Compare and highlight differences

Compare / EASA/ Incorporated Amendments/ Compare & Highlight Differences

Appendix IV -- Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences

Available versions for ERULES-1963177438-24031

ED Decision 2025/014/R found in: Information Security (2023/203 and 2022/1645) Part-IS (Dec 2025)

Version

Show details Hide details

##### Appendix IV — Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences

*ED Decision 2025/014/R*

Although Part-IS does not credit ISO/IEC 27001 certification, the
practices and methods typically adopted for implementing and
maintaining an ISMS under ISO/IEC 27000 largely align with the
objectives of this regulation. Therefore, entities that have already
implemented an ISMS under ISO/IEC 27001:2022 can use this as a
basis for Part-IS compliance.

The following provides guidance on how organisations that have
already implemented an ISMS compliant with ISO/IEC 27001:2022 can
integrate Part-IS requirements into their existing ISMS.
Specifically, the table below illustrates how to incorporate the
‘Part-IS particularity’ of each requirement into an existing
ISO/IEC 27001-based ISMS in order to achieve Part-IS compliance. This
is referred to as ‘Guidance on Part-IS implementation’.

<table bgcolor="#d9d9d9" cellpadding="7" cellspacing="0">
<col/>
<col/>
<thead>
<tr valign="top">
<td bgcolor="#808080">
Part-IS
				requirement
</td>
<td bgcolor="#808080">
ISO/IEC
				27001:2022 mapping and specific guidance
</td>
</tr>
</thead>
<tbody>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084427">IS.D.OR.200</a>(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
4.	Context
				of the organisation

6.1.1	Actions
				to address risks and opportunities - General
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
An
				ISMS designed in the context of an ISO/IEC 27001:2022 ISMS, which
				is currently not connected to the management systems required by
				the delegated and implementing acts of <a href="http://data.europa.eu/eli/reg/2018/1139/oj">Regulation
				(EU) 2018/1139</a>, including Part-IS, may differ if
				these different systems do not address the same goals. Part-IS
				focuses on information security requirements meeting the
				applicable aviation safety objectives, which have an influence on
				elements of the ISMS. Also, the ‘interested parties’ and the
				‘internal and external issues’ as laid down in Chapter 4 of
				ISO/IEC 27001:2022 may be adapted to address the requirements of
				Part-IS for the organisation.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Please
				note that the point IS.D.OR.200 requirement
				points to many other Part-IS requirements that the ISMS has to
				comply with, namely points 205, 210, 215, 220, 225, 230, 235,
				240, 245, 255, and 260. Further details are
				provided in the specific chapters on the particular requirement.
Regarding
				the other remaining requirements, not pointing out to other
				Part-IS requirements, and comparing them with ISO/IEC 27001:2022,
				there are four requirements left, namely points
				IS.D.OR.200(a)(1), IS.D.OR.200(a)(6), IS.D.OR.200 (a)(12)
				and IS.D.OR.200(a)(13).
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.200(a)(1)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
5.2	Policy

A.5.1	Policies
				for information securities
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
An
				ISMS designed in the context of an ISO/IEC 27001:2022 ISMS, which
				is currently not connected to the management systems required by
				the delegated and implementing acts of Regulation (EU) 2018/1139,
				may differ as these different systems do often not address the
				same goals. Part-IS focuses on information security requirements
				influencing the applicable aviation safety objectives, which in
				their turn have an influence on the elements of the ISMS.
In
				addition, all domain-specific delegated and implementing acts of
				Regulation (EU) 2018/1139, namely points ORO.GEN.200(a)(2),
				ORA.GEN.200(a)(2), CAMO.A.200(a)(2), 145.A.200(a)(2),
				21.A.139(c)(1), 21.A.239(c)(1), ATM/ANS.OR.B.005(a)(2),
				ATCO.OC.C.001(b) and ADR.OR.D.005(b)(2), require a ‘safety
				policy’, where information security may be integrated.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				policy on information security established in an ISO/IEC
				27001:2022 context has to be updated with regard to the
				potential impact of the risks on aviation safety. At least
				the elements of <a href="#_DxCrossRefBm1749084441">AMC1
				IS.D.OR.200(a)(1)</a> have to be mentioned in the
				policy. Therefore, the following elements may need to be added to
				an existing ISMS policy. The elements in bold and italics
				are additional guidance that might also be considered.

