Which specific point in Annex II must be complied with as such even when other security requirements are considered equivalent?

Point IS.I.OR.230 of Annex II to this Regulation must be complied with as such, even when cybersecurity requirements from Regulation (EU) 2015/1998 or security requirements from Regulation (EU) 2021/696 are considered equivalent.

Article 5 - Requirements arising from other Union legislation

Q: For which organisations are cybersecurity requirements in point 1.7 of the Annex to Regulation (EU) 2015/1998 considered equivalent, and what exception applies?

For an organisation referred to in Article 2(1) that is an operator or an entity referred to in the national civil aviation security programmes of Member States laid down in accordance with Article 10 of Regulation (EC) No 300/2008, the cybersecurity requirements contained in point 1.7 of the Annex to Regulation (EU) 2015/1998 shall be considered equivalent with the requirements laid down in this Regulation, except as regards point IS.I.OR.230 of Annex II to this Regulation, which shall be complied with as such.

Navigate / EASA

Ask question Discover more Add to collection

Article 5 – Requirements arising from other Union legislation

Regulation (EU) 2023/203

1. Where an organisation referred to in Article 2(1) complies with security requirements laid down in accordance with Article 14 of Directive (EU) 2016/1148 that are equivalent to the requirements laid down in this Regulation, compliance with those security requirements shall be considered to constitute compliance with the requirements laid down in this Regulation.

2. Where an organisation referred to in Article 2(1) is an operator or an entity referred to in the national civil aviation security programmes of Member States laid down in accordance with Article 10 of Regulation (EC) No 300/2008 of the European Parliament and of the Council[25], the cybersecurity requirements contained in point 1.7 of the Annex to Regulation (EU) 2015/1998 shall be considered to be equivalent with the requirements laid down in this Regulation, except as regards point IS.I.OR.230 of Annex II to this Regulation that shall be complied with as such.

3. Where the organisation referred to in Article 2(1) is the air navigation service provider of the European Geostationary Navigation Overlay Service (EGNOS) referred to in Regulation (EU) 2021/696[26], the security requirements contained in Articles 33 to 43 of Title V of that Regulation are considered to be equivalent with the requirements laid down in this Regulation, except as regards point IS.I.OR.230 of Annex II to this Regulation that shall be complied with as such.

4. The Commission, after consulting the Agency and the Cooperation Group referred to in Article 11 of Directive (EU) 2016/1148, may issue guidelines for the assessment of the equivalence of requirements laid down in this Regulation and Directive (EU) 2016/1148.

[25] Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002, (OJ L 97, 9.4.2008, p. 72).

[26] Regulation (EU) 2021/696 of the European Parliament and of the Council of 28 April 2021 establishing the Union Space Programme and the European Union Agency for the Space Programme and repealing Regulations (EU) No 912/2010, (EU) No 1285/2013 and (EU) No 377/2014 and Decision No 541/2014/EU (OJ L 170, 12.5.2021, p. 69).

Details

Source-Title: Article 5 - Requirements arising from other Union legislation View latest amendments

Erulesid: ERULES-1963177438-19951 Compare versions

Domain: Information Security (IS)

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 22 February, 2023

Regulatorysource: Regulation (EU) 2023/203 Navigate

Regulatorysubject: Cover regulation

Typeofcontent: IR (Implementing rule)

Parentir: Powers and recitals

Origin: EASA

Category: EAR

Article 5 – Requirements arising from other Union legislation

Details

Related sections: