To which authority must a design organisation approved by EASA report information security occurrences?

EASA is the competent authority for design organisations approved by EASA, so they must report to EASA.

If an air operator holds two AOCs under two different EU Member States, how are information security occurrences reported for aircraft under each AOC?

Occurrences involving aircraft operating under the State A AOC must be reported to the State A competent authority, and occurrences involving aircraft operating under the State B AOC must be reported to the State B competent authority.

What is the reporting requirement for an organisation holding multiple approvals when an information security incident or vulnerability affects more than one approval?

The reporting must be done to all the competent authorities of the affected approvals.

Which authority is responsible for receiving information security reports from an organisation that holds an approval but operates outside the EU, such as a Part-145 organisation?

EASA is the competent authority for such organisations, and they must report to the Agency.

What must be done to information reported through the civil reporting system for a dual-use aircraft vulnerability?

Information reported through the civil reporting system should be sanitised, meaning all sensitive information should be properly removed.

GM1 IS.I.OR.230 Information security external reporting scheme

Q: For an organisation holding multiple approvals, to which authority must an information security incident be reported if the incident affects only one approved part?

The reporting must be done to the competent authority of the approved part of the organisation where the incident has occurred or the vulnerability has been discovered.

Q: In the case of a dual-use aircraft, when must a vulnerability be reported through both military and civil reporting systems?

A vulnerability may need to be reported through both the military and civil reporting systems if it affects a dual-use function or system.

Navigate / EASA

Ask question Discover more Add to collection

GM1 IS.I.OR.230 Information security external reporting scheme

ED Decision 2023/009/R

Organisations are required to report occurrences to their competent authority.

EXAMPLES

Design organisations approved by EASA: EASA is the competent authority.

Air operators certified by the competent authority of a Member State: the competent authority of the Member State is the competent authority.

SPECIAL CASES

In a situation where an organisation has two air operator certificates (AOCs) under two different EU Member States (State A and B), the occurrences involving aircraft operating under the State A AOC have to be reported to the State A competent authority; instead, the occurrences involving aircraft operating under the State B AOC have to be reported to the State B competent authority.

For organisations holding multiple approvals, the reporting will be done to the competent authority of the approved part of the organisation where the incident has occurred, or the vulnerability has been discovered. In case the incident/vulnerability affects multiple approvals, the reporting will be done to all the competent authorities.

For organisations holding an approval but operating outside the EU (e.g. Part-145), EASA is the competent authority and they have to report to the Agency.

Dual-use aircraft — a vulnerability may need to be reported through both the military and civil reporting systems if it affects a dual-use function/system. Information reported through the civil reporting system should be sanitised (i.e. all sensitive information should be properly removed).

Details

Source-Title: GM1 IS.I.OR.230 Information security external reporting scheme View latest amendments

Erulesid: ERULES-1963177438-21785 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/009/R Navigate

Regulatorysubject: Part-IS.I.OR

Typeofcontent: GM to IR (Guidance material to implementing rule)

Parentir: IS.I.OR.230 Information security external reporting scheme

Origin: EASA

Category: EAR