IS.I.OR.200 Information security management system (ISMS)

• Regulation (EU) 2023/203 found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)

IS.I.OR.200 Information security management system (ISMS) Regulation (EU) 2023/203 (a)     In order to achieve the objectives set out in [Article 1](#_DxCrossRefBm1193569433), the organisation shall set up, implement and maintain an information security management system (ISMS) which ensures that the organisation: (1)     establishes a policy on information security setting out the overall principles of the organisation with regard to the potential impact of information security risks on aviation safety; (2)     identifies and reviews information security risks in accordance with point [IS.I.OR.205](#_DxCrossRefBm1193569493); (3)     defines and implements information security risk treatment measures in accordance with point [IS.I.OR.210](#_DxCrossRefBm1193569551); (4)     implements an information security internal reporting scheme in accordance with point [IS.I.OR.215](#_DxCrossRefBm1193569550); (5)     defines and implements, in accordance with point [IS.I.OR.220](#_DxCrossRefBm1193569549), the measures required to detect information security events, identifies those events which are considered incidents with a potential impact on aviation safety except as permitted by point [IS.I.OR.205](#_DxCrossRefBm1193569493)(e), and responds to, and recovers from, those information security incidents; (6)     implements the measures that have been notified by the competent authority as an immediate reaction to an information security incident or vulnerability with an impact on aviation safety; (7)     takes appropriate action, in accordance with point [IS.I.OR.225](#_DxCrossRefBm1193569548), to address findings notified by the competent authority; (8)     implements an external reporting scheme in accordance with point [IS.I.OR.230](#_DxCrossRefBm1193569432) in order to enable the competent authority to take appropriate actions; (9)     complies with the requirements contained in point [IS.I.OR.235](#_DxCrossRefBm1193569547) when contracting any part of the activities referred to in point [IS.I.OR.200](#_DxCrossRefBm1193569541) to other organisations; (10)    complies with the personnel requirements laid down in point [IS.I.OR.240](#_DxCrossRefBm1193569546); (11)    complies with the record-keeping requirements laid down in point [IS.I.OR.245](#_DxCrossRefBm1193569545); (12)    monitors compliance of the organisation with the requirements of this Regulation and provides feedback on findings to the accountable manager to ensure effective implementation of corrective actions; (13)    protects, without prejudice to applicable incident reporting requirements, the confidentiality of any information that the organisation may have received from other organisations, according to its level of sensitivity. (b)     In order to continuously meet the requirements referred to in [Article 1](#_DxCrossRefBm1193569433), the organisation shall implement a continuous improvement process in accordance with point [IS.I.OR.260](#_DxCrossRefBm1193569542). (c)      The organisation shall document, in accordance with point [IS.I.OR.250](#_DxCrossRefBm1193569544), all key processes, procedures, roles and responsibilities required to comply with point [IS.I.OR.200](#_DxCrossRefBm1193569541)(a), and shall establish a process for amending that documentation. Changes to those processes, procedures, roles and responsibilities shall be managed in accordance with point [IS.I.OR.255](#_DxCrossRefBm1193569543). (d)     The processes, procedures, roles and responsibilities established by the organisation in order to comply with point [IS.I.OR.200](#_DxCrossRefBm1193569541)(a) shall correspond to the nature and complexity of its activities, based on an assessment of the information security risks inherent to those activities, and may be integrated within other existing management systems already implemented by the organisation. (e)     Without prejudice to the obligation to comply with the reporting requirements laid down in Regulation (EU) No 376/2014([[25]](#_ftn25)) and the requirements laid down in point [IS.I.OR.200](#_DxCrossRefBm1193569541)(a)(13), the organisation may be approved by the competent authority not to implement the requirements referred to in points (a) to (d) and the related requirements contained in points [IS.I.OR.205](#_DxCrossRefBm1193569493) through [IS.I.OR.260](#_DxCrossRefBm1193569542), if it demonstrates to the satisfaction of that authority that its activities, facilities and resources, as well as the services it operates, provides, receives and maintains, do not pose any information security risks with a potential impact on aviation safety neither to itself nor to other organisations. The approval shall be based on a documented information security risk assessment carried out by the organisation or a third party in accordance with point [IS.I.OR.205](#_DxCrossRefBm1193569493) and reviewed and approved by its competent authority. The continued validity of that approval will be reviewed by the competent authority following the applicable oversight audit cycle and whenever changes are implemented in the scope of work of the organisation. ---