F1The appropriate authority shall draw up, apply and maintain a national civil aviation security programme.

That programme shall define responsibilities for the implementation of the F2... basic standards referred to in Article 4 and shall describe the measures required by operators and entities for this purpose.

The appropriate authority shall make available in writing on a ‘need to know’ basis the appropriate parts of its national civil aviation security programme to operators and entities which it deems to have a legitimate interest.