Browse all sections of Information Security (2023/203 and 2022/1645) Part-IS (Dec 2025)

• GM1 IS.D.OR.245(a)(1)(vi)&(a)(5) Record-keeping
• AMC1 IS.I.OR.200(c) Information security management system (ISMS)
• GM2 IS.I.OR.215(a)&(b) Information security internal reporting scheme
• Article 11 - Amendment to Regulation (EU) No 139/2014
• IS.I.OR.225 Response to findings notified by the competent authority
• Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and the NIST CSF 2.0
• GM1 IS.D.OR.260(b) Continuous improvement
• Delegated Regulation (EU) 2022/1645
• GM2 IS.AR.205(d) Information security risk assessment
• GM1 IS.I.OR.200(a)(1) Information security management system (ISMS)
• AMC1 IS.AR.205(a) Information security risk assessment
• AMC1 IS.D.OR.200(a)(12) Information security management system (ISMS)
• GM1 IS.AR.225(b) Personnel requirements
• AMC1 IS.I.OR.220(a) Information security incidents -- detection, response and recovery
• AMC1 IS.AR.215(a) Information security incidents -- detection, response and recovery
• Appendix III -- Examples of aviation services and interfaces
• GM1 IS.AR.200(a)(1) Information security management system (ISMS)
• Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences
• GM1 IS.AR.200(a)(8) Information security management system (ISMS)
• AMC1 IS.I.OR.200(e) Information security management system (ISMS)
• List of acronyms and abbreviations
• GM1 IS.AR.210 Information security risk treatment
• GM1 IS.I.OR.205(a) Information security risk assessment
• GM1 IS.I.OR.240(i) Personnel requirements
• GM1 IS.D.OR.200 Information security management system (ISMS)
• AMC1 IS.I.OR.220(b) Information security incidents -- detection, response and recovery
• GM3 IS.AR.220 Contracting of information security management activities
• AMC1 IS.I.OR.200(a)(13) Information security management system (ISMS)
• GM1 IS.D.OR.230(a)&(b) Information security external reporting scheme
• GM1 IS.D.OR.240(a)(3) Personnel requirements
• GM1 IS.I.OR.200(c) Information security management system (ISMS)
• IS.D.OR.210 Information security risk treatment
• AMC1 IS.D.OR.215(a)&(b) Information security internal reporting scheme
• IS.I.OR.235 Contracting of information security management activities
• Article 4 - Requirements arising from other Union legislation
• Signature
• IS.D.OR.250 Information security management manual (ISMM)
• AMC1 IS.I.OR.240(b) Personnel requirements
• AMC1 IS.I.OR.200(a)(1) Information security management system (ISMS)
• Powers and recitals
• AMC1 IS.I.OR.205(c) Information security risk assessment
• Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences
• GM1 IS.AR.225(a) Personnel requirements
• Article 12 - Amendment to Regulation (EU) No 1321/2014
• AMC1 IS.D.OR.200(e) Information security management system (ISMS)
• GM1 IS.I.OR.205(c) Information security risk assessment
• Article 14 - Amendment to Regulation (EU) 2017/373
• Article 7 - Amendment to Regulation (EU) No 139/2014
• GM1 IS.AR.235 Continuous improvement
• AMC1 IS.I.OR.260(a) Continuous improvement
• GM1 IS.I.OR.230(a)&(b) Information security external reporting scheme
• GM1 IS.D.OR.240 Personnel requirements
• GM1 IS.I.OR.235(b) Contracting of information security management activities
• AMC1 IS.D.OR.220(c) Information security incidents -- detection, response and recovery
• GM1 IS.I.OR.205(d) Information security risk assessment
• IS.D.OR.205 Information security risk assessment
• AMC1 IS.I.OR.230(c) Information security external reporting scheme
• GM1 IS.D.OR.215(a)&(b) Information security internal reporting scheme
• AMC1 IS.I.OR.240(a)(3) Personnel requirements
• GM1 IS.D.OR.220(b) Information security incidents -- detection, response and recovery
• IS.D.OR.240 Personnel requirements
• GM1 Article 1 -- Subject matter
• GM1 IS.I.OR.260(a) Continuous improvement
• GM5 IS.AR.220 Contracting of information security management activities
• AMC1 IS.I.OR.220(c) Information security incidents -- detection, response and recovery
• GM1 IS.I.OR.240(f) Personnel requirements
• AMC1 IS.I.OR.245(c)&(d) Record-keeping
