Does AMC1 IS.I.OR.205(a) specify a particular methodology for the preliminary risk assessment?

It requires a documented methodology, but does not specify a particular one.

What does the term 'elements listed in IS.I.OR.205(a)' refer to in the context of AMC1 IS.I.OR.205(a)?

It refers to the elements that are subject to inclusion in or exclusion from the ISMS scope, as listed in point IS.I.OR.205(a).

Which elements should be included in the ISMS scope according to AMC1 IS.I.OR.205(a)?

All relevant aviation safety elements should be identified and included in the ISMS scope as per IS.I.OR.200 and related AMC.

AMC1 IS.I.OR.205(a) Information security risk assessment

Q: What is the relationship between AMC1 IS.I.OR.205(a) and IS.I.OR.200?

The organisation should ensure that all relevant aviation safety elements are identified and included in the ISMS scope as per IS.I.OR.200 and related AMC.

Q: What should an organisation ensure when conducting an information security risk assessment under AMC1 IS.I.OR.205(a)?

The organisation should ensure that all relevant aviation safety elements are identified and included in the ISMS scope as per IS.I.OR.200 and related AMC.

Q: What is a means to comply with point IS.I.OR.205(a) according to AMC1 IS.I.OR.205(a)?

A means to comply is to perform a preliminary high-level risk assessment or impact assessment, carried out in accordance with a documented methodology and following precise criteria for the inclusion in and exclusion from the ISMS scope of the elements listed in IS.I.OR.205(a).

Q: How should the preliminary high-level risk assessment be carried out to comply with IS.I.OR.205(a)?

It should be carried out in accordance with a documented methodology and following precise criteria for the inclusion in and exclusion from the ISMS scope of the elements listed in IS.I.OR.205(a).

Q: What criteria should be followed for inclusion and exclusion from the ISMS scope under AMC1 IS.I.OR.205(a)?

Precise criteria should be followed for the inclusion in and exclusion from the ISMS scope of the elements listed in IS.I.OR.205(a).

Q: What is the purpose of the preliminary high-level risk assessment or impact assessment mentioned in AMC1 IS.I.OR.205(a)?

It is a means to comply with the requirement in point IS.I.OR.205(a).

Navigate / EASA

Ask question Discover more Add to collection

AMC1 IS.I.OR.205(a) Information security risk assessment

ED Decision 2023/009/R

When conducting an information security risk assessment, the organisation should ensure that all relevant aviation safety elements are identified and included in the ISMS scope as per IS.I.OR.200 and related AMC.

A means to comply with the requirement in point IS.I.OR.205(a) is to perform a preliminary high-level risk assessment or impact assessment, carried out in accordance with a documented methodology and following precise criteria for the inclusion in and exclusion from the ISMS scope of the elements listed in IS.I.OR.205(a).

Details

Source-Title: AMC1 IS.I.OR.205(a) Information security risk assessment View latest amendments

Erulesid: ERULES-1963177438-21792 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/009/R Navigate

Regulatorysubject: Part-IS.I.OR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: IS.I.OR.205 Information security risk assessment

Origin: EASA

Category: EAR