What is the purpose of identifying interfaces with third parties in the risk assessment?

To identify situations where information security risks, due to mutual exposure, could increase aviation safety risks for the organisation or other parties.

In the context of AMC1 IS.I.OR.205(b), what role do assets play in identifying interfaces?

Assets used for the exchange of data and information are part of the basis for identifying interfaces with other parties.

AMC1 IS.I.OR.205(b) Information security risk assessment

Q: What should an organisation identify as part of the information security risk assessment according to AMC1 IS.I.OR.205(b)?

The organisation should identify the interfaces it has with other parties such as service providers, supply chains and other third parties, based on the exchange of data and information and the assets used for that exchange.

Q: Which parties are mentioned in AMC1 IS.I.OR.205(b) as potential interfaces for information exchange?

Service providers, supply chains, and other third parties.

Q: What is the basis for identifying interfaces with other parties in the information security risk assessment?

The exchange of data and information and the assets used for that exchange.

Q: What potential outcomes should be considered when identifying interfaces with other parties?

Information security risks, as a result of mutual exposure, may either increase aviation safety risks faced by other parties and/or increase aviation safety risks faced by the organisation.

Q: How can mutual exposure with other parties affect aviation safety risks?

It may increase aviation safety risks faced by other parties and/or increase aviation safety risks faced by the organisation.

Navigate / EASA

Ask question Discover more Add to collection

AMC1 IS.I.OR.205(b) Information security risk assessment

ED Decision 2023/009/R

The organisation should, as part of the information security risk assessment, identify the interfaces it has with other parties such as service providers, supply chains and other third parties, based on the exchange of data and information and the assets used for that exchange, which could lead to a situation where information security risks, as a result of mutual exposure, may either:

— increase aviation safety risks faced by other parties; and/or

— increase aviation safety risks faced by the organisation.

Details

Source-Title: AMC1 IS.I.OR.205(b) Information security risk assessment View latest amendments

Erulesid: ERULES-1963177438-21798 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/009/R Navigate

Regulatorysubject: Part-IS.I.OR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: IS.I.OR.205 Information security risk assessment

Origin: EASA

Category: EAR