(a)	committing
				to complying with applicable legislation, considering relevant
				standards and best practices, including safety- and
				cybersecurity-related standards and guidance published or
				prescribed by ICAO, EASA or the relevant civil aviation
				authority;

(b)	setting
				objectives and performance measures for managing information
				security, updated to ensure meeting the applicable
				aviation safety objectives;

(c)	defining
				general principles, activities, processes for the organisation to
				appropriately secure information and communication technology
				systems and data, in relation to the information security /
				safety risk assessment required by point <a href="#_DxCrossRefBm1749084438">IS.D.OR.205</a>;

(d)	committing
				to applying ISMS requirements into the processes of the
				organisation;

(e)	committing
				to continually improving towards higher levels of information
				security process maturity as per point IS.D.OR.260;

(f)	committing
				to satisfying applicable requirements regarding information
				security (including requirements stemming from civil
				aviation authorities) and its proactive and systematic
				management and to the provision of appropriate resources for its
				implementation and operation;

(g)	assigning
				information security as one of the essential responsibilities for
				all managers;

(h)	committing
				to promoting the information security policy through training or
				awareness sessions within the organisation to all personnel on a
				regular basis or upon modifications;

(i)	encouraging
				the implementation of a ‘just culture’ and the
				reporting of vulnerabilities, suspicious/anomalous events and/or
				information security incidents;

(j)	committing
				to communicating the information security policy to all relevant
				parties, as appropriate.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.200(a)(6)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
10.1	Corrective
				actions

A5.5	Contact
				with authorities

A5.26	Response
				to information security incidents

A8.8	Management
				of technical vulnerabilities
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement has no specific counterpart in ISO/IEC 27001:2022.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				policies and procedures, defined as means of compliance with the
				requirements listed above, should be extended to information
				security measures mandated by the competent authority.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.200(a)(12)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
9.2.	Internal
				audit

9.3	Management
				review

10.2	Non-conformity
				and corrective action

A5.36	Compliance
				with policies, rules and standards for information security
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement is strongly related to the internal audit system and
				the independent checking function of ISO/IEC 27001:2022. The
				required feedback system to the accountable manager or the head
				of the design organisation fits into the requirement of 9.3.
In
				addition, all delegated and implementing acts for the specific
				domains require a similar ‘compliance monitoring function’,
				where information security should be integrated as described in
				<a href="#_DxCrossRefBm1749084443">AMC1
				IS.D.OR.200(a)(12)</a>.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				requirements of ISO/IEC 27001:2022 and the delegated and
				implementing acts of Regulation (EU) 2018/1139 are compatible.
				Therefore, it will be easy to integrate Part-IS into the audit
				scope of the ISO/IEC 27001:2022 internal audit system.

The
				role of the accountable manager or the head of the design
				organisation as defined under point IS.D.OR.240(a) has to be
				addressed accordingly in the feedback loop if the role is not
				already addressed in the management review process. The
				accountable manager or the head of the design organisation is
				required to be personally briefed on the key findings so that
				appropriate decisions can be made.

Refer
				also to <a href="#_DxCrossRefBm1749084444">GM1
				IS.D.OR.200(a)(12)</a>.
Note:
ISO 19011:2018 provides guidance on the establishment of an
				internal audit system. Specifically, Chapter A.7 ‘Auditing
				compliance within a management system’ provides useful guidance
				on how to integrate a compliance monitoring function into an
				internal audit system.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.200(a)(13)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.5.3.	Control
				of documented information (Note)

A5.12	Classification
				of information

A5.34	Privacy
				and protection of personal identifiable information (PII)

A8.12	Data
				leakage prevention
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement is limited to ‘information from other
				organisations’ and to confidentiality. ISO/IEC 27001:2022 does
				not differentiate between ‘internal’ or ‘external’
				information (as laid down e.g. in ISO 9001:2015 Chapter 8.5.3).
				The only reference is made in the note in Chapter 7.5.3.
Part-IS
				stresses protection of external information received due to the
				sensitivity it may have regarding incidents and vulnerabilities
				disclosure. Insufficient confidentiality protection may result in
				exploitation of vulnerabilities affecting safety that the
				original provider of information may not have perceived.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				protection of information, specifically regarding confidentiality
				(as in ISO/IEC 27002:2022), is related to a set of controls
				that can be found in Table A.1 (Matrix of controls and
				attribute values) of ISO/IEC 27002:2022. See also the definition
				in ISO/IEC 27002:2022:

