What is the relationship between internal and external reporting for information security incidents and vulnerabilities?

Both internal and external reporting are necessary for a complete and effective reporting system. Organisations should collect and report internally incidents and vulnerabilities aiming at covering all items within the scope of the Regulation, and internal reports should be assessed in a timely manner. Where the potential impact on safety is an unsafe condition, organisations should initiate reporting of these internal reports according to IS.D.OR.230.

GM1 IS.D.OR.215(a)&(b) Information security internal reporting scheme

Q: How should internal reports be handled in terms of timeliness and assessment?

Internal reports should be assessed in a timely manner.

Navigate / EASA

Ask question Discover more Add to collection

GM1 IS.D.OR.215(a)&(b) Information security internal reporting scheme

ED Decision 2023/009/R

RELATIONSHIP BETWEEN INTERNAL AND EXTERNAL REPORTING

Organisations should collect and report internally incidents and vulnerabilities aiming at covering all items within the scope of this Regulation. Both internal and external reporting are necessary for a complete and effective reporting system. Internal reports should be assessed in a timely manner and where the potential impact on safety is an unsafe condition, organisations should initiate reporting of these internal reports according to IS.D.OR.230.

Details

Source-Title: GM1 IS.D.OR.215(a)&(b) Information security internal reporting scheme View latest amendments

Erulesid: ERULES-1963177438-21671 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/009/R Navigate

Regulatorysubject: Part-IS.D.OR

Typeofcontent: GM to DR

Origin: EASA

Category: EAR