What are the criteria for compliance when evaluating a deficiency's impact and extent on the ISMS?

The process should include criteria for compliance: (a) deciding on corrections and their implementation without undue delay; (b) deciding on the need for and implementation of corrective actions based on root cause analysis; (c) verifying implemented actions; (d) reporting to and reviewing with the person identified in IS.AR.225(a); and (e) documenting as evidence the detected deficiencies, actions, and outcomes.

How should corrections be implemented to limit the impact of a deficiency?

Corrections should be decided and implemented without undue delay in order to limit the impact of the deficiency, deal with its consequences, and, as applicable, control or eliminate it.

What documentation is required as evidence in the continuous improvement process?

Documentation should include detected deficiencies, planned and implemented corrections and/or corrective actions with deadlines and responsible persons, management feedback, outcomes of the verification process step, and, if necessary, change decisions made for the ISMS itself.

What should be done to prevent future recurrence of a deficiency?

The process should include, if needed, the prevention of the deficiency's future recurrence or occurrence elsewhere, typically through corrective actions that eliminate the root cause.

AMC1 IS.AR.235(b) Continuous improvement

Q: What should a competent authority do when a deficiency is identified under AMC1 IS.AR.235(b)?

The competent authority should react in a timely manner following a defined process leading to a managed status regarding the deficiency, its associated consequences and, if needed, the prevention of its future recurrence or occurrence elsewhere.

Q: What is the basis for deciding on corrective actions for a deficiency?

Corrective actions should be based on a root cause analysis and an evaluation of actions remediating the cause, aimed at being proportionate to the consequences and impact of the deficiency.

Q: What must be verified regarding implemented actions under the continuous improvement process?

Implemented actions must be verified to be effective and result in acceptable residual risks; not to have unintended side effects leading to other deficiencies, new risks, or an ISMS not aligned with applicable requirements; and for corrective actions, to effectively remediate or eliminate the root cause.

Q: Who should receive reports on identified deficiencies and action plans?

Reports should be made to and reviewed with the person identified in IS.AR.225(a) and, as necessary, with other involved or affected roles and parties.

Q: What is the purpose of the defined process when a deficiency is identified?

The purpose is to achieve a managed status regarding the deficiency, its associated consequences, and, if needed, prevent its future recurrence or occurrence elsewhere.

Q: How should corrective actions be proportionate to the deficiency?

Corrective actions should be based on a root cause analysis and an evaluation of actions remediating the cause, aimed at being proportionate to the consequences and impact of the deficiency.

Navigate / EASA

Ask question Discover more Add to collection

AMC1 IS.AR.235(b) Continuous improvement

ED Decision 2023/010/R

When a deficiency is identified, the competent authority should react in a timely manner following a defined process leading to a managed status regarding the deficiency, its associated consequences and, if needed, the prevention of its future recurrence or occurrence elsewhere.

Based on an evaluation of the impact and extent of the deficiency and the potential consequences on the ISMS, the process should include as criteria for compliance:

(a) deciding on corrections and their implementation without undue delay in order to limit the impact of the deficiency and deal with its consequences as well as, as applicable, to control or eliminate it;

(b) deciding on the need for, and the implementation of, corrective actions to eliminate the cause(s) of, and contributing factors to, the deficiency based on a root cause analysis and an evaluation of actions remediating the cause aimed at being proportionate to the consequences and impact of the deficiency;

(1) to be effective and to result in acceptable residual risks;

(2) not to have unintended side effects leading to other deficiencies, new risks, or an ISMS not aligned with the applicable requirements; as well as

(3) for corrective actions, to effectively remediate or eliminate the root cause;

(d) reporting to and reviewing the identified deficiencies, action plan and results of the action taken with the person identified in IS.AR.225(a) and, as necessary, with other involved or affected roles and parties;

(e) documenting as evidence the detected deficiencies, the planned and implemented corrections and/or corrective actions with deadlines and responsible persons, the management feedback, the outcomes of the process step under point (c) above and, if necessary, the change decisions made for the ISMS itself.

Details

Source-Title: AMC1 IS.AR.235(b) Continuous improvement View latest amendments

Erulesid: ERULES-1963177438-21734 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-IS.AR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: IS.AR.235 Continuous improvement

Origin: EASA

Category: EAR