3.1.7 Confidential
				information

Information
				that is not intended to be made available or disclosed to
				unauthorized individuals, entities or processes.
The
				organisation having implemented these controls should take
				special care that they apply to information received from
				external information that may result in information security
				threats if known by unauthorised actors. When this kind of
				information is further shared with other organisations or
				authorities, appropriate confidentiality procedures must be put
				in place and followed (TLP marking, for instance).
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.200(b)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
10.1	Continual
				improvement
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				and ISO/IEC 27001:2022 are very similar regarding this
				requirement. See points IS.D.OR.260 (a) and (b) for subtle
				differences.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
See
				point IS.D.OR.260 in this table.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.200(c)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
6.3	Planning
				of changes

7.5.3	Control
				of documented information
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Control
				of documented information is one of the key processes in each ISO
				management system standard, following the ISO ‘high-level
				structure’ (ISO/IEC Directives part 1 Annex SL), such as
				ISO/IEC 27001 :2022.

For
				changes, see point IS.D.OR.255.
In
				addition, most of the delegated and implementing acts for the
				specific domains require a similar need to document, where
				information security should be integrated.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
See
				points IS.D.OR.250 and IS.D.OR.255 in this table.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.200(d)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
4.3	Determining
				the scope of the information security management system
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				scope statement and the ‘statement of applicability’ (SOA)
				are the best references to apply the ‘nature and complexity’.
In
				addition, most of the delegated and implementing acts for the
				specific domains require a similar need to document, where
				information security should be integrated.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
When
				determining the scope, it should be noted that Part-IS is
				delimited to the subject matter as defined in Article 1 of the
				Regulation(s), which refers to identification and management
				of information security risks with potential impact on
				aviation safety.

Considering
				this, the scope of an ISMS under ISO/IEC 27001:2022 may be
				broader than that required by Part-IS. Some organisational units,
				processes or locations may fall under what is covered by the ISMS
				under ISO/IEC 27001:2022, but not within the scope of Part-IS.

The
				opposite may happen too: the scope under ISO/IEC 27001:2022 may
				be narrower than the one Part-IS would require (e. g. the ISO/IEC
				27001:2022 scope covers only the IT department).

In
				both situations, scope definitions must be compared and adjusted
				when necessary.

Note: See also guidance on point IS.D.OR.205(a) in this table.
The
				scope statement in the ISO/IEC 27001:2022 context is the right
				place where this clarification is made.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.200(e)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
4.1	Understanding
				the organisation and its context.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				is a ‘derogation’ for organisations falling under the
				applicability of Article 2 of this Regulation. This process is
				independent from an ISO/IEC 27001:2022 certification process. 

</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
If
				an organisation which already has an established ISMS according
				to ISO/IEC 27001:2022 decides to embark on this process, the
				full implementation of Part-IS into the ISMS may be put on hold
				until the decision of the competent authority is made.

To
				demonstrate that an organisation’s activities, facilities and
				resources, as well as the services it operates, provides,
				receives and maintains, do not pose any information security
				risks with a potential impact on aviation safety either to itself
				or to other organisations, the existing risk assessment
				methodology according to ISO/IEC 27001:2022 Chapter 6.1.2 may be
				used if the methodology is enhanced with a focus on the impact on
				safety. On the other hand, an existing risk assessment
				methodology used by the existing safety management system (SMS)
				could be enhanced by addressing potential information security
				risks.

In
				any case, the competent authority responsible for the
				organisation will determine which process and methodology shall
				be used.
This
				demonstration has to be at least verified and reassessed at
				regular intervals and as a mandatory part of the organisation’s
				change process. In case of any doubt about the conclusion, the
				appropriate civil aviation authority must be contacted.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.205(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
4.3	Determining
				the scope of the information security management system

6.1.2	Information
				security risk assessment
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement of Part-IS is in line with ISO/IEC 27001:2022,
				however ISO/IEC 27001:2022 allows a wider focus, whereas
				Part-IS puts the focus on safety already from the element’s
				identification stage.
In
				addition, all of the delegated and implementing acts for the
				specific domains require a risk assessment process, where
				information security can be integrated. 

</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
<a href="#_DxCrossRefBm1749084454">AMC1
				IS.D.OR.205(a)</a> explains that when conducting
				an information security risk assessment, the organisation should
				ensure that each relevant aviation safety impact is identified
				and included in the ISMS scope, which might not be the case when
				using ISO/IEC 27001:2022.

On
				the other hand, an ISO/IEC 27001:2022 ISMS focuses its security
				risk assessment mainly on the business impact of infringement on
				confidentiality, integrity and availability, their risks and the
				impact on assets (e. g. loss of IT infrastructure, breach of
				data).

