What are the two main control objectives for documented information under the ISMS?

The two main control objectives are: (1) ensuring the documented information is available and suitable for use where and when needed, and (2) ensuring it is adequately protected from loss of confidentiality, improper use, or loss of integrity.

Who must approve the outline of the information security personnel structure?

The outline of the structure of the specific information security personnel must be approved by the person identified in IS.AR.225(a).

AMC1 IS.AR.200(c) Information security management system (ISMS)

Q: What should a competent authority outline regarding information security personnel when establishing an ISMS under IS.AR.200(c)?

The competent authority should provide an outline of the structure of the specific information security personnel (internal and external), including their roles and responsibilities, that will be used to manage and maintain the elements within the scope of the ISMS. This outline must be approved by the person identified in IS.AR.225(a).

Q: What is required regarding contracted organisations or qualified entities used to implement the ISMS?

The competent authority should identify and categorise all relevant contracted organisations or qualified entities used to implement the ISMS. It should also define and document procedures for managing interfaces with all other entities and coordination between the competent authority and other national authorities, contracted organisations, or qualified entities.

Q: What should the competent authority identify and define to maintain compliance with the objectives of the Regulation over the ISMS life cycle?

The competent authority should identify and define all key processes and procedures, and internal and external reporting schemes that will be used to maintain compliance with the objectives of this Regulation over the life cycle of the ISMS. It may adjust existing processes or procedures for compliance.

Q: What additional information must be identified and documented for maintaining compliance with the ISMS objectives?

The competent authority should identify and document any other information that will be used to maintain compliance with the objectives of this Regulation.

Q: What requirements apply when creating and updating documented information for the ISMS?

When creating and updating documented information, the competent authority should ensure appropriate identification and description (e.g., a title, date, author, or reference number) as well as a review and an approval for suitability and adequacy.

Q: How should the competent authority control documented information required by the ISMS?

The competent authority should control the documented information required by the ISMS to ensure that it is (1) available and suitable for use, where and when it is needed, and (2) adequately protected (e.g., from loss of confidentiality, improper use, or loss of integrity).

Q: Can the competent authority adjust existing processes or procedures for compliance with the ISMS objectives?

Yes, the competent authority may adjust existing processes or procedures for compliance with the objectives of this Regulation.

Navigate / EASA

Ask question Discover more Add to collection

AMC1 IS.AR.200(c) Information security management system (ISMS)

ED Decision 2023/010/R

When establishing compliance with the provisions under point IS.AR.200(c), the competent authority should:

(a) provide an outline of the structure of the specific information security personnel (internal and external), including their roles and responsibilities that will be used to manage and maintain the elements included within the scope of the ISMS and will be approved by the person identified in IS.AR.225(a). The competent authority should review the outline of the structure at planned intervals or if significant changes occur (see the Note in AMC1 IS.AR.200(a)(1));

(b) identify and categorise all relevant contracted organisations or qualified entities used to implement the ISMS. The competent authority should define and document procedures for the management of interfaces with all other entities and coordination between the competent authority and other national authorities, contracted organisations or qualified entities;

(c) identify and define all key processes and procedures, and internal and external reporting schemes that will be used to maintain compliance with the objectives of this Regulation over the life cycle of the ISMS. The competent authority may adjust existing processes or procedures for compliance;

(d) identify and document any other information that will be used to maintain compliance with the objectives of this Regulation;

(e) when creating and updating documented information, ensure appropriate identification and description (e.g. a title, date, author, or reference number) as well as a review and an approval for suitability and adequacy;

(f) control the documented information required by the ISMS to ensure that it is:

(1) available and suitable for use, where and when it is needed;

(2) adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

Details

Source-Title: AMC1 IS.AR.200(c) Information security management system (ISMS) View latest amendments

Erulesid: ERULES-1963177438-21696 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-IS.AR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: IS.AR.200 Information security management system (ISMS)

Origin: EASA

Category: EAR