What steps must the competent authority take when an organisation applies for approval of a change to the information security management system under point IS.D.OR.255(b) of Part-IS.D.OR?

Upon receiving the application, the competent authority shall check the organisation's compliance with the applicable requirements before issuing the approval, establish the conditions under which the organisation may operate during the implementation of the change, and if satisfied that the organisation complies, approve the change.

What is the applicable date for point 21.B.435A on changes to the information security management system?

Point 21.B.435A is applicable from 22 February 2026, according to Regulation (EU) 2023/203.

If a non-compliance is found during the review of a notified change to the information security management system, what actions must the competent authority take?

The competent authority shall notify the organisation of the non-compliance, request further changes, and act in accordance with point 21.B.433.

Under what condition will the competent authority approve a change to the information security management system that requires an application for approval?

The competent authority shall approve the change if it is satisfied that the organisation complies with the applicable requirements.

21.B.435A Changes to the information security management system

Q: How should the competent authority handle a change to the information security management system that was notified under the procedure in point IS.D.OR.255(a) of Part-IS.D.OR?

The competent authority shall include the review of such changes in its continuing oversight in accordance with the principles laid down in point 21.B.431. If any non-compliance is found, the competent authority shall notify the organisation thereof, request further changes and act in accordance with point 21.B.433.

Q: For changes to the information security management system that require an application for approval, what must the competent authority do before issuing the approval?

The competent authority shall check the organisation's compliance with the applicable requirements before issuing the approval.

Q: What conditions must the competent authority establish for a change to the information security management system that requires an application for approval?

The competent authority shall establish the conditions under which the organisation may operate during the implementation of the change.

Navigate / EASA

Ask question Discover more Add to collection

21.B.435A Changes to the information security management system

Regulation (EU) 2023/203

(a) For changes managed and notified to the competent authority in accordance with the procedure set out in point IS.D.OR.255(a) of the Annex (Part‑IS.D.OR) to Delegated Regulation (EU) 2022/1645, the competent authority shall include the review of such changes in its continuing oversight in accordance with the principles laid down in point 21.B.431. If any non-compliance is found, the competent authority shall notify the organisation thereof, request further changes and act in accordance with point 21.B.433.

(b) For other changes requiring an application for approval in accordance with point IS.D.OR.255(b) of the Annex (Part‑IS.D.OR) to Delegated Regulation (EU) 2022/1645:

(1) upon receiving the application for the change, the competent authority shall check the organisation’s compliance with the applicable requirements before issuing the approval;

(2) the competent authority shall establish the conditions under which the organisation may operate during the implementation of the change;

(3) if it is satisfied that the organisation complies with the applicable requirements, the competent authority shall approve the change.

[applicable from 22 February 2026 – Regulation (EU) 2023/203]

Details

Source-Title: 21.B.435A Changes to the information security management system View latest amendments

Erulesid: ERULES-1963177438-21953 Compare versions

Domain: Initial airworthiness

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 22 February, 2023

Regulatorysource: Regulation (EU) 2023/203 Navigate

Regulatorysubject: Part-21

Typeofcontent: IR (Implementing rule)

Origin: EASA

Category: EAR