This
				means that, starting from an ISMS based on ISO/IEC 27001:2022, a
				complementary analysis has to be made to take into account all
				the elements related to aviation safety.
To
				bridge the two approaches of management systems (SMS and ISMS),
				an identified information security risk may be entered as a
				‘cause’ or ‘contributing event’ in the
				aviation-safety-focused risk assessment required by the
				domain‑specific implementing or delegated act. The figure
				in <a href="#_DxCrossRefBm1749084465">GM1
				IS.D.OR.205(c)</a> provides a good indication of how
				this bridge could be built.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.205(b)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
4.1	Understanding
				the organisation and its context

4.3	Determining
				the scope of the information security management system

A5.19	Information
				security in supplier relationships

A5.21	Managing
				information security in the information and communication
				technology (ICT) supply chain
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Point
				IS.D.OR.205(b) focuses on the identification of interfaces with
				the other organisations. ISO/IEC 27001:2022 4.3 requires
				considering in point c) the interfaces at and dependencies
				between activities performed by the organisation and those that
				are performed by other organisations. So, there is more in
				Part-IS than that required by ISO/IEC 27001:2022, provided that
				the scope considered includes safety, as required by point
				IS.D.OR.205(a).
Controls
				A5.19 and A5.21 are a profound foundation for the requirements of
				point IS.D.OR.205(b).
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
ISO/IEC
				27001:2022 A5.19 requires the identification of risks associated
				with the use of suppliers’ products or services. ISO 27002
				A5.19 contains additional guidance in points f) to j) on how to
				manage the risk exposure.

ISO/IEC
				27001:2022 A5.21 requires the management of information security
				risks associated with the ICT products and services supply chain.
				ISO 27002 A5.21 contains additional guidance in points f), k), l)
				and m) on how to manage risks through the supply chain.
The
				Part-IS notion about interfaces and supply chain goes beyond the
				respective ISO/IEC 27001:2022 notion. <a href="#_DxCrossRefBm1749084461">GM1
				IS.D.OR.205(b)</a> requests interfacing organisations
				to share information about mutual risk exposure (including all
				data flows) and urges organisations to use ED-201A for that.
				Point IS.D.OR.205(c) also requires accounting for information
				acquired by interfacing organisations, which underlines the
				two-way nature of the considerations. Particular attention should
				be paid to the Part-IS intent to protect the so-called functional
				chains. The notion is that while organisations may protect
				themselves well enough, interfaces between organisations may pose
				risks to each chain when not accounted for. 

</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.205(c)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
6.1.2	Information
				security risk assessment
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Point
				IS.D.OR.205(c) is the ‘heart’ of Part-IS. ISO/IEC 27001:2022
				6.1.2 opens a ‘framework’ where the requirements of point
				IS.D.OR.205 may fit in.
It
				has to be assured that the risk management systems of the ISMS
				and those required by the SMS regulations (see point
				IS.D.OR.205(a)) do NOT operate independently, as there might be
				difficulties in connecting the two systems.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Further
				to this provision, a proper risk assessment has to be made,
				taking into account the scope and interfaces described in points
				IS.D.OR.205(a) and IS.D.OR.205(b). It has to be noted (see also
				GM1 IS.D.OR.205(c)) that point IS.D.OR.205 does not require
				the use of any specific information security risk assessment
				framework, such as ISO 31000, NIST or others, to develop the risk
				assessment. ISO/IEC 27001:2022 tends to lean towards using ISO
				27005 as a risk assessment standard; however, it does not make it
				mandatory. The key point is that the risk assessment carried out
				in the application of ISO/IEC 27001:2022 6.1.2 does not
				necessarily consider safety risks, and may focus on different
				types of risks.

With
				respect to safety, conditions that may lead to safety
				consequences are identified as hazards. Their
				materialisation may be either directly triggered or caused by
				information security threats which have not been successfully
				prevented. Information security can thus cause or contribute to a
				safety consequence in four different ways:

(1)	it
				can act as a safety threat;

(2)	it
				can have a negative effect on a safety barrier, rendering it less
				effective than before;

(3)	it
				can directly trigger the materialisation of an already identified
				hazard; or

(4)	it
				can constitute a new, not yet identified, hazard, which can
				obviously also materialise.

By
				using e.g. the ‘bow-tie method’ regarding information
				security, a ‘hazard’ would be replaced by a ‘vulnerability’,
				which can be exploited resulting in information security
				consequences (e.g. lack or reduction of confidentiality,
				integrity, availability, authenticity properties). Hence, from a
				methodology perspective, both considerations are very similar and
				can be designed to interact (e. g. consequences of the
				information security bow-tie may connect as causes of the ‘safety
				bow-tie’).

