IS.AR.100 Scope IS.AR.200 Information security management system (ISMS) IS.AR.205 Information security risk assessment IS.AR.210 Information security risk treatment IS.AR.215 Information security incidents -- detection, response and recovery IS.AR.220 Contracting of information security management activities IS.AR.225 Personnel requirements IS.AR.230 Record-keeping IS.AR.235 Continuous improvement Appendix I -- Examples of threat scenarios with a potential harmful impact on safety Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and the NIST CSF 2.0 Appendix III -- Examples of aviation services and interfaces Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences