When does point ARGH.GEN.136 become applicable?

Point ARGH.GEN.136 is applicable from 27 March 2031, according to Regulation (EU) 2025/23.

ARGH.GEN.136 Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

Q: With whom must the competent authority coordinate its reporting scheme for information security incidents from ground handling organisations?

The competent authority shall coordinate with any other relevant authorities responsible for information security or cybersecurity within the Member State concerned to increase the coordination and compatibility of reporting schemes.

Q: What scope of entities does the Agency's information security analysis cover under point (b)?

The Agency's analysis covers information security incidents or vulnerabilities with a potential impact on aviation safety involving products, equipment, persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.

Q: To whom must the competent authority immediately notify the measures it takes under point (c)?

The measures shall immediately be notified to all persons or organisations that shall comply with them under Regulation (EU) 2018/1139 and its delegated and implementing acts. The competent authority shall also notify those measures to the Agency and, when combined action is required, the competent authorities of the other Member States concerned.

Navigate / EASA

Ask question Discover more Add to collection

ARGH.GEN.136 Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

Regulation (EU) 2025/23

(a) The competent authority shall implement a system for the collection, analysis, and dissemination of information related to information security incidents and vulnerabilities with a potential impact on aviation safety that are reported by ground handling organisations. This shall be done in coordination with any other relevant authorities responsible for information security or cybersecurity within the Member State concerned to increase the coordination and compatibility of reporting schemes.

(b) The Agency shall implement a system for the analysis of any relevant safety-significant information received pursuant to point ARGH.GEN.125(c), and without undue delay provide the Member States and the Commission with any information, including recommendations or corrective actions to be taken, necessary for them to react in a timely manner to an information security incident or vulnerability with a potential impact on aviation safety involving products, equipment, persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.

(c) Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the potential impact of the information security incident or vulnerability on aviation safety.

(d) Measures taken in accordance with point (c) shall immediately be notified to all persons or organisations that shall comply with them under Regulation (EU) 2018/1139 and its delegated and implementing acts. The competent authority shall also notify those measures to the Agency and, when combined action is required, the competent authorities of the other Member States concerned.

[point ARGH.GEN.136 applicable from 27 March 2031 — Regulation (EU) 2025/23]

Details

Source-Title: ARGH.GEN.136 Immediate reaction to an information security incident or vulnerability with an impact on aviation safety View latest amendments

Erulesid: ERULES-1963177438-23635 Compare versions

Domain: Ground Handling

Applicabilitydate: 27 March, 2031

Entryintoforcedate: 27 March, 2025

Regulatorysource: Regulation (EU) 2025/23 Navigate

Regulatorysubject: Part-ARGH

Typeofcontent: IR (Implementing rule)

Origin: EASA

Category: EAR