Guidance
				on organisations that are NOT required to operate an SMS,
				including safety risk management

Any
				ISO/IEC 27001:2022 risk assessment has to be reviewed and revised
				by introducing safety impact (consequence) considerations.

Any
				risk matrix stemming from an ISO/IEC 27001:2022 6.1.2 risk
				assessment is acceptable, provided that it includes safety
				impacts (consequences), and the results remain within the
				limitations of ICAO Annex 19. If two different risk assessment
				schemes are used, they need to be linked accordingly.

Guidance
				on organisations that are required to operate an SMS, including
				safety risk management

In
				most of the cases, where an organisation is subject to the
				domain-specific implementing or delegated acts for SMS and
				operates an ISMS under voluntary compliance with ISO/IEC
				27001:2022, it may operate two risk management systems, one for
				safety under the oversight of a competent authority, and one for
				information security. The latter may ultimately be certified by
				an ISO/IEC 27001:2022 accredited body.

Each
				potential risk identified by the ISMS risk management has to be
				systematically assessed for its potential impact on safety. To
				establish the connection between the systems, the following
				approach should be used:

(1)	If
				a safety risk assessment is available, it should be able to
				provide its context and determined target likelihoods for
				acceptable information security risks to the information security
				risk assessment process. The context consists of the system
				architecture, including its preventative and mitigative barriers,
				the hazards assessed and the safety risks identified. Based upon
				the information provided, the information security risk
				assessment can be conducted. Modifications to the system
				architecture, or any modifications of properties of the
				preventative or mitigative barriers, as well as the achieved risk
				properties need to be communicated back to the safety risk
				assessment process. Based upon this communication, the safety
				risk assessment has to be updated. In other words: mitigation
				measures put in place as a result of the information security
				risk assessment should also be considered as they may not only
				mitigate, but possibly also create a negative safety impact.

(2)	If
				a safety risk assessment is available, but the information
				security assessment process identifies a new hazard that was
				previously unknown to the safety risk assessment, a full hazard
				assessment of all safety aspects have to be conducted to ensure
				that the safety risk assessment contains the ‘full picture’
				of the newly addressed hazard.

(3)	The
				safety risk and the information security risk assessments need to
				be repeated as described above until all acceptability
				requirements for all aspects are met.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.205(d)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
6.3	Planning
				of changes

8.2	Information
				security risk assessment
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Point
				IS.D.OR.205(d) is about the subsequent changes to the original
				risk assessment, due to a change of context or interfaces or
				knowledge about the risks or lessons learnt. This is equivalent
				to ISO/IEC 27001:2022 8.2. In both frameworks the reviews are
				planned and documented.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				same process as that already in place in an ISO/IEC 27001:2022
				context can be used to implement point IS.D.OR.205(d), provided
				that this process has been updated to include safety criteria
				evaluation of changes that trigger an unplanned update of the
				risk assessment.

Those
				organisations that have most experienced risk assessment updates
				at planned intervals will need to be proactive to trigger such
				updates more often in the situations listed in points
				IS.D.OR.205(d) (1), (2), (3), and (4) that could affect safety.

The
				triggering criteria and the process should be documented and
				tested before implementation, for example through table-top
				exercises.

The
				change management process is key to keep a management system in a
				solid and stable condition. Considering an established ISMS
				according to ISO/IEC 27001:2022, the regular updates of the risk
				assessment based on changes and lessons learned should be
				effective. The essential focus, introduced by Part-IS, is the
				‘impact on safety’, which drives the update assessment.
				Change management processes focusing on changes that may have
				impact on safety are also set out in all domain‑specific
				implementing and delegated acts.
Without
				the ‘bridge’ of Part-IS, both systems (ISMS and SMS) are
				implemented independently, often without considering
				interdependencies. Part-IS implies the need (and provides the
				opportunity) to interlink the systems to provide a common risk
				picture for the organisation, with a focus on safety, but also
				opening the horizon to information security.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084437">IS.D.OR.210</a>(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
6.1.3	Information
				security risk treatment

8.3	Information
				security risk treatment
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Point
				IS.D.OR.210(a) is about information security risk treatment,
				which is widely covered by ISO/IEC 27001:2022, its Appendix A,
				and ISO/IEC 27002. Point IS.D.OR.210(a) provides however
				some additional inputs related to the risks that may have a
				safety impact.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
ISO/IEC
				27001:2022 6.1.3 is about the definition of the risk treatment
				plan, while ISO/IEC 27001:2022 8.3 deals with the implementation
				of the plan, and both are relevant.

