Part-IS, in plain terms.

02

When does Part-IS apply?

Regulation (EU) 2023/203 — Part-IS.I.OR — has applied since 22 February 2026 (1 January 2026 for the EGNOS air navigation service provider). Regulation (EU) 2025/2293, which amended it for declared organisations, and the amended AMC and GM of ED Decisions 2025/013/R to 2025/015/R apply from the same date. Delegated Regulation (EU) 2022/1645 — Part-IS.D.OR — has applied since 16 October 2025.

• EASA's oversight guidelines (G-03) expect an organisation to have its ISMS at the “Present” and “Suitable” level by the applicability date, to have done a compliance monitoring activity by then, and to start operating the ISMS immediately after.
• An organisation that has made nothing available to its competent authority by the applicability date should, according to G-03, expect a Level 2 finding.

03

Which organisations does Part-IS.I.OR apply to?

The organisations listed in Article 2(1) of Regulation (EU) 2023/203, each with its own exclusions: Part-145 maintenance organisations and CAMOs; air operators under Part-ORO; approved training organisations; aircrew aero-medical centres; FSTD operators; ATCO training organisations and ATCO aero-medical centres; ATM/ANS providers; U-space service providers and single common information service providers; and approved organisations involved in the design or production of ATM/ANS systems and constituents. The exclusions take out the organisations whose activity is limited to the least complex aircraft or services.

• Declaring an activity instead of holding an approval does not take an organisation out of scope: an operator that declares its activity under Part-ORO is an air operator under point (c) unless an exclusion applies. Declared training organisations and Part-ML or combined airworthiness organisations are not on the list (EASA FAQ).
• Delegated Regulation (EU) 2022/1645 (Part-IS.D.OR) covers design and production organisations under Part 21, aerodrome operators and apron management service providers.

04

What does IS.I.OR.200 require?

An information security management system which ensures that the organisation does the thirteen things of IS.I.OR.200(a); a continuous improvement process (200(b)); documentation of its key processes, procedures, roles and responsibilities, with a process for amending it (200(c)); and proportionality — the processes “shall correspond to the nature and complexity of its activities, based on an assessment of the information security risks inherent to those activities, and may be integrated within other existing management systems” (200(d)).

05

How must information security risks be assessed?

IS.I.OR.205 asks for three steps. Identify all the elements that could be exposed — the activities, facilities and resources, the services the organisation operates, provides, receives or maintains, and the equipment, systems, data and information behind them (205(a)). Identify the interfaces with other organisations “which could result in the mutual exposure to information security risks” (205(b)). Then identify the risks to those elements and interfaces that may have a potential impact on aviation safety, give each a level from a predefined classification that takes into account “the potential of occurrence of the threat scenario and the severity of its safety consequences”, and associate each risk and its level with its element or interface (205(c)).

• The table is Figure 1 of GM1 IS.I.OR.205(c), “an example of a risk acceptance matrix for comparison purposes”. Intermediate categories are allowed, and an existing SMS matrix may be used as long as it fits the purpose (EASA FAQ).
• Conditional acceptance should take into account how long the risk is expected to exist, or commit to future treatment within a defined time, and requires a comprehensive risk management structure; the accountable manager or delegated person(s) review the risks proposed as conditionally acceptable.
• The assessment is reviewed when the elements change, when the interfaces or the risks communicated by other organisations change, when the information or knowledge used to classify risks changes, and when there are lessons learnt from incidents (205(d)).
• EASA's proportionality guidelines (G-04) score likelihood on three factors — the window of opportunity, the means and knowledge to prepare the attack, and the means and capability to perform it — each from 1 to 3: a total of 3–4 is Low, 5–6 Medium, 7–9 High.
• ATM/ANS providers subject to Subpart C of Part-ATM/ANS.OR replace the analysis of the impact on aviation safety with an analysis of the impact on their services, as per their safety support assessment (205(e)).

06

What must happen to an unacceptable risk?

