21.B.240A Changes to the information security management system

• Regulation (EU) 2023/203 found in: Initial Airworthiness and Environmental Protection (748/2012) Part-21 Part-21L (Jul 2024)

21.B.240A Changes to the information security management system Regulation (EU) 2023/203 (a)     For changes managed and notified to the competent authority in accordance with the procedure set out in point IS.D.OR.255(a) of the Annex (Part‑IS.D.OR) to [Delegated Regulation (EU) 2022/1645](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R1645&qid=1705575972222), the competent authority shall include the review of such changes in its continuing oversight in accordance with the principles laid down in point [21.B.221](#_DxCrossRefBm1649097533). If any non-compliance is found, the competent authority shall notify the organisation thereof, request further changes and act in accordance with point [21.B.225](#_DxCrossRefBm1649097260). (b)     For other changes requiring an application for approval in accordance with point IS.D.OR.255(b) of the Annex (Part‑IS.D.OR) to [Delegated Regulation (EU) 2022/1645](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R1645&qid=1705575972222): (1)     upon receiving the application for the change, the competent authority shall check the organisation’s compliance with the applicable requirements before issuing the approval; (2)     the competent authority shall establish the conditions under which the organisation may operate during the implementation of the change; (3)     if it is satisfied that the organisation complies with the applicable requirements, the competent authority shall approve the change. [applicable from 22 February 2026 – Regulation (EU) 2023/203] #### 21.B.240A Changes to the information security management system *Regulation (EU) 2023/203* (a) For changes managed and notified to the competent authority in accordance with the procedure set out in point IS.D.OR.255(a) of the Annex (Part‑IS.D.OR) to [Delegated Regulation (EU) 2022/1645](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R1645&qid=1705575972222), the competent authority shall include the review of such changes in its continuing oversight in accordance with the principles laid down in point [21.B.221](#_DxCrossRefBm485231026). If any non-compliance is found, the competent authority shall notify the organisation thereof, request further changes and act in accordance with point [21.B.225](#_DxCrossRefBm485230751). (b) For other changes requiring an application for approval in accordance with point IS.D.OR.255(b) of the Annex (Part‑IS.D.OR) to [Delegated Regulation (EU) 2022/1645](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R1645&qid=1705575972222): (1) upon receiving the application for the change, the competent authority shall check the organisation’s compliance with the applicable requirements before issuing the approval; (2) the competent authority shall establish the conditions under which the organisation may operate during the implementation of the change; (3) if it is satisfied that the organisation complies with the applicable requirements, the competent authority shall approve the change. [applicable from 22 February 2026 – Regulation (EU) 2023/203]