What criteria should the competent authority consider when establishing compliance with the objectives of IS.AR.205(d)?

The competent authority should take into account criteria such as reviewing the risk assessment at regular intervals to identify and account for relevant changes, determining the periodicity of evaluations based on asset criticality, residual risk levels, and contractual or regulatory requirements, and documenting the periodicity with justification, approval date, and risk owner information.

What factors determine the frequency of risk assessment reviews?

The frequency is determined by the authority performing the assessment, considering the criticality of the assets within the scope, the levels of residual risk of those assets, and any contractual or regulatory requirements. A higher criticality or level of risk will require more frequent review.

Why might a competent authority need to review the risk assessment more frequently?

A competent authority might need to review the risk assessment more frequently if the assets within the scope have higher criticality or higher levels of residual risk, as stated in AMC1 IS.AR.205(d).

What is the purpose of reviewing the risk assessment at regular intervals?

The purpose is to identify and account for relevant changes, ensuring that the risk assessment remains current and effective in addressing the objectives of IS.AR.205(d).

Who determines the periodicity for evaluating potential changes to the risk assessment?

The authority performing the assessment determines the periodicity, considering the criticality of assets, residual risk levels, and contractual or regulatory requirements.

What information about the risk owner must be included in the documentation of review periodicity?

The documentation must include information about the risk owner, along with the justification and date of approval.

Does AMC1 IS.AR.205(d) specify a fixed review interval for risk assessments?

No, it does not specify a fixed interval. It states that the periodicity should be determined by the authority performing the assessment, based on asset criticality, residual risk levels, and contractual or regulatory requirements.

What is the role of contractual or regulatory requirements in setting the review periodicity?

Contractual or regulatory requirements are one of the factors that the authority should consider when determining the periodicity of risk assessment reviews, as they may impose specific review frequencies.

AMC1 IS.AR.205(d) Information security risk assessment

Q: How often should the risk assessment under IS.AR.205(a), (b), and (c) be reviewed?

The risk assessment should be reviewed at regular intervals to identify and account for relevant changes. The periodicity is determined by the authority performing the assessment, considering the criticality of assets, levels of residual risk, and any contractual or regulatory requirements. Higher criticality or risk levels require more frequent reviews.

Navigate / EASA

Ask question Discover more Add to collection

AMC1 IS.AR.205(d) Information security risk assessment

ED Decision 2023/010/R

The competent authority should take into account the following criteria when establishing compliance with the objectives contained in point IS.AR.205(d):

(a) The risk assessment performed under points IS.AR.205 (a), (b) and (c) should be reviewed at regular intervals to identify and account for relevant changes. The periodicity at which potential changes have to be evaluated should be determined by the authority performing the assessment considering the criticality of the assets within the scope of the risk assessment, levels of residual risk of the assets within the scope of the risk assessment and any contractual or regulatory requirements. A higher criticality or level of risk will require more frequent review.

(b) The periodicity of risk assessment reviews should be documented by the competent authority and include the justification, date of approval and information about the risk owner.

Details

Source-Title: AMC1 IS.AR.205(d) Information security risk assessment View latest amendments

Erulesid: ERULES-1963177438-21719 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-IS.AR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: IS.AR.205 Information security risk assessment

Origin: EASA

Category: EAR