• GM2 IS.I.OR.255 Changes to the information security management system
• AMC1 IS.I.OR.215(a)&(b) Information security internal reporting scheme
• GM1 IS.D.OR.240(f) Personnel requirements
• GM1 IS.D.OR.230 Information security external reporting scheme
• AMC1 IS.I.OR.245(a)(1)(vi)&(a)(5) Record-keeping
• AMC1 IS.I.OR.260(b) Continuous improvement
• Appendix V -- Proportionality considerations related to safety relevance and aspects of complexity
• GM1 IS.I.OR.255 Changes to the information security management system
• IS.AR.205 Information security risk assessment
• 5378459906000GM1 IS.D.OR.220(c) Information security incidents -- detection, response and recovery
• GM1 IS.AR.205(c) Information security risk assessment
• AMC1 IS.D.OR.240(b) Personnel requirements
• AMC1 IS.I.OR.240(a)(2) Personnel requirements
• Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and the NIST CSF 2.0
• Article 5 - Competent authority
• Article 1 - Subject matter
• Article 16
• GM1 IS.I.OR.220(b) Information security incidents -- detection, response and recovery
• Appendix V -- Proportionality considerations related to indicators of complexity
• ANNEX VII -- INFORMATION SECURITY -- Annexes II (Part-145), III (Part-66) and Vc (Part-CAMO) to Regulation (EU) No 1321/2014
• Appendix I -- Examples of threat scenarios with a potential harmful impact on safety
• AMC1 IS.D.OR.200(a)(1) Information security management system (ISMS)
• AMC1 IS.AR.225(e) Personnel requirements
• GM1 IS.D.OR.240(g) Personnel requirements
• AMC1 IS.AR.235 Continuous improvement
• AMC1 IS.D.OR.240(i) Personnel requirements
• AMC1 IS.D.OR.205(d) Information security risk assessment
• GM1 IS.I.OR.240(b)&(c) Personnel requirements
• GM1 IS.AR.235(a) Continuous improvement
• GM1 Article 6(2) Competent authority
• GM1 IS.I.OR.200(e) Information security management system (ISMS)
• GM1 IS.D.OR.240(b) Personnel requirements
• GM1 IS.I.OR.245(c)&(d) Record-keeping
• IS.I.OR.210 Information security risk treatment
• GM1 IS.I.OR.215(a)&(b) Information security internal reporting scheme
• AMC1 IS.I.OR.240(d) Personnel requirements
• AMC1 IS.D.OR.205(b) Information security risk assessment
• IS.I.OR.100 Scope
• IS.I.OR.245 Record-keeping
• AMC1 IS.D.OR.245(a)(1)(vi)&(a)(5) Record-keeping
• ANNEX II -- INFORMATION SECURITY -- ORGANISATION REQUIREMENTS [PART-IS.I.OR]
• IS.D.OR.245 Record-keeping
• AMC1 IS.D.OR.230(c) Information security external reporting scheme
• GM1 IS.AR.230(a)(1)(iv)&(a)(4) Record-keeping
• GM1 Article 5(2) Competent authority
• AMC1 IS.AR.215(b) Information security incidents -- detection, response and recovery
• GM1 IS.AR.215(a) Information security incidents -- detection, response and recovery
• AMC1 IS.AR.205(c) Information security risk assessment
• AMC1 IS.D.OR.260 Continuous improvement
• AMC1 IS.AR.215(c) Information security incidents -- detection, response and recovery
• GM1 IS.AR.235(b) Continuous improvement
• GM4 IS.AR.220 Contracting of information security management activities
• GM1 IS.I.OR.230(c) Information security external reporting scheme
• IS.AR.220 Contracting of information security management activities
• IS.D.OR.255 Changes to the information security management system
• GM2 IS.I.OR.205(b) Information security risk assessment
• IS.AR.100 Scope
• Article 3 - Definitions
• GM1 IS.I.OR.245 Record-keeping
• GM1 Article 5(1) Requirements arising from other Union legislation
• IS.D.OR.215 Information security internal reporting scheme
• Article 13 - Amendment to Regulation (EU) 2015/340
• ANNEX VI -- INFORMATION SECURITY -- Annex II (Part-ADR.AR) to Regulation (EU) No 139/2014
• Appendix VI -- Adaptation of the EU Cybersecurity Skills Framework (ECSF)
• Article 4 - Requirements for organisations and competent authorities
• Article 2 - Scope
• AMC1 IS.I.OR.205(d) Information security risk assessment
• Article 9 - Amendment to Regulation (EU) No 748/2012
• AMC1 IS.AR.200(a)(8) Information security management system (ISMS)
• GM1 IS.AR.230 Record-keeping
• GM2 IS.I.OR.235 Contracting of information security management activities
• IS.AR.225 Personnel requirements