ISO/IEC
				27001:2022 Annex A contains a list of possible information
				security controls, and therefore should also be used in addition
				to the already existing controls, to mitigate information
				security risks having an impact of safety. All the controls of
				Annex A are detailed in ISO/IEC 27002.

Point
				IS.D.OR.210(a) specifies that the measures selected in the plan
				have to reduce the consequences on aviation safety associated
				with the materialisation of the threat scenario. This is in line
				with point IS.D.OR.205 since the risk treatment phase is a
				consequence of the risk assessment phase and has to address all
				the risks that have been evaluated.

Point IS.D.OR.210(a)
				also stipulates that those (protection) measures shall not
				introduce any new potential unacceptable risks to aviation
				safety.

This
				is an area that is not directly covered by either ISO/IEC
				27001:2022 or ISO/IEC 27002. The requirement addresses the
				so-called ‘side effects’ when introducing measures into a
				system (a well-known issue in software development which is also
				very relevant for information security measures). Preventive or
				mitigative measures specifically (e.g. physical security, access
				control) could lead to unintended side effects.
Also,
				the risk treatment of the identified risks should focus on
				addressing safety via the same linkage/integration of ISMS and
				safety management.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.210(b)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
6.1.3.f	Information
				security risk treatment

7.3	Awareness

9.3	Management
				review

A5.19	Information
				security in supplier relationships

A5.21	Managing
				information security in the ICT supply chain
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Point
				IS.D.OR.210(b) requires key personnel in the organisation to be
				informed about the risks, the corresponding threat scenarios and
				the security risk treatment measures, which result in specific
				controls covered by Annex A to ISO/IEC 27001:2022 and
				ISO/IEC 27002. It partially covers IS.D.OR.210(b) by the
				following requirement: obtain risk owners’ approval of the
				information security risk treatment plan and acceptance of the
				residual information security risks.

Point
				IS.D.OR.210(b) has two specific requirements that also have
				equivalent requirements in ISO/IEC 27001:2022 and ISO/IEC 27002:

				—	Inform
				the accountable manager or the head of the design organisation of
				the risk treatment plan — which is a mandatory input to the
				management review.

				—	Inform
				the interfacing entities (the same as in point IS.D.OR.205(b)) of
				all risks shared with them — which is stated in A5.19 Guidance
				point l).
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
In
				addition to the risk owner’s approval requested by ISO/IEC
				27001:2022 6.1.3.f, the organisation will need to inform:

				— the
				accountable manager or the head of the design organisation of the
				risk treatment plan. ISO/IEC 27001:2022 9.3. f) defines ‘results
				of risk assessment and status of risk treatment plan’ as
				mandatory input for the management review which is the vehicle to
				inform the accountable managers/heads of the design organisation;
— the
				interfacing entities (the same as in point IS.D.OR.205(b)) of all
				risks shared with them. ISO/IEC 27002 A5.21 states in point f)
				‘defining rules for sharing of information and any potential
				issues and compromises between the organisations’.
				GM1 IS.D.OR.205(b) and ED-201A may also be used as guidance
				on risk sharing.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084436">IS.D.OR.215</a>(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.24	Information
				security incident management planning and preparation

A6.8	Information
				security event reporting
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Fully
				covered by the requirements of A5.24 and A6.8. However, the
				linkage to the external reporting scheme for the incidents with
				relation to safety (unsafe conditions) has to be established.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				linkage to the external reporting scheme for the incidents with
				relation to safety could be described under A5.5 (contact with
				authorities) in the ISO structure.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.215(b)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.25	Assessment
				and decision on information security events

A5.26	Response
				to information security incidents

A5.27	Learning
				from information security incidents

A5.28	Collection
				of evidence

A8.8	Management
				of technical vulnerabilities
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Fully
				covered by the requirements from A5.25 to A5.28 and A8.8 with a
				need to focus on safety impacts.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				requirements of controls A8.8, A5.25 to A5.28 and the guidance in
				ISO/IEC 27002:2022 are comprehensive to fulfil the
				requirements of IS.D.OR.215(b).