Under IS.I.OR.210(a), the organisation develops measures to address it, implements them “in a timely manner” and checks their continued effectiveness. The measures must enable it to control the circumstances that contribute to the threat scenario, to reduce the consequences on aviation safety, or to avoid the risk — and they “shall not introduce any new potential unacceptable risks to aviation safety”. Under 210(b), the accountable manager, the person or group of IS.I.OR.240(b) and other affected personnel are informed of the outcome of the assessment, the threat scenarios and the measures, and interfacing organisations are informed of any risk shared with them.

07

What must the internal reporting scheme do?

Collect and evaluate information security events, including those to be reported externally (IS.I.OR.215(a)), and — with the detection and response process — let the organisation identify which reported events are incidents or vulnerabilities with a potential impact on aviation safety, identify their causes and contributing factors and address them in risk management, evaluate all known relevant information, and distribute the information internally as necessary (215(b)). Contracted organisations that may expose the organisation to such risks must be required to report events to it (215(c)); the organisation cooperates on investigations with any organisation that has a significant contribution to its information security (215(d)); and the scheme may be integrated with other reporting schemes (215(e)).

08

What do detection, response and recovery mean under IS.I.OR.220?

Detection measures, based on the risk assessment and treatment, that identify deviations from predetermined functional performance baselines and trigger warnings (220(a)); response measures that activate predefined resources and courses of action, contain the spread of an attack and control the failure mode of the affected elements (220(b)); and recovery measures, including emergency measures if needed, that remove the condition that caused the incident or constrain it to a tolerable level, and reach a safe state of the affected elements “within a recovery time previously defined by the organisation” (220(c)).

09

What must be reported to the competent authority, and when?

Any information security incident or vulnerability “which may represent a significant risk to aviation safety” (IS.I.OR.230(b)), in three stages: a notification “as soon as the condition has been known to the organisation”; a report “as soon as possible, but not exceeding 72 hours from the time the condition has been known to the organisation, unless exceptional circumstances prevent this”, in the form defined by the competent authority; and a follow-up report on the actions taken or intended to recover and to prevent similar incidents, “as soon as those actions have been identified” (230(c)(1)–(3)).

• AMC1 IS.I.OR.230(a)&(b) names three triggers: (a) any occurrence covered by Regulation (EU) No 376/2014 that originated from intentional unauthorised electronic interactions; (b) information security incidents having a potential significant risk to aviation safety not covered by 376/2014; (c) vulnerabilities that pose a significant risk to aviation safety and are not yet adequately mitigated.
• Significant risk to aviation safety means an unsafe condition — one that can result in an accident or a serious incident (GM1 IS.I.OR.230(a)&(b)). Where several systems are involved, consider their combined effects: assumptions of independence that hold for fortuitous failures may not hold for deliberate acts.
• The recipients: the competent authority; also the design approval holder when an aircraft or an associated system or component is affected (230(b)(1)); and the organisation responsible for the design of an affected system or constituent (230(b)(2)).
• With several approvals, report to the authority of the approved part where the incident occurred or the vulnerability was found — to all of them if several are affected. An organisation holding an approval but operating outside the EU reports to EASA (GM1 IS.I.OR.230).
• Within the 72 hours, urgency follows the safety impact; where there is an immediate and particularly significant hazard the competent authority expects to be advised immediately and by the fastest possible means (AMC1 IS.I.OR.230(c)).

10

How does Part-IS reporting relate to Regulation (EU) No 376/2014?

They are complementary, and neither exempts from the other. IS.I.OR.230(a) requires an information security reporting system that complies with Regulation (EU) No 376/2014 where that regulation applies. GM1 IS.I.OR.230(a)&(b) adds that the two sets of obligations “should not give rise to two parallel reporting systems”: they may be discharged through one reporting channel, and a person with more than one reporting role may discharge them all through a single report. When the analysis of an occurrence reported under 376/2014 later finds that its root cause or a contributing factor was an intentional unauthorised electronic interaction, the organisation should update its notification.