• AMC1 IS.I.OR.205(e) Information security risk assessment
• AMC1 IS.I.OR.205(a) Information security risk assessment
• AMC1 IS.I.OR.235(a) Contracting of information security management activities
• IS.AR.210 Information security risk treatment
• GM3 IS.I.OR.235 Contracting of information security management activities
• GM1 IS.D.OR.235(b) Contracting of information security management activities
• GM1 IS.AR.215 Information security incidents -- detection, response and recovery
• GM1 Article 3 -- Definitions
• AMC1 IS.I.OR.205(b) Information security risk assessment
• IS.I.OR.220 Information security incidents -- detection, response and recovery
• IS.D.OR.230 Information security external reporting scheme
• GM1 IS.D.OR.240(i) Personnel requirements
• Article 5 - Requirements arising from other Union legislation
• Table of Contents
• AMC1 IS.D.OR.220(b) Information security incidents -- detection, response and recovery
• GM1 IS.D.OR.220(b)&(c) Information security incidents -- detection, response and recovery
• GM1 IS.I.OR.245(a)(1)(vi)&(a)(5) Record-keeping
• AMC1 IS.D.OR.230(a)&(b) Information security external reporting scheme
• GM1 IS.I.OR.260(b) Continuous improvement
• GM1 IS.I.OR.235(a) Contracting of information security management activities
• GM1 IS.D.OR.200(a)(12) Information security management system (ISMS)
• AMC1 IS.AR.230(a)(1)(iv)&(a)(4) Record-keeping
• AMC1 IS.D.OR.260(a) Continuous improvement
• GM1 IS.D.OR.260(a) Continuous improvement
• AMC1 IS.D.OR.235(a) Contracting of information security management activities
• IS.I.OR.205 Information security risk assessment
• GM1 IS.D.OR.200(c) Information security management system (ISMS)
• GM1 IS.AR.225(c) Personnel requirements
• Incorporated amendments
• AMC1 IS.D.OR.255 Changes to the information security management system
• EASA eRules
• GM2 IS.D.OR.205(d) Information security risk assessment
• AMC1 IS.AR.210(a) Information security risk treatment
• Appendix I -- Examples of threat scenarios with a potential harmful impact on safety
• IS.I.OR.240 Personnel requirements
• AMC1 IS.AR.200(a)(1) Information security management system
• Appendix VI -- Adaptation of the EU Cybersecurity Skills Framework (ECSF)
• GM1 Article 1 -- Subject matter
• GM1 IS.D.OR.245(c)&(d) Record-keeping
• GM1 IS.I.OR.220(a) Information security incidents -- detection, response and recovery
• GM1 IS.AR.225(d) Personnel requirements
• Disclaimer
• Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and NIST CSF 2.0
• ANNEX V -- INFORMATION SECURITY -- Annexes II (Part-ARO) and III (Part-ORO) to Regulation (EU) No 965/2012
• AMC1 IS.AR.235(b) Continuous improvement
• GM2 IS.AR.220 Contracting of information security management activities
• GM1 IS.I.OR.220(c) Information security incidents -- detection, response and recovery
• GM1 IS.I.OR.240(e) Personnel requirements
• ANNEX IX -- INFORMATION SECURITY -- Annexes II (Part-ATM/ANS.AR) and III (Part-ATM/ANS.OR) to Implementing Regulation (EU) 2017/373
• GM1 IS.I.OR.200(a)(12) Information security management system (ISMS)
• EXPLANATORY MEMORANDUM
• Article 1 - Subject matter
• GM1 IS.I.OR.200(d) Information security management system (ISMS)
• GM1 IS.D.OR.220 Information security incidents -- detection, response and recovery
• GM1 IS.AR.205(b) Information security risk assessment
• GM1 IS.I.OR.250(a) Information security management manual (ISMM)
• AMC1 IS.AR.230(c)&(d) Record-keeping
• AMC1 IS.I.OR.240(h) Personnel requirements
• GM1 IS.D.OR.205(b) Information security risk assessment
• AMC1 IS.I.OR.260 Continuous improvement
• ANNEX I -- INFORMATION SECURITY -- AUTHORITY REQUIREMENTS [PART-IS.AR]
• IS.D.OR.100 Scope
• AMC1 IS.AR.225(c) Personnel requirements
• IS.I.OR.200 Information security management system (ISMS)
• GM1 Article 4(2) Requirements arising from other Union legislation
• ANNEX III -- INFORMATION SECURITY -- ANNEXES VI (Part-ARA) and VII (Part-ORA) to Regulation (EU) No 1178/2011
• GM1 IS.D.OR.240(e) Personnel requirements
• GM2 IS.I.OR.235(a) Contracting of information security management activities
