acesso em: 13 jan. 2026.
BRASIL. Decreto nº 10.222, de 5 de fevereiro de 2020. Aprova a Estratégia Nacional de Segurança Cibernética. Diário Oficial da União: seção 1, Brasília, DF, 6 fev. 2020. Disponível em: https://www.in.gov.br/en/web/dou/-/decreto-n-10.222-de-5-de-fevereiro-de-2020-241828419. Acesso em: 13 jan. 2026.
BRASIL. Decreto nº 12.573, de 4 de agosto de 2025. Institui a Estratégia Nacional de Cibersegurança. Diário Oficial da União: seção 1, Brasília, DF, ed. 146, p. 2, 5 ago. 2025. Disponível em: https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/decreto/d12573.htm. Acesso em: 15 maio 2026.
BRASIL. Ministério da Defesa. Portaria GM-MD n° 5.081, de 16 de outubro de 2023. Aprova a Doutrina Militar de Defesa Cibernética. Diário Oficial da União: seção 1, Brasília, DF, 25 out. 2023. Disponível em: https://www.gov.br/defesa/pt-br/assuntos/estado-maior-conjunto-das-forcas-armadas/doutrina-militar/publicacoes-1/publicacoes/MD31M07DoutrinaMilitardeDefesaCiberntica2Edio2023.pdf. Acesso em: 15 maio 2026.
BUZAN, Barry; HANSEN, Lene. The Evolution of International Security Studies. Cambridge: Cambridge University Press, 2009.
BUZAN, Barry; WÆVER, Ole. Regions and Powers: The Structure of International Security. Cambridge: Cambridge University Press, 2003.
BUZAN, Barry; WÆVER, Ole; WILDE, Jaap de. Security: A New Framework for Analysis. Boulder, CO: Lynne Rienner, 1998.
CHEUNG, Kam-Fung; BELL, Michael G. H.; BHATTACHARJYA, Jyotirmoyee. Cybersecurity in logistics and supply chain management: an overview and future research directions. Transportation Research Part E: Logistics and Transportation Review, [S.l.], v. 146, p. 102217, fev. 2021. Acesso em: 15 maio 2026.
CHUN, Clayton K. S. Aerospace Power in the Twenty-First Century: a basic primer. Colorado Springs: United States Air Force Academy; Maxwell Air Force Base: Air University Press, 2001.
CORRÊA, Henrique Luiz. Administração de cadeias de suprimentos e logística: integração na era da indústria 4.0. 2. ed. São Paulo: Atlas, 2019.
DOUHET, Giulio. The command of the air. Tradução de Dino Ferrari. Maxwell AFB: Air University Press, Curtis E. LeMay Center for Doctrine Development and Education, 2019.
GERRING, John. Case study research: principles and practices. Cambridge: Cambridge University Press, 2007.
GHADGE, Abhijeet et al. Managing cyber risk in supply chains: a review and research agenda. [S.l.: s.n.], 2020. Disponível em: https://www.researchgate.net/publication/334736415_Managing_cyber_risk_in_supply_chains_A_review_and_research_agenda. Acesso em: 13 jan. 2026.
GRAY, Colin S. Airpower for strategic effect. Maxwell Air Force Base: Air University Press, Air Force Research Institute, 2012.
HANSEN, Lene; NISSENBAUM, Helen. Digital Disaster, Cyber Security, and the Copenhagen School. International Studies Quarterly, [S.l.], v. 53, n. 4, p. 1155-1175, 2009. Disponível em: https://nissenbaum.tech.cornell.edu/papers/Digital%20Disaster.pdf. Acesso em: 15 maio 2026.
HEVNER, Alan R. et al. Design Science in Information Systems Research. MIS Quarterly, [S.l.], v. 28, n. 1, p. 75-106, 1 mar. 2004. Disponível em: https://www.researchgate.net/publication/201168946_Design_Science_in_Information_Systems_Research. Acesso em: 15 maio 2026.