• EASA says the report should be compatible with ECCAIRS 2, the European reporting system that organisations reach through their authority's portal or by uploading an E5X file (EASA FAQ). Some authorities already take information security reports there — Sweden's, for example, through the occurrence category ISEC, “information security related”.
• Where 376/2014 applies, its Article 13(4) analysis deadlines — preliminary results within 30 days, final results in principle within three months — run alongside the Part-IS follow-up. The 30-day follow-up some summaries attribute to Part-IS comes from there, not from IS.I.OR.230.

11

What must we do with findings and measures from the competent authority?

For a finding, IS.I.OR.225: identify the root cause or causes of, and contributing factors to, the non-compliance; define a corrective action plan; and demonstrate the correction of the non-compliance to the satisfaction of the competent authority — all within the period agreed with it. How the response depends on the category of the finding is set by the domain regulation (AMC1 IS.I.OR.225). Separately, IS.I.OR.200(a)(6) requires the organisation to implement the measures the competent authority notifies “as an immediate reaction to an information security incident or vulnerability with an impact on aviation safety”.

12

Can we contract out information security management?

Yes, under IS.I.OR.235. The contracted activities must comply with Part-IS, the contracted organisation works under your oversight, the risks of the contracted activities are appropriately managed, and the competent authority can have access, on request, to the contracted organisation. GM1 IS.I.OR.235 distinguishes information security management activities, which 235 governs because they can have a major impact on the organisation, from activities contracted for operational needs, whose information security risks are managed through IS.I.OR.205 and 210.

13

Who has to be appointed, and what must personnel do?

The accountable manager designated under the domain regulation must have corporate authority to ensure that all activities required by Part-IS can be financed and carried out; must ensure the resources, establish and promote the information security policy, and “demonstrate a basic understanding of this Regulation” (IS.I.OR.240(a)). The accountable manager appoints a person or group of persons to ensure compliance, reporting directly to them, with deputies defined in the procedures (240(b)), and a person or group to manage compliance monitoring (240(c)); where structures are shared, activities may be delegated to a common responsible person (240(d)). The organisation needs processes for sufficient personnel on duty (240(f)), for their competence (240(g)) and for their acknowledgement of the responsibilities of their roles (240(h)), and must appropriately establish the identity and trustworthiness of personnel with access to the information systems and data in scope (240(i)).

14

Which records must be kept, and for how long?

IS.I.OR.245 lists the records and their minimum retention, and requires them to be stored so that they are protected from damage, alteration and theft, identified by security classification where required, with means that ensure integrity, authenticity and authorised access (245(d)).

15

What must the ISMM contain, and who approves it?

IS.I.OR.250(a) lists ten contents: (1) a statement signed by the accountable manager — countersigned by the CEO if the accountable manager is not the CEO; (2) the persons of 240(b) and (c) with their duties, accountabilities, responsibilities and authorities; (3) the common responsible person, if any; (4) the information security policy; (5) the number and categories of staff and the system to plan their availability; (6) the key persons responsible for implementing IS.I.OR.200, including compliance monitoring; (7) an organisation chart; (8) the internal reporting scheme; (9) the procedures, including the control of contracted activities and the ISMM amendment procedure; (10) currently approved alternative means of compliance. The initial issue is approved by the competent authority, and amendments outside the organisation's procedure need approval — except for declared organisations (250(b)–(c)).

• The ISMM may be integrated with other expositions or manuals, provided there is a clear cross-reference to the requirements of the Annex (250(d)).
• Parts may be kept in separate documents referenced from the manual, which then form part of it; one ISMM may cover several approvals operating a common ISMS (GM1 IS.I.OR.250(a)).

16

How are changes to the ISMS managed?