• GM1 IS.AR.205(a) Information security risk assessment
• GM1 IS.D.OR.230(c) Information security external reporting scheme
• IS.AR.230 Record-keeping
• GM1 Article 4(1) Requirements arising from other Union legislation
• AMC1 IS.AR.225(b) Personnel requirements
• GM1 IS.AR.225(e) Personnel requirements
• IS.AR.200 Information security management system (ISMS)
• GM1 IS.I.OR.230 Information security external reporting scheme
• Cover Regulation to Delegated Regulation (EU) 2022/1645
• Article 3 - Definitions
• Note from the editor
• GM1 IS.I.OR.240(c) Personnel requirements
• AMC1 IS.D.OR.235(b) Contracting of information security management activities
• GM1 IS.I.OR.210 Information security risk treatment
• GM1 IS.I.OR.225 Response to findings notified by the competent authority
• Article 10 - Amendment to Regulation (EU) No 965/2012
• AMC1 IS.D.OR.210(a) Information security risk treatment
• AMC1 IS.I.OR.200(a)(12) Information security management system (ISMS)
• GM1 IS.AR.200(c) Information security management system (ISMS)
• Signature
• GM3 IS.D.OR. 215(a)&(b) Information security internal reporting scheme
• GM1 IS.D.OR.235 Contracting of information security management activities
• GM2 IS.AR.205(b) Information security risk assessment
• AMC1 IS.AR.200(c) Information security management system (ISMS)
• GM1 IS.I.OR.260 Continuous improvement
• Article 8
• AMC1 IS.D.OR.205(c) Information security risk assessment
• GM1 IS.D.OR.240(b)&(c) Personnel requirements
• IS.I.OR.260 Continuous improvement
• GM1 IS.I.OR.240 Personnel requirements
• GM1 IS.I.OR.200 Information security management system (ISMS)
• AMC1 IS.AR.200(a)(11) Information security management system (ISMS)
• AMC1 IS.AR.235(a) Continuous improvement
• AMC1 IS.AR.220 Contracting of information security management activities
• GM1 IS.D.OR.240(c) Personnel requirements
• IS.I.OR.250 Information security management manual (ISMM)
• AMC1 IS.I.OR.240(i) Personnel requirements
• GM1 IS.I.OR.205(b) Information security risk assessment
• Implementing Regulation (EU) 2023/203
• GM1 IS.I.OR.220(b)&(c) Information security incidents -- detection, response and recovery
• Powers and recitals
• GM1 IS.AR.200(d) Information security management system (ISMS)
• GM1 IS.D.OR.225 Response to findings notified by the competent authority
• IS.AR.235 Continuous improvement
• ANNEX -- INFORMATION SECURITY -- ORGANISATION REQUIREMENTS [PART-IS.D.OR]
• GM1 IS.D.OR.205(a) Information security risk assessment
• AMC1 IS.I.OR.240(f) Personnel requirements
• AMC1 IS.D.OR.200(c) Information security management system (ISMS)
• AMC1 IS.D.OR.260(b) Continuous improvement
• AMC1 IS.D.OR.240(h) Personnel requirements
• AMC1 IS.I.OR.255 Changes to the information security management system
• GM1 IS.D.OR.240(h) Personnel requirements
• GM1 IS.AR.220 Contracting of information security management activities
• GM1 IS.AR.200 Information security management system (ISMS)
• AMC1 IS.D.OR.245(c)&(d) Record-keeping
• GM1 IS.I.OR.215(c) Information security internal reporting scheme
• GM3 IS.D.OR.235 Contracting of information security management activities
• IS.I.OR.255 Changes to the information security management system
• IS.I.OR.215 Information security internal reporting scheme
• Article 7 - Submission of relevant information to NIS competent authorities
• AMC1 IS.AR.205(d) Information security risk assessment
• GM1 IS.D.OR.215(c) Information security internal reporting scheme
• GM1 IS.D.OR.200(d) Information security management system (ISMS)
• GM1 Article 5(2) Requirements arising from other Union legislation
• GM1 IS.D.OR.205(d) Information security risk assessment
• 5378459906000GM1 IS.AR.215(c) Information security incidents-- detection, response and recovery
• GM1 IS.I.OR.215(d) Information security internal reporting scheme
• Appendix III -- Examples of aviation services and interfaces
• GM3 IS.I.OR.215(a)&(b) Information security internal reporting scheme
• AMC1 IS.D.OR.220(a) Information security incidents -- detection, response and recovery
• AMC1 IS.I.OR.225 Response to findings notified by the competent authority