KHALIFA, M.; ALBADAWY, M. Using artificial intelligence in academic writing and research: an essential productivity tool. Computer Methods and Programs in Biomedicine Update, [S.l.], v. 5, p. 100145, 5 mar. 2024. Disponível em: https://www.researchgate.net/publication/378752005_Using_Artificial_Intelligence_in_Academic_Writing_and_Research_An_Essential_Productivity_Tool. Acesso em: 15 maio 2026.
MACCARTHY, Bart L.; IVANOV, Dmitry. The Digital Supply Chain: emergence, concepts, definitions, and technologies. In: MACCARTHY, Bart L.; IVANOV, Dmitry (ed.). The Digital Supply Chain. Amsterdam: Elsevier, 2022. Cap. 1. p. 22-44.
MILLER, Randall. Why supply chain management is important in aerospace and defense. [S.l.]: EY, 2020. Disponível em: https://www.ey.com/en_au/aerospace-defense/why-supply-chain-management-is-important-in-aerospace-and-defense. Acesso em: 13 jan. 2026.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY. Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations: NIST SP 800-161r1. Gaithersburg, MD: U.S. Department of Commerce, 2022. Disponível em: https://doi.org/10.6028/NIST.SP.800-161r1-upd1. Acesso em: 8 abr. 2025.
NISSENBAUM, Helen. Where Computer Security Meets National Security. Ethics and Information Technology, [S.l.], v. 7, n. 2, p. 61-73, 2005.
PAULUS, Alexandra. An Achilles heel of today's armed forces: managing software supply chain risk in the military sector. Berlin: Stiftung Wissenschaft und Politik, 2025. Disponível em: https://www.swp-berlin.org/publications/products/research_papers/2025RP06_SoftwareSupplyChainRisk_Military.pdf. Acesso em: 24 jan. 2026.
PEFFERS, Ken et al. A Design Science Research Methodology for Information Systems Research. Journal of Management Information Systems, [S.l.], v. 24, n. 3, p. 45-77, dez. 2007. Disponível em: https://www.researchgate.net/publication/284503626_A_design_science_research_methodology_for_information_systems_research. Acesso em: 15 maio 2026.
PINTO, Danielle Jacon Ayres; GRASSI, Jessica Maria. Guerra cibernética, ameaças às infraestruturas críticas e a defesa cibernética do Brasil. Revista Brasileira de Estudos de Defesa, Niterói, v. 7, n. 2, p. 103-131, jul./dez. 2020. Disponível em: https://rbed.abedef.org/rbed/article/view/75178. Acesso em: 15 maio 2026.
ROSA, Carlos Eduardo Valle. Poder Aéreo: guia de estudos. Rio de Janeiro: Luzes, 2014.
UNITED STATES. Department of Energy. Cybersecurity Capability Maturity Model (C2M2). Version 2.1. Washington, DC: Department of Energy, 2022. Disponível em: https://www.energy.gov/ceser/cybersecurity-capability-maturity-model-c2m2. Acesso em: 8 abr. 2025.
UNITED STATES. Executive Office of the President. Office of the National Cyber Director; National Space Council. Space system cybersecurity: space industry perspectives. Washington, DC: The White House, 2025. Disponível em: https://bidenwhitehouse.archives.gov/wp-content/uploads/2025/01/Space-System-Cybersecurity-Industry-Perspectives-Report.pdf. Acesso em: 24 jan. 2026.
UNITED STATES. National Aeronautics and Space Administration. Office of Inspector General. NASA's Jet Propulsion Laboratory (JPL): IG-19-022. [S.l.], 2019. Disponível em: https://oig.nasa.gov/wp-content/uploads/2024/02/IG-19-022.pdf. Acesso em: 8 abr. 2025.
YIN, Robert K. Estudo de caso: planejamento e métodos. Tradução de Daniel Grassi. 2. ed. Porto Alegre: Bookman, 2001.
Downloads
Published
Issue
Section
License
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
