How should corrective actions be determined for eliminating the root cause(s) of a deficiency?

They should be proportionate to the consequences of the deficiency.

What must be done after implementing actions to address a deficiency, to ensure no further risk is introduced?

The elements of the ISMS which may be affected by the implemented actions must be reassessed to ensure that no further risk is introduced.

Who should the outcomes of the process steps be reported to and reviewed with?

The management, as per point (d) of AMC1 IS.I.OR.260(b).

What is required regarding documentation of the improvement process steps?

The result of the process steps must be documented and evidenced, as per point (e) of AMC1 IS.I.OR.260(b).

GM1 IS.I.OR.260(b) Continuous improvement

Q: What is the purpose of the 'necessary improvement measures' mentioned in IS.I.OR.260(b)?

They refer to correction or corrective actions to eliminate deficiencies or actions aimed at improving the effectiveness as well as the maturity of the ISMS.

Q: According to GM1 IS.I.OR.260(b), what should a process satisfying the criteria in AMC1 IS.I.OR.260 include as a first step?

It should include identifying the extent, impact, context and triggers of the deficiency, evaluating it according to some established criteria, and analysing potential consequences for the ISMS including a potential existence in other areas.

Q: What is the purpose of deciding on corrections and their implementation in the improvement process?

To immediately limit the impact and manage the consequences of the deficiency as well as, as applicable, to control or eliminate it.

Q: Which step in the improvement process involves verifying the implemented actions?

Verifying the implemented actions referred to in point (c) of AMC1 IS.I.OR.260(b) is step (e) of the process.

Navigate / EASA

Ask question Discover more Add to collection

GM1 IS.I.OR.260(b) Continuous improvement

ED Decision 2023/009/R

The ‘necessary improvement measures’ referred to in IS.I.OR.260(b) refer to correction or corrective actions to eliminate deficiencies or actions aimed at improving the effectiveness as well as the maturity of the ISMS.

A process satisfying the criteria defined in AMC1 IS.I.OR.260 should include the following aspects:

(a) identifying the extent, impact, context and triggers of the deficiency, evaluating it according to some established criteria, analysing potential consequences for the ISMS including a potential existence in other areas;

(b) deciding on corrections and their implementation to immediately limit the impact and manage the consequences of the deficiency as well as, as applicable, to control or eliminate it;

(c) deciding on corrective actions required to eliminate the (root) cause(s) of the deficiency that are proportionate to the consequences;

(d) reassessing the elements of the ISMS which may be affected by the implemented actions to ensure that no further risk is introduced;

(e) verifying the implemented actions referred to in point (c) of AMC1 IS.I.OR.260(b);

(f) reporting to and reviewing the outcomes of the process steps with the management (see point (d) of AMC1 IS.I.OR.260(b));

(g) documenting and evidencing the result of the process steps above (see point (e) of AMC1 IS.I.OR.260(b)).

Details

Source-Title: GM1 IS.I.OR.260(b) Continuous improvement View latest amendments

Erulesid: ERULES-1963177438-21829 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/009/R Navigate

Regulatorysubject: Part-IS.I.OR

Typeofcontent: GM to IR (Guidance material to implementing rule)

Parentir: IS.I.OR.260 Continuous improvement

Origin: EASA

Category: EAR