One dashboard for the whole DO-326A process. Answer the questions at each stage and the builder compiles everything in the background: assets, interfaces, threats, scenarios, scores and measures, all cross-referenced. When you are ready, export submission-ready artefacts in Word.
Why it exists
In over a decade of cyber airworthiness work we have watched the same thing happen on programme after programme. A DO-326A requirement lands, the artefacts have to be produced, and there are not enough suitably qualified and experienced people in the industry to produce them.
There are only two ways to speed that up - grow the pool of qualified people, or give the people you already have better tools. We teach the first. The Artefact Builder is the second.
The status quo costs companies a lot more than engineer salaries and consultant fees. Every month an artefact set sits unfinished is a month of delay on the certification, and on everything that depends on it.
The Artefact Builder cuts that time right down. A preliminary risk assessment, an initial PSecAC, or the full 14 artefacts: it holds your hand at every stage and gives you export-ready documents in days.
Months of work, down to hours. Yes, really.
Quality, not just speed
Saving time and money is the easy part. What matters is whether the artefact stands up in front of the certification authority.
Every artefact follows the structure and intent of DO-326A and DO-356A, so the authority sees what it expects to see, in the order it expects to see it.
The output is assessed by our technical director, Dan Locke, drawing on 10+ years of cyber airworthiness work with the MoD, the MAA and industry.
Our aim is simple: the Coratools Artefact Builder should produce the best DO-326A artefacts in UK defence and beyond.
Who it's for
If your programme has to produce any of the 14 artefacts, at aircraft level or system level, the builder is for you. Design organisations certifying an aircraft or a modification, system suppliers delivering into one, certification teams running several programmes at once, and anyone who has just been handed a DO-326A requirement and wants to know where to start.
Whichever regulator you answer to, the route is the same. Each of these points to DO-326A and DO-356A as the means of compliance.
Similar requirements apply in CS-E, CS-ETSO and CS-P.
Packages
Every package is available at aircraft level or system level. All 14 covers both.
Upgrading is simple. Move to a bigger package whenever you like and pay the difference. Everything you have built carries over.
Set-up and onboarding up front, then an annual fee. Per platform type, whole fleet.
How you get it
Already a customer? Open the user portal →
Like the Lite version and want a closer look? Get in touch and we will open up other parts of the builder for you to try on your own project.
Pick a package. One of our cyber engineers installs the builder at your site and onboards your team.
Questions
A document the certification authority expects to see as evidence that you have followed DO-326A. There are 14 across aircraft and system level. The builder produces each one as a Word document from your answers.
No. It never proposes a security measure. It suggests threat sources, conditions and scenarios from what you have told it, scores them against DO-356A, and shows you where measures are needed. The measures are yours.
No. There is no inference in the builder. It makes suggestions, and you are free to use them or enter your own. It is not a substitute for professional oversight. It is a (very good) guide.
This is decided case by case, depending on your organisation's requirements. We appreciate that some of the information needed to produce DO-326A artefacts can be extremely sensitive, so we fit the installation to your requirements to ensure the security and privacy of your data. Depending on the package, it also includes an engineer's time to onboard your team and to answer questions about your platform or project.
All information entered into the tool, and everything it generates, stays locally on your device at all times, to ensure the privacy and security of your organisation's data.
Upgrades and maintenance are all included in the annual fee. Our cyber experts work day in, day out with DO-326A and DO-356A, so they are among the first to know about a pending change to either standard, and the builder is updated to match. The annual fee also covers reopening any artefact when your design changes.
Absolutely. Under continuing airworthiness every risk has to be reassessed. With the builder you load your file, re-run the risk assessment and see how the modification affects your risk position. It is one of the biggest reasons to have the tool.
Yes. Move to a bigger package whenever you like and pay the difference. Your existing artefacts carry straight over.
See it on your project
Thirty minutes, your platform, your questions.