AMC1 IS.I.OR.205(a) Information security risk assessment

• ED Decision 2023/009/R found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)

AMC1 IS.I.OR.205(a) Information security risk assessment ED Decision 2023/009/R When conducting an information security risk assessment, the organisation should ensure that all relevant aviation safety elements are identified and included in the ISMS scope as per [IS.I.OR.200](#_DxCrossRefBm1193569541) and related AMC. A means to comply with the requirement in point [IS.I.OR.205](#_DxCrossRefBm1193569493)(a) is to perform a preliminary high-level risk assessment or impact assessment, carried out in accordance with a documented methodology and following precise criteria for the inclusion in and exclusion from the ISMS scope of the elements listed in [IS.I.OR.205](#_DxCrossRefBm1193569493)(a). ##### AMC1 IS.I.OR.205(a) Information security risk assessment *ED Decision 2023/009/R* When conducting an information security risk assessment, the organisation should ensure that all relevant aviation safety elements are identified and included in the ISMS scope as per [IS.I.OR.200](#_DxCrossRefBm1749084277) and related AMC. A means to comply with the requirement in point [IS.I.OR.205](#_DxCrossRefBm1749084227)(a) is to perform a preliminary high-level risk assessment or impact assessment, carried out in accordance with a documented methodology and following precise criteria for the inclusion in and exclusion from the ISMS scope of the elements listed in [IS.I.OR.205](#_DxCrossRefBm1749084227)(a).