The UK aviation industry is operated almost entirely within the private sector. The nature and capability of information technology in use at airports is therefore a commercial and operational matter for individual airport operators, groups and air navigation service providers. Use of legacy operating systems does not in itself result in cyber vulnerabilities, providing appropriate controls are in place. The Department for Transport has an active cyber security programme, working in partnership with the NCSC and closely with the aviation industry to ensure that operators take an appropriate and proportionate approach to managing their cyber security risks and that they are supported with advice on mitigating any identified vulnerabilities.