How should documented information required by the ISMS be controlled?

The documented information should be controlled to ensure that it is (1) available and suitable for use, where and when it is needed, and (2) adequately protected (e.g., from loss of confidentiality, improper use, or loss of integrity).

What is the role of the accountable manager in relation to the outline of the information security personnel structure?

The outline of the structure of the specific information security personnel, including their roles and responsibilities, will be approved by the accountable manager.

Can an organisation adjust existing processes or procedures to maintain compliance with the ISMS objectives?

Yes, the organisation may adjust existing processes or procedures for compliance when identifying and defining key processes and procedures and reporting schemes.

What does 'adequately protected' mean for documented information in the context of the ISMS?

Adequately protected means protecting documented information from loss of confidentiality, improper use, or loss of integrity.

What is the requirement for reviewing and approving documented information?

When creating and updating documented information, the organisation must ensure a review and an approval for suitability and adequacy.

What are the two conditions for availability of documented information?

Documented information must be available and suitable for use, where and when it is needed.

What is the ED Decision reference for AMC1 IS.I.OR.200(c)?

The ED Decision reference is ED Decision 2023/009/R.

What is the scope of the ISMS as mentioned in the outline of the structure?

The outline of the structure is used to manage and maintain the elements included within the scope of the ISMS.

What should an organisation do if significant changes occur in the structure of information security personnel?

The organisation should review the outline of the structure if significant changes occur, in addition to planned intervals.

What are the examples of identification and description for documented information?

Examples include a title, date, author, or reference number.

What is the purpose of identifying and categorising contracted organisations?

The purpose is to implement the ISMS, and the organisation must define and document procedures for managing interfaces and coordination with them.

AMC1 IS.I.OR.200(c) Information security management system (ISMS)

Q: What should an organisation provide when establishing compliance with IS.I.OR.200(c) regarding the structure of information security personnel?

The organisation should provide an outline of the structure of the specific information security personnel (internal and external), including their roles and responsibilities. This outline will be used to manage and maintain the elements within the scope of the ISMS and will be approved by the accountable manager.

Q: What is required regarding contracted organisations used to implement the ISMS?

The organisation should identify and categorise all relevant contracted organisations used to implement the ISMS, and define and document procedures for the management of interfaces and coordination between the organisation and other organisations, including contracted organisations.

Q: What key processes and procedures must an organisation identify for maintaining compliance with the ISMS objectives?

The organisation should identify and define all key processes and procedures, and internal and external reporting schemes, that will be used to maintain compliance with the objectives of this Regulation over the life cycle of the ISMS. The organisation may adjust existing processes or procedures for compliance.

Q: What should an organisation do when creating and updating documented information for the ISMS?

The organisation should ensure appropriate identification and description (e.g., a title, date, author, or reference number) as well as a review and an approval for suitability and adequacy.

Q: What additional information should an organisation identify and document for maintaining compliance with the ISMS objectives?

The organisation should identify and document any other information that will be used to maintain compliance with the objectives of this Regulation.

Q: What is the purpose of the outline of the structure of information security personnel?

The outline of the structure will be used to manage and maintain the elements included within the scope of the ISMS.

Navigate / EASA

Ask question Discover more Add to collection

AMC1 IS.I.OR.200(c) Information security management system (ISMS)

ED Decision 2023/009/R

When establishing compliance with the provisions under point IS.I.OR.200(c), the organisation should:

(a) provide an outline of the structure of the specific information security personnel (internal and external), including their roles and responsibilities. This outline of the structure will be used to manage and maintain the elements included within the scope of the ISMS and will be approved by the accountable manager. The organisation should review the outline of the structure at planned intervals or if significant changes occur (see the Note in AMC1 IS.I.OR.200(a)(1));

(b) identify and categorise all relevant contracted organisations used to implement the ISMS. The organisation should define and document procedures for the management of interfaces and coordination between the organisation and other organisations, including contracted organisations;

(c) identify and define all key processes and procedures, and internal and external reporting schemes, that will be used to maintain compliance with the objectives of this Regulation over the life cycle of the ISMS. The organisation may adjust existing processes or procedures for compliance;

(d) identify and document any other information that will be used to maintain compliance with the objectives of this Regulation;

(e) when creating and updating documented information, ensure appropriate identification and description (e.g. a title, date, author, or reference number) as well as a review and an approval for suitability and adequacy;

(f) control the documented information required by the ISMS to ensure that it is:

(1) available and suitable for use, where and when it is needed;

(2) adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

Details

Source-Title: AMC1 IS.I.OR.200(c) Information security management system (ISMS) View latest amendments

Erulesid: ERULES-1963177438-21774 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/009/R Navigate

Regulatorysubject: Part-IS.I.OR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: IS.I.OR.200 Information security management system (ISMS)

Origin: EASA

Category: EAR