What should an organisation develop to understand the scope of its ISMS and the boundaries for the information security risk assessment?

The organisation should develop a clear and comprehensive understanding of its aviation activities and services, the related processes and associated information systems, and the relevant data flows and information exchanges that define the scope of the ISMS and the boundaries for risk assessment. It should also develop corresponding documentation on resources and dependencies related to computing, networking and contracted services which have the potential to affect the information security and safety of the functions, services, or capabilities within the scope of the risk assessment.

What is the purpose of identifying operational inputs and outputs relevant to the organisation's functions, services and capabilities?

The purpose is to establish understanding of all relevant assets, resources and dependencies that are directly a part of the functions, services and capabilities. This identification can include internal or external sources, and internal or external leased or managed services, or other dependencies.

What is the non-exhaustive list of activities provided for the identification of the scope and boundaries of the risk assessment?

The non-exhaustive list includes: (a) identification of operational inputs and outputs relevant to the functions, services and capabilities; (b) identification of all relevant assets used to create, process, transmit, store or receive those inputs and outputs; (c) identification of the operating environments and locations for all relevant assets; and (d) for each asset, identification of the specific methods, processes and resources used to manage, operate and maintain it throughout its life cycle.

Which sources can operational inputs and outputs relevant to the organisation's functions, services and capabilities be related to?

They can be related to internal or external sources, and internal or external leased or managed services, or other dependencies.

GM1 IS.D.OR.205(a) Information security risk assessment

Q: Which items should be identified for each asset included in the scope of the information security risk assessment?

For each asset included in the scope, the organisation should identify the specific methods, processes and resources that will be used to manage, operate and maintain each asset throughout its life cycle, including internal or contracted resources, and contracted companies remotely managing the assets (i.e. provider of managed services).

Q: What types of assets should be identified as part of the scope and boundaries of the ISMS risk assessment?

The organisation should identify all relevant assets (i.e. hardware, software, network and computing resources) used to create, process, transmit, store or receive the operational inputs and outputs relevant to the functions, services and capabilities of the organisation.

Q: What should be identified regarding the operating environments and locations for all relevant assets?

The organisation should identify the operating environments (e.g. office, public access area, access-controlled room etc.) and locations for all relevant assets.

Q: Which documentation should the organisation develop to define the scope of the ISMS and the boundaries for risk assessment?

The organisation should develop corresponding documentation on resources and dependencies related to computing, networking and contracted services which have the potential to affect the information security and safety of the functions, services, or capabilities within the scope of the risk assessment.

Navigate / EASA

Ask question Discover more Add to collection

GM1 IS.D.OR.205(a) Information security risk assessment

ED Decision 2023/009/R

SCOPE AND BOUNDARIES IDENTIFICATION

The organisation should develop clear and comprehensive understanding of its aviation activities and services, the related processes and associated information systems, and the relevant data flows and information exchanges that define the scope of the ISMS and the boundaries for risk assessment. Therefore, the organisation should develop corresponding documentation on resources and dependencies related to computing, networking and contracted services which have the potential to affect the information security and safety of the functions, services, or capabilities within the scope of the risk assessment.

The following non-exhaustive list provides examples of items that may be considered for the identification of the aforementioned scope and boundaries. The level of detail of the analysis can be an iterative process, with the effort commensurate with the expected level of risk. As stated above, the purpose is to establish understanding of all relevant assets, resources and dependencies that are directly a part of the functions, services and capabilities through the following activities:

(a) Identification of operational inputs and outputs relevant to the functions, services and capabilities of the organisation; these can be related to:

— Internal or external sources;

— internal or external leased or managed services, or other dependencies;

(b) Identification of all relevant assets (i.e. hardware, software, network and computing resources) used to create, process, transmit, store or receive the aforementioned operational inputs and outputs;

(c) Identification of the operating environments (e.g. office, public access area, access-controlled room etc.) and locations for all relevant assets;

(d) For each asset included in the scope, identification of the specific methods, processes and resources that will be used to manage, operate and maintain each asset throughout its life cycle, including:

— internal or contracted resources;

— contracted companies remotely managing the assets (i.e. provider of managed services).

Details

Source-Title: GM1 IS.D.OR.205(a) Information security risk assessment View latest amendments

Erulesid: ERULES-1963177438-21635 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/009/R Navigate

Regulatorysubject: Part-IS.D.OR

Typeofcontent: GM to DR

Origin: EASA

Category: EAR