What is the subject matter of Implementing Regulation (EU) 2023/203?

The subject matter is defined in Article 1 of the Implementing Regulation, which is listed in the table of contents. The specific content is not provided in the section text, but the regulation covers information security requirements for aviation.

Which articles of Implementing Regulation (EU) 2023/203 amend other regulations?

Articles 8 through 15 amend Regulation (EU) No 1178/2011, Regulation (EU) No 748/2012, Regulation (EU) No 965/2012, Regulation (EU) No 139/2014, Regulation (EU) No 1321/2014, Regulation (EU) 2015/340, Regulation (EU) 2017/373, and Regulation (EU) 2021/664 respectively.

What is the scope of Part-IS.AR (Authority Requirements) as indicated in the table of contents?

Part-IS.AR is Annex I to Implementing Regulation (EU) 2023/203, titled 'INFORMATION SECURITY -- AUTHORITY REQUIREMENTS'. It includes requirements for competent authorities, such as establishing an information security management system (ISMS), conducting risk assessments, and managing incidents.

What are the main sections under Part-IS.AR (Authority Requirements)?

The main sections under Part-IS.AR include: IS.AR.100 (Scope), IS.AR.200 (Information security management system), IS.AR.205 (Information security risk assessment), IS.AR.210 (Information security risk treatment), IS.AR.215 (Information security incidents -- detection, response and recovery), IS.AR.220 (Contracting of information security management activities), IS.AR.225 (Personnel requirements), IS.AR.230 (Record-keeping), and IS.AR.235 (Continuous improvement).

What is the scope of Part-IS.I.OR (Organisation Requirements) as indicated in the table of contents?

Part-IS.I.OR is Annex II to Implementing Regulation (EU) 2023/203, titled 'INFORMATION SECURITY -- ORGANISATION REQUIREMENTS'. It applies to organisations and includes requirements for establishing an ISMS, risk assessment, incident reporting, and personnel training.

Which annexes to Regulation (EU) No 965/2012 are amended by Implementing Regulation (EU) 2023/203?

Annex V to Implementing Regulation (EU) 2023/203 amends Annexes II (Part-ARO) and III (Part-ORO) to Regulation (EU) No 965/2012, which concern air operations.

What is the scope of Part-IS.D.OR (Organisation Requirements for design organisations) as indicated in the table of contents?

Part-IS.D.OR is the Annex to Delegated Regulation (EU) 2022/1645, titled 'INFORMATION SECURITY -- ORGANISATION REQUIREMENTS'. It applies to design organisations and includes requirements similar to Part-IS.I.OR, such as ISMS, risk assessment, and incident reporting.

Which annexes to Regulation (EU) No 1178/2011 are amended by Implementing Regulation (EU) 2023/203?

Annex III to Implementing Regulation (EU) 2023/203 amends Annexes VI (Part-ARA) and VII (Part-ORA) to Regulation (EU) No 1178/2011, which concern aircrew requirements.

Which annex to Regulation (EU) No 748/2012 is amended by Implementing Regulation (EU) 2023/203?

Annex IV to Implementing Regulation (EU) 2023/203 amends Annex I (Part 21) to Regulation (EU) No 748/2012, which concerns airworthiness and environmental certification.

Which annex to Regulation (EU) No 139/2014 is amended by Implementing Regulation (EU) 2023/203?

Annex VI to Implementing Regulation (EU) 2023/203 amends Annex II (Part-ADR.AR) to Regulation (EU) No 139/2014, which concerns aerodromes.

What is the subject matter of Delegated Regulation (EU) 2022/1645?

The subject matter is defined in Article 1 of the Delegated Regulation, which is listed in the table of contents. The specific content is not provided in the section text, but it covers information security requirements for design organisations.

Which regulations are amended by Delegated Regulation (EU) 2022/1645?

Article 6 amends Regulation (EU) No 748/2012 and Article 7 amends Regulation (EU) No 139/2014, as indicated in the table of contents.

What appendices are included in Part-IS.AR (Authority Requirements)?

The appendices include: Appendix I -- Examples of threat scenarios with a potential harmful impact on safety, Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and the NIST CSF 2.0, Appendix III -- Examples of aviation services and interfaces, and Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences.

What appendices are included in Part-IS.I.OR (Organisation Requirements)?

The appendices include: Appendix I -- Examples of threat scenarios with a potential harmful impact on safety, Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and NIST CSF 2.0, Appendix III -- Examples of aviation services and interfaces, Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences, Appendix V -- Proportionality considerations related to indicators of complexity, and Appendix VI -- Adaptation of the EU Cybersecurity Skills Framework (ECSF).

What appendices are included in Part-IS.D.OR (Organisation Requirements for design organisations)?

The appendices include: Appendix I -- Examples of threat scenarios with a potential harmful impact on safety, Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and the NIST CSF 2.0, Appendix III -- Examples of aviation services and interfaces, Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences, Appendix V -- Proportionality considerations related to safety relevance and aspects of complexity, and Appendix VI -- Adaptation of the EU Cybersecurity Skills Framework (ECSF).

The main sections under Part-IS.I.OR include: IS.I.OR.100 (Scope), IS.I.OR.200 (Information security management system), IS.I.OR.205 (Information security risk assessment), IS.I.OR.210 (Information security risk treatment), IS.I.OR.215 (Information security internal reporting scheme), IS.I.OR.220 (Information security incidents -- detection, response and recovery), IS.I.OR.225 (Response to findings notified by the competent authority), IS.I.OR.230 (Information security external reporting scheme), IS.I.OR.235 (Contracting of information security management activities), IS.I.OR.240 (Personnel requirements), IS.I.OR.245 (Record-keeping), IS.I.OR.250 (Information security management manual), IS.I.OR.255 (Changes to the information security management system), and IS.I.OR.260 (Continuous improvement).

Q: What are the main sections under Part-IS.D.OR (Organisation Requirements for design organisations)?

The main sections under Part-IS.D.OR include: IS.D.OR.100 (Scope), IS.D.OR.200 (Information security management system), IS.D.OR.205 (Information security risk assessment), IS.D.OR.210 (Information security risk treatment), IS.D.OR.215 (Information security internal reporting scheme), IS.D.OR.220 (Information security incidents -- detection, response and recovery), IS.D.OR.225 (Response to findings notified by the competent authority), IS.D.OR.230 (Information security external reporting scheme), IS.D.OR.235 (Contracting of information security management activities), IS.D.OR.240 (Personnel requirements), IS.D.OR.245 (Record-keeping), IS.D.OR.250 (Information security management manual), IS.D.OR.255 (Changes to the information security management system), and IS.D.OR.260 (Continuous improvement).

Table of contents

Details