In
				accordance with point IS.D.OR.215(b)(1), the impact on safety
				always needs to be assessed specifically.
<a href="#_DxCrossRefBm1749084475">AMC1 IS.D.OR.215(a)&amp;(b)</a>
				has also to be considered.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="5">
IS.D.OR.215(c)
</td>
<td bgcolor="#d9d9d9">
A5.19	Information
				security in supplier relationships

A5.20	Addressing
				information security within supplier agreements

A5.21	Managing
				information security in the information and communication
				technology (ICT) supply chain
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
To
				be covered under the procedures according to A5.19 and A5.21, as
				well as under the agreements according to A5.20.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
However,
				this depends on whether the supplier is also subject to Part-IS
				or not. In the latter case, the external reporting shall be done
				by the contracting organisation. <a href="#_DxCrossRefBm1749084479">GM1 IS.D.OR.215(c)</a>
				provides guidance on the relationship with contracted
				organisations.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.215(d)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.6	Contact
				with special interest groups

A5.20	Addressing
				information security within supplier agreements

A5.21	Managing
				information security in the information and communication
				technology (ICT) supply chain

A5.28	Collection
				of evidence
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				requirements of controls A5.20, A5.21 and A5.28 and the guidance
				in ISO/IEC 27002:2022 are comprehensive to fulfil the
				requirements of point IS.D.OR.215(d) in terms of process, but
				Part-IS will require cooperation with a broader range of
				organisations.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
As
				ISO/IEC 27001:2022 only focuses on the supply chain and Part-IS
				requires a broader focus, the process needs to be highlighted to
				other relevant stakeholders. This may be covered under A5.6.
				Nevertheless, ISO/IEC 27002 A5.19 has a clear statement under
				point (i) of the guidance.
See
				also the cooperation in accordance with point IS.D.OR.205(c).
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.215(d)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.24	Information
				security incident management planning and preparation

A6.8	Information
				security event reporting
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Fully
				covered by the requirements of A5.24 and A6.8.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
However,
				the linkage to the external reporting scheme for the incidents
				with relation to safety (unsafe conditions) shall be established.
				This could be described under A5.5 (contact with authorities) in
				the ISO structure.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084435">IS.D.OR.220</a>(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.24	Information
				security incident management planning and preparation

A5.25	Assessment
				and decision on information security events

A5.26	Response
				to information security incidents

A5.27	Learning
				from information security incidents

A5.28	Collection
				of evidence

A5.29	Information
				security during disruption

A7.5	Physical
				security monitoring

A8.16	Monitoring
				activities
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Fully
				covered by the requirements of A5.24 to A5.29, and A7.5 for
				physical security and A8.16 for technical monitoring.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				requirements of the controls (both reactive and proactive)
				mentioned above and the guidance in ISO/IEC 27002:2022 are
				comprehensive to fulfil the requirements of point IS.D.OR.220(a).

Again,
				the impact on safety needs to be assessed, and measures shall be
				taken to ensure safety. Part-IS refers to ‘unsafe conditions’,
				which have to be mitigated to an acceptable level. A
				re-assessment of risks that are related to incidents that have
				occurred or to a vulnerability that has been identified is
				mandatory in Part-IS to ensure that no risk becomes unacceptable.
Note:
				Due to historical reasons, information security and safety
				management use different wording when referring to situations
				which are more or less the same. The term ‘incident’ is used
				in a similar way (an event which already happened and infringes
				safety/security). A vulnerability in the sense of information
				security could be mapped to the term ‘hazard’ in the area of
				safety (a situation identified, which is possible to happen, but
				has not happened so far).
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.220(b)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.26	Response
				to information security incidents

A5.29	Information
				security during disruption

A7.5	Physical
				security monitoring

A8.8	Management
				of technical vulnerabilities
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Fully
				covered by the requirements of A5.26 and A5.29.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				requirements of control A5.26 and the guidance in ISO/IEC
				27002:2022 are comprehensive to fulfil the requirements of point
				IS.D.OR.220(b).
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.220(c)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.26	Response
				to information security incidents