Through a procedure the organisation develops and the competent authority approves (IS.I.OR.255(a)). A change not covered by that procedure needs an application before it takes place and a formal approval before it is implemented, and the organisation operates under any conditions the authority prescribes meanwhile (255(b)). AMC1 IS.I.OR.255 expects the application to give at least the nature and purpose of the change, its implementation plan, its verification plan and its potential impact on aviation safety. Declared organisations need no approval of the procedure or of the change, and “may implement the change immediately”.

17

What does continuous improvement under IS.I.OR.260 involve?

Assessing the effectiveness and maturity of the ISMS “using adequate performance indicators”, on a calendar the organisation predefines or following an information security incident (260(a)); and, where deficiencies are found, taking the improvement measures that keep the ISMS compliant and the risks at an acceptable level, then reassessing the elements of the ISMS those measures affect (260(b)). GM1 IS.I.OR.260(a) names the minimum areas to monitor and maps established maturity models to five levels; EASA's FAQ notes that no specific maturity level is required.

18

What changes for a declared organisation?

Regulation (EU) 2025/2293, applicable from 22 February 2026, adapted Part-IS.I.OR to organisations that declare their activity rather than hold an approval. A declared organisation does not need approval of the initial issue of its ISMM (250(b)), of amendments outside its procedure (250(c)), of its change procedure (255(a)), or of other changes, which it may implement immediately (255(b)). It still makes the ISMM available to the competent authority and provides a copy of every amendment. Everything else in Part-IS.I.OR applies unchanged.

19

Can an organisation be exempted from the ISMS requirements?

Yes, by the competent authority's approval under IS.I.OR.200(e), if the organisation demonstrates that its activities, facilities and resources, and the services it operates, provides, receives and maintains, “do not pose any information security risks with a potential impact on aviation safety neither to itself nor to other organisations”. The approval rests on a documented information security risk assessment under IS.I.OR.205, reviewed and approved by the authority, and its continued validity is reviewed with the oversight audit cycle and whenever the scope of work changes. Regulation (EU) No 376/2014 reporting and IS.I.OR.200(a)(13) still apply.

• EASA's derogation guidelines (G-02) set out what an application contains and how authorities assess it — and advise refraining from granting a derogation if in doubt.
• EASA uses form FO.ORG.00030 for the organisations it oversees; national authorities publish their own forms.

20

How does Part-IS relate to NIS2 and to aviation security rules?

Neither discharges the other automatically. Article 5(1) of Regulation (EU) 2023/203 says that compliance with equivalent security requirements under the NIS Directive constitutes compliance with Part-IS; since that directive was repealed, the reference reads as Articles 21 and 23 of Directive (EU) 2022/2555 (NIS2), and GM1 Article 5(1) leaves it to the competent authority to decide whether measures taken under NIS2 are sufficient, bearing in mind that the two frameworks cover different elements. In the other direction, Article 7 has Part-IS authorities pass relevant information from IS.I.OR.230 notifications by operators of essential services to the NIS single point of contact.

• Article 5(2): for an operator or entity in its State's national civil aviation security programme, the cybersecurity requirements of point 1.7 of the Annex to Implementing Regulation (EU) 2015/1998 are considered equivalent to Part-IS — except IS.I.OR.230, which must be complied with as such.
• The perimeters differ: GM1 Article 5(2) gives the example of an airport, where body scanners fall under point 1.7 and runway lighting control systems under the aviation safety rules.

21

How will the competent authority assess our ISMS?

EASA's oversight guidelines for competent authorities (Part-IS TF G-03) assess implementation in levels: “Present” and “Suitable” — the ISMS foundation — then “Operating”, and “Effective”. Organisations were expected to make four things available: the first version of the ISMM; the IS.I.OR.255 change procedure; an initial risk assessment of their activities, facilities, systems and data, interfaces and major threat scenarios; and evidence of internal compliance monitoring against the G-03 checklist, with a corrective action plan. An organisation is deemed compliant only once the authority has concluded that it has reached Present, Suitable and Operating, which G-03 does not expect until well after the applicability date.

• For the organisations EASA itself oversees, EASA describes an 18-month development phase (EASA FAQ).