IS.D.OR.100 Scope IS.D.OR.200 Information security management system (ISMS) IS.D.OR.205 Information security risk assessment IS.D.OR.210 Information security risk treatment IS.D.OR.215 Information security internal reporting scheme IS.D.OR.220 Information security incidents -- detection, response and recovery IS.D.OR.225 Response to findings notified by the competent authority IS.D.OR.230 Information security external reporting scheme IS.D.OR.235 Contracting of information security management activities IS.D.OR.240 Personnel requirements IS.D.OR.245 Record-keeping IS.D.OR.250 Information security management manual (ISMM) IS.D.OR.255 Changes to the information security management system IS.D.OR.260 Continuous improvement Appendix I -- Examples of threat scenarios with a potential harmful impact on safety Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and the NIST CSF 2.0 Appendix III -- Examples of aviation services and interfaces Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences Appendix V -- Proportionality considerations related to safety relevance and aspects of complexity Appendix VI -- Adaptation of the EU Cybersecurity Skills Framework (ECSF)