IS.I.OR.100 Scope IS.I.OR.200 Information security management system (ISMS) IS.I.OR.205 Information security risk assessment IS.I.OR.210 Information security risk treatment IS.I.OR.215 Information security internal reporting scheme IS.I.OR.220 Information security incidents -- detection, response and recovery IS.I.OR.225 Response to findings notified by the competent authority IS.I.OR.230 Information security external reporting scheme IS.I.OR.235 Contracting of information security management activities IS.I.OR.240 Personnel requirements IS.I.OR.245 Record-keeping IS.I.OR.250 Information security management manual (ISMM) IS.I.OR.255 Changes to the information security management system IS.I.OR.260 Continuous improvement Appendix I -- Examples of threat scenarios with a potential harmful impact on safety Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and NIST CSF 2.0 Appendix III -- Examples of aviation services and interfaces Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences Appendix V -- Proportionality considerations related to indicators of complexity Appendix VI -- Adaptation of the EU Cybersecurity Skills Framework (ECSF)