What is the role of the competent authority in the derogation process under IS.I.OR.200(e)?

The competent authority approves the derogation and determines whether the documented information security risk assessment is deemed satisfactory for a derogation to be granted.

What is the ED Decision associated with AMC1 IS.I.OR.200(e)?

The ED Decision associated with AMC1 IS.I.OR.200(e) is ED Decision 2023/009/R.

AMC1 IS.I.OR.200(e) Information security management system (ISMS)

Q: What is expected from the risk assessment to justify the grounds for a derogation under IS.I.OR.200(e)?

The risk assessment is expected to provide explanations for the exclusion of all elements from the scope of the ISMS.

Q: Which AMC documents provide directions for performing a documented information security risk assessment for a derogation?

AMC1 IS.I.OR.205(a) and AMC1 IS.I.OR.205(b) provide the directions to perform a documented information security risk assessment for seeking approval of a derogation under point IS.I.OR.200(e).

Q: What must the risk assessment explain regarding the scope of the ISMS for a derogation?

The risk assessment must provide explanations for the exclusion of all elements from the scope of the ISMS.

Q: What should an organisation do if it wants a third party to perform the risk assessment for a derogation?

The organisation should consider the requirements of IS.I.OR.235 and the related AMC.

Q: What is the purpose of the documented information security risk assessment in the context of IS.I.OR.200(e)?

The purpose is to seek approval by the competent authority of a derogation under point IS.I.OR.200(e).

Navigate / EASA

Ask question Discover more Add to collection

AMC1 IS.I.OR.200(e) Information security management system (ISMS)

ED Decision 2023/009/R

DEROGATION

Organisations should follow the directions provided in AMC1 IS.I.OR.205(a) and AMC1 IS.I.OR.205(b) to perform a documented information security risk assessment to seek the approval by the competent authority of a derogation under point IS.I.OR.200(e). In order to justify the grounds for a derogation, the risk assessment is expected to provide explanations for the exclusion of all elements from the scope of the ISMS. It is up to the authority to determine whether this assessment is deemed satisfactory for a derogation to be granted.

Organisations that would like to have the risk assessment performed by a third party should consider the requirements of IS.I.OR.235 and the related AMC.

Details

Source-Title: AMC1 IS.I.OR.200(e) Information security management system (ISMS) View latest amendments

Erulesid: ERULES-1963177438-21783 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/009/R Navigate

Regulatorysubject: Part-IS.I.OR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: IS.I.OR.200 Information security management system (ISMS)

Origin: EASA

Category: EAR