What should a competent authority primarily consider when implementing the ISMS required by IS.AR.200(d)?

The competent authority should primarily consider the risks that it may be posing to other organisations, as well as its own risk exposure. Other relevant aspects include the authority's needs and objectives, information security requirements, its own processes, and the size, complexity and structure of the authority, all of which may change over time.

Can a competent authority integrate its ISMS with existing management systems to reduce implementation effort?

Yes, a competent authority may take advantage of existing management systems by integrating the ISMS with them. This can reduce the effort and costs required to implement and maintain the ISMS, while ensuring consistency and alignment with the authority's overall management approach.

What are some potential synergies when integrating an ISMS with an existing management system?

Potential synergies include leveraging existing policies and procedures as a foundation, aligning the ISMS with other management systems such as safety management systems (SMSs), using existing risk management processes to identify and assess information security risks, reusing existing controls like access controls or incident management processes, and using the continuous improvement process of existing management systems to improve the ISMS over time.

How can an authority use existing risk management processes in its ISMS implementation?

An authority may use its existing risk management processes to identify and assess information security risks that could potentially lead to aviation safety risks.

What is the purpose of aligning the ISMS with other management systems like SMSs?

Aligning the ISMS with other management systems, such as safety management systems (SMSs), helps ensure that the ISMS is consistent with the authority's overall management approach.

Which existing controls can be reused to implement information security controls required by the ISMS?

Existing controls such as access controls or incident management processes can be reused to implement the information security controls required by the ISMS.

What is the role of existing policies and procedures in ISMS implementation?

An authority may use its existing policies and procedures as a foundation for its ISMS, which helps ensure consistency and minimise the need for additional documentation.

GM1 IS.AR.200(d) Information security management system (ISMS)

Q: How can an authority improve its ISMS over time using existing management systems?

An authority may use the continuous improvement process of existing management systems to improve the ISMS over time.

Q: What factors related to the authority's structure should be considered when implementing the ISMS?

The authority should consider its needs and objectives, information security requirements, its own processes, and the size, complexity and structure of the authority, all of which may change over time.

Navigate / EASA

Ask question Discover more Add to collection

GM1 IS.AR.200(d) Information security management system (ISMS)

ED Decision 2023/010/R

PROPORTIONALITY IN ISMS IMPLEMENTATION

When implementing the processes and procedures, as well as establishing the roles and responsibilities required under point IS.AR.200(d), the competent authority should primarily consider the risks that it may be posing to other organisations, as well as its own risk exposure. Other aspects that may be relevant include the authority’s needs and objectives, information security requirements, its own processes, and the size, complexity and structure of the authority, all of which may change over time.

INTEGRATION OF ISMS UNDER THIS REGULATION WITH EXISTING MANAGEMENT SYSTEMS

A competent authority may take advantage of existing management systems when implementing an ISMS by integrating it with those existing systems.

By integrating the ISMS with existing management systems, the competent authority may reduce the effort and costs required to implement and maintain the ISMS, while also ensuring consistency and alignment with the authority’s overall management approach. Below is a non-exhaustive list of potential synergies that can be exploited when integrating the ISMS with an existing management system:

— Leverage existing policies and procedures: an authority may use its existing policies and procedures as a foundation for its ISMS. This may help to ensure consistency and minimise the need for additional documentation.

— Align the ISMS with other management systems: an authority may align the ISMS with other management systems, such as safety management systems (SMSs), to ensure that the ISMS is consistent with the authority’s overall management approach.

— Use existing risk management processes: an authority may use their existing risk management processes to identify and assess the information security risks potentially leading to aviation safety risks.

— Reuse existing controls: an authority may reuse existing controls, such as access controls or incident management process, to implement the information security controls required by the ISMS.

— Continuous improvement process: an authority may use the continuous improvement process of existing management systems to improve the ISMS over time.

Details

Source-Title: GM1 IS.AR.200(d) Information security management system (ISMS) View latest amendments

Erulesid: ERULES-1963177438-21701 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-IS.AR

Typeofcontent: GM to IR (Guidance material to implementing rule)

Parentir: IS.AR.200 Information security management system (ISMS)

Origin: EASA

Category: EAR