• GM1 IS.D.OR.220(a) Information security incidents -- detection, response and recovery
• GM1 IS.AR.205(d) Information security risk assessment
• IS.AR.215 Information security incidents -- detection, response and recovery
• GM1 IS.D.OR.205 Information security risk assessment
• GM1 IS.D.OR.215(d) Information security internal reporting scheme
• GM1 IS.AR.205 Information security risk assessment
• GM2 IS.D.OR.235 Contracting of information security management activities
• IS.D.OR.225 Response to findings notified by the competent authority
• AMC1 IS.D.OR.240(g) Personnel requirements
• Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences
• GM1 IS.I.OR.240(b) Personnel requirements
• AMC1 IS.D.OR.240(d) Personnel requirements
• AMC1 IS.AR.225(a) Personnel requirements
• AMC1 IS.AR.200(a)(9) Information security management system (ISMS)
• GM1 IS.D.OR.200(a)(1) Information security management system (ISMS)
• Appendix I -- Examples of threat scenarios with a potential harmful impact on safety
• GM2 IS.D.OR.215(a)&(b) Information security internal reporting scheme
• ANNEX VIII -- INFORMATION SECURITY -- Annexes II (Part ATCO.AR) and III (Part ATCO.OR) to Regulation (EU) 2015/340
• GM1 IS.AR.225 Personnel requirements
• Article 15 - Amendment to Regulation (EU) 2021/664
• AMC1 IS.D.OR.225 Response to findings notified by the competent authority
• GM1 IS.I.OR.240(h) Personnel requirements
• GM1 IS.D.OR.210 Information security risk treatment
• Cover Regulation to Implementing Regulation (EU) 2023/203
• GM2 IS.D.OR.235(a) Contracting of information security management activities
• GM1 IS.I.OR.205(e) Information security risk assessment
• IS.D.OR.220 Information security incidents -- detection, response and recovery
• Appendix III -- Examples of aviation services and interfaces
• Article 6 - Competent authority
• AMC1 IS.I.OR.230(a)&(b) Information security external reporting scheme
• GM1 IS.I.OR.240(g) Personnel requirements
• GM2 IS.D.OR.255 Changes to the information security management system
• IS.I.OR.230 Information security external reporting scheme
• ANNEX IV -- INFORMATION SECURITY -- Annex I (Part 21) to Regulation (EU) No 748/2012
• GM1 IS.I.OR.240(a)(3) Personnel requirements
• GM1 IS.AR.215(b)&(c) Information security incidents -- detection, response and recovery
• GM1 Article 3 -- Definitions
• GM1 IS.D.OR.260 Continuous improvement
• AMC1 IS.D.OR.240(a)(2) Personnel requirements
• GM1 IS.D.OR.255 Changes to the information security management system
• GM1 IS.I.OR.235 Contracting of information security management activities
• GM1 IS.AR.230(c)&(d) Record-keeping
• Article 2 - Scope
• GM1 IS.D.OR.205(c) Information security risk assessment
• GM1 IS.I.OR.205 Information security risk assessment
• GM1 IS.I.OR.220 Information security incidents -- detection, response and recovery
• Article 6 - Amendment to Regulation (EU) No 748/2012
• GM1 IS.D.OR.200(e) Information security management system (ISMS)
• AMC1 IS.AR.205(b) Information security risk assessment
• AMC1 IS.D.OR.240(f) Personnel requirements
• IS.D.OR.260 Continuous improvement
• GM1 IS.AR.215(b) Information security incidents -- detection, response and recovery
• GM1 IS.D.OR.235(a) Contracting of information security management activities
• GM2 IS.D.OR.205(b) Information security risk assessment
• AMC1 IS.I.OR.210(a) Information security risk treatment
• AMC1 IS.D.OR.240(a)(3) Personnel requirements
• GM1 IS.D.OR.250(a) Information security management manual (ISMM)
• AMC1 IS.I.OR.240(g) Personnel requirements
• Article 8 - Amendment to Regulation (EU) No 1178/2011
• AMC1 IS.I.OR.235(b) Contracting of information security management activities
• AMC1 IS.D.OR.200(a)(13) Information security management system (ISMS)
• AMC1 IS.AR.225(d) Personnel requirements
• List of revisions
• GM1 IS.D.OR.245 Record-keeping
• AMC1 IS.D.OR.205(a) Information security risk assessment
• IS.D.OR.200 Information security management system (ISMS)
• GM2 IS.I.OR.205(d) Information security risk assessment
• IS.D.OR.235 Contracting of information security management activities