In what manner must personnel acknowledge their understanding of assigned roles and information security responsibilities?

The acknowledgement must be in a traceable and verifiable manner.

How should the authority ensure that employees understand their information security responsibilities?

By specifying all responsibilities in a clear and transparent manner and having personnel acknowledge understanding in a traceable and verifiable way.

What are the two key aspects of the acknowledgement required from personnel under AMC1 IS.AR.225(d)?

The acknowledgement must be traceable and verifiable.

AMC1 IS.AR.225(d) Personnel requirements

Q: How should the competent authority specify information security responsibilities for employees under AMC1 IS.AR.225(d)?

The authority should specify all information security responsibilities an employee has in a clear and transparent manner for any assigned role and task.

Q: What is required of personnel performing activities under Regulation (EU) 2023/203 regarding acknowledgement of roles and responsibilities?

All personnel performing the activities required under this Regulation should acknowledge, in a traceable and verifiable manner, understanding of the assigned roles and the associated information security responsibilities.

Q: What does AMC1 IS.AR.225(d) require regarding the clarity of information security responsibilities?

It requires that the authority specify all information security responsibilities an employee has in a clear and transparent manner.

Q: What is the scope of personnel who must acknowledge understanding of roles and responsibilities under AMC1 IS.AR.225(d)?

All personnel performing the activities required under this Regulation.

Q: Does AMC1 IS.AR.225(d) require personnel to acknowledge understanding of assigned roles?

Yes, all personnel performing the activities required under this Regulation should acknowledge, in a traceable and verifiable manner, understanding of the assigned roles and the associated information security responsibilities.

Q: What is the role of the authority in relation to information security responsibilities for assigned roles and tasks?

The authority should specify all information security responsibilities an employee has in a clear and transparent manner.

Navigate / EASA

Ask question Discover more Add to collection

AMC1 IS.AR.225(d) Personnel requirements

ED Decision 2023/010/R

ACKNOWLEDGEMENT OF RESPONSIBILITIES

Regarding any assigned role and task, the authority should specify all information security responsibilities an employee has in a clear and transparent manner.

As part of this, all personnel performing the activities required under this Regulation should acknowledge, in a traceable and verifiable manner, understanding of the assigned roles and the associated information security responsibilities.

Details

Source-Title: AMC1 IS.AR.225(d) Personnel requirements View latest amendments

Erulesid: ERULES-1963177438-21709 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-IS.AR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: IS.AR.225 Personnel requirements

Origin: EASA

Category: EAR