What documented information should a competent authority develop to maintain compliance with the information security management system objectives?

The amount of documented information may vary due to factors like size, complexity, or harmonisation with existing management processes. A non-exhaustive list includes: information security policy with objectives, responsibilities and accountabilities for roles, scope of the ISMS with interfaces and dependencies, risk management process, archive of identified risks with treatment measures, evidence of necessary and current competencies, and key performance indicators from monitoring and measurement.

Where are the responsibilities and accountabilities for information security roles documented?

Responsibilities and accountabilities for roles relevant to information security should be documented, referencing the personnel requirements in points IS.AR.225(a) and (b) and the related AMC and GM.

What should be documented regarding the scope of the ISMS?

The scope of the ISMS and the interfaces with, and dependencies on, other parties should be documented, as per IS.AR.200(a)(2) and the information security requirements in points IS.AR.205(a) and (b).

Which points are referenced for the information security risk management process documentation?

The information security risk management process should be documented, referencing the information security requirements in points IS.AR.205 and IS.AR.210.

What evidence of personnel competencies should be documented under IS.AR.200(c)?

Evidence of the competencies necessary for personnel performing activities required under this Regulation should be documented, as per IS.AR.225(c) and related AMC and GM. Additionally, evidence of current competencies should be documented as per IS.AR.230(b)(1).

What are key performance indicators in ISMS documentation derived from?

Key performance indicators are derived from evidence of the monitoring and measurement of the ISMS processes.

Which EASA decision is this guidance material associated with?

This guidance material is associated with ED Decision 2023/010/R.

What is the non-exhaustive list of documented information for ISMS compliance?

The list includes: (a) information security policy with objectives, (b) responsibilities and accountabilities for roles, (c) scope of ISMS and interfaces, (d) risk management process, (e) archive of risks and treatment measures, (f) evidence of necessary competencies, (g) evidence of current competencies, and (h) key performance indicators from monitoring and measurement.

What is the purpose of the documented information in ISMS?

The purpose is to maintain compliance with the objectives of this Regulation, with the amount varying based on factors like size and complexity.

Which points are referenced for the scope of ISMS and dependencies on other parties?

The scope and dependencies are referenced in IS.AR.200(a)(2) and the information security requirements in points IS.AR.205(a) and (b).

What is the reference for the archive of identified risks and treatment measures?

The archive is referenced in IS.AR.230.

What is the reference for evidence of current competencies of personnel?

Evidence of current competencies is referenced in IS.AR.230(b)(1).

What is the reference for evidence of necessary competencies?

Evidence of necessary competencies is referenced in IS.AR.225(c) and the related AMC and GM.

What is the reference for responsibilities and accountabilities for roles?

Responsibilities and accountabilities are referenced in the personnel requirements in points IS.AR.225(a) and (b) and the related AMC and GM.

What is the reference for the information security policy?

The information security policy is referenced in IS.AR.200(a)(1).

What is the reference for the risk management process?

The risk management process is referenced in the information security requirements in points IS.AR.205 and IS.AR.210.

GM1 IS.AR.200(c) Information security management system (ISMS)

Q: Which EASA regulation points are referenced for the information security policy documentation?

The information security policy should include the authority's information security objectives, as referenced in point IS.AR.200(a)(1).

Q: What is the 'risk register' or 'risk ledger' in the context of ISMS documentation?

It is an archive of the risks identified in the information security risk assessment along with the associated risk treatment measures, as referenced in IS.AR.230.

Q: Does the amount of documented information for ISMS compliance vary between competent authorities?

Yes, the amount may vary due to factors such as size and complexity, or the need for harmonisation with other management processes already in place.

Navigate / EASA

Ask question Discover more Add to collection

GM1 IS.AR.200(c) Information security management system (ISMS)

ED Decision 2023/010/R

The amount of documented information that should be developed to maintain compliance with the objectives of this Regulation may vary between competent authorities due to various factors, such as size and complexity, or the need for harmonisation with other management processes already in place. As general guidance, taking into account the documents required to comply with point IS.AR.200(a) and the record-keeping requirements referred to in IS.AR.230, the following is a non-exhaustive list of information that should be documented:

(a) information security policy that should include the authority’s information security objectives — see IS.AR.200(a)(1);

(b) responsibilities and accountabilities for roles relevant to information security — see the personnel requirements referred to in points IS.AR.225(a) and (b) and the related AMC and GM;

(c) scope of the ISMS and the interfaces with, and dependencies on, other parties — see IS.AR.200(a)(2) and the information security requirements referred to in points IS.AR.205(a) and (b);

(d) information security risk management process — see the information security requirements referred to in points IS.AR.205 and IS.AR.210;

(e) archive of the risks identified in the information security risk assessment along with the associated risk treatment measures (often referred to as ‘risk register’ or ‘risk ledger’) — see IS.AR.230;

(f) evidence of the competencies necessary for the personnel performing the activities required under this Regulation — see IS.AR.225(c) and the related AMC and GM;

(g) evidence of the current competencies of the personnel performing the activities required under this Regulation — see IS.AR.230(b)(1);

(h) (key) performance indicators derived from evidence of the monitoring and measurement of the ISMS processes.

Details

Source-Title: GM1 IS.AR.200(c) Information security management system (ISMS) View latest amendments

Erulesid: ERULES-1963177438-21698 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-IS.AR

Typeofcontent: GM to IR (Guidance material to implementing rule)

Parentir: IS.AR.200 Information security management system (ISMS)

Origin: EASA

Category: EAR