What specific resources are included in the audit scope when auditing a supplier contracted for Part-IS information security management activities?

The resources included in the audit scope are contracted organisation personnel, systems/equipment, and networks.

GM5 IS.AR.220 Contracting of information security management activities

Q: What should be the scope and objective of an authority's audit of a supplier contracted for information security management activities under Part-IS?

The scope and objective of the audit should be limited to processes, resources (i.e. contracted organisation personnel, systems/equipment, networks) and data used for the execution of Part-IS contracted activities.

Q: How should findings from an audit of a contracted information security management organisation be handled?

Findings identified during an audit should be addressed through a remediation plan with a time frame to be validated by the authority.

Q: At whose discretion are compliance and/or implementation audits of contracted information security management organisations performed?

Compliance and/or implementation audits should be done at the authority's discretion.

Navigate / EASA

Ask question Discover more Add to collection

GM5 IS.AR.220 Contracting of information security management activities

ED Decision 2023/010/R

AUDIT OF CONTRACTED ORGANISATIONS

The following aspects should be considered by the authority when auditing a supplier contracted to perform information security management activities:

— the scope of the audit as well as the objective should be limited to processes, resources (i.e. contracted organisation personnel, systems/equipment, networks) and data used for the execution of Part-IS contracted activities;

— compliance and/or implementation audits should be done at the authority’s discretion;

— findings identified during an audit should be addressed through a remediation plan with a time frame to be validated by the authority.

Details

Source-Title: GM5 IS.AR.220 Contracting of information security management activities View latest amendments

Erulesid: ERULES-1963177438-21692 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-IS.AR

Typeofcontent: GM to IR (Guidance material to implementing rule)

Parentir: IS.AR.220 Contracting of information security management activities

Origin: EASA

Category: EAR