A5.29	Information
				security during disruption
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement is covered by the requirements of A5.26 and A5.29,
				with the difference that the recovery here is not intended to
				continuously ensure confidentiality, integrity, availability and
				integrity; instead, it is intended to maintain or return to an
				acceptable level of safety.
In
				addition, some domain-specific implementing and delegated acts of
				Regulation (EU) 2018/1139 (e.g. points ARO.GEN.200,
				ATM/ANS.OR.A.070, ADR.OR.B.070) require emergency response
				planning and/or contingency planning, where information security
				should be integrated.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Coupled
				with the requirements of controls A5.26 and A5.28 and the
				guidance in ISO/IEC 27002:2022, <a href="#_DxCrossRefBm1749084487">AMC1.IS.D.OR.220(c)</a>
				should be applied in order to revert as quickly as possible to a
				safe state.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084434">IS.D.OR.225</a>
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
10.2	Non-conformity
				and corrective action
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement has no specific counterpart in ISO/IEC 27001:2022.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				issue is not covered by the requirements of ISO/IEC 27001:2022,
				so it is not possible to adapt existing policies and procedures
				under ISO/IEC 27001:2022 for this requirement. To ensure
				compliance with this requirement, please refer exclusively to the
				related AMC and GM.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084243">IS.D.OR.230</a>
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.5	Contact
				with authorities
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement is not directly addressed in ISO/IEC 27001:2022.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				issue is not covered by the requirements of ISO/IEC 27001:2022,
				so it is not possible to adapt existing policies and procedures
				under ISO/IEC 27001:2022 for this requirement. To ensure
				compliance with this requirement, please refer exclusively to the
				related AMC and GM.
The
				reporting requirement should also be considered if the
				organisation falls under the NIS 2 Directive.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084433">IS.D.OR.235</a>(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.19	Information
				security in supplier relationships

A5.21	Managing
				information security in the information and communication
				technology (ICT) supply chain

A5.22	Monitoring,
				review and change management of supplier services
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
ISO/IEC
				27001:2022 controls A5.19, A5.21 and A5.29 may cover this
				requirement. The difference in the requirements of point
				IS.D.OR.235 is that they are limited to those activities directly
				related to the ISMS (e. g. internal audits, consultancy for risk
				assessments, etc.).
In
				addition, all domain-specific implementing or delegated acts
				require procedures to deal with contracted activities in a wider
				scope, where information security should be integrated.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement relates only to ISMS activities (e.g. internal
				audits, risk assessments), not to those activities not directly
				related to ISMS itself (e. g. hardware, software, IT and OT).

The
				difference in the requirements of point IS.D.OR.235 is that they
				are limited to those activities directly related to the ISMS (e.
				g. internal audits, consultancy for risk assessments, etc.). The
				controls in ISO/IEC 27001:2022 do not exclude those kinds of
				services, but sometimes they will not be in the focus of the
				organisation.
Therefore,
				there is no need to establish an independent system for those
				contractors referred to in point IS.D.OR.235(a). The list of
				suppliers should be reviewed to ensure that the suppliers
				providing the services mentioned in point IS.D.OR.235 are
				covered.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.235(b)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.20	Addressing
				information security within supplier agreements
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Access
				provided to the authority is not covered in ISO/IEC 27001:2022.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Organisations
				subject to Part-IS are required to provide access to the
				competent authority. If the contracted organisation is approved
				by an authority of another Member State, the different competent
				authorities will coordinate on which authority will perform
				oversight of the organisation according to their authority
				procedures (e.g. <a href="http://data.europa.eu/eli/reg/2012/965/oj">Regulation
				(EU) No 965/2012</a>, point ARO.GEN.300(e)).

For
				contracted organisations not subject to Part-IS,
				<a href="#_DxCrossRefBm1749084507">GM1 IS.D.OR.235(b)</a>
				provides the content to be introduced either in the ‘general
				terms and conditions of trade’ of the contracting organisation,
				or if standard general terms and conditions are used (e. g. for
				COTS-products), the content of the GM has to be arranged on a
				contractual basis (e. g. through a side letter).
<a href="#_DxCrossRefBm1749084506">AMC1.IS.D.OR.235(b)</a>
				should be considered in conjunction with ISO/IEC 27001:2022
				A5.20.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084432">IS.D.OR.240</a>(a)
IS.D.OR.240(e)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
5.1	Leadership
				and commitment

5.3	Organisational
				roles, responsibilities and authorities

7.1	Resources

A5.2	Information
				security roles and responsibilities
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
ISO/IEC
				27001:2022 does not require a specific role such as the
				‘accountable manager’ or ‘head of the design organisation’.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				implementation of the requirements of point IS.D.OR.240(a) can be
				covered by the implementation of ISO/IEC 27001:2022 requirements
				mentioned above, provided that the role of accountable
				manager/head of the design organisation is clearly defined and
				meets the requirements in point IS.D.OR.240(a).
The
				requirement of point IS.D.OR.240(a)(3) has to be set in line with
				the roles in A5.2 (where an accountable manager or the head of
				the design organisation is not envisaged). However, the measures
				in A6.3 should be used to ensure the competency of the
				accountable manager or the head of the design organisation (point
				IS.D.OR.240(a)(3)).
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.240(b)
IS.D.OR.240(c)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
5.3	Organisational
				roles, responsibilities and authorities

7.1	Resources

A5.2	Information
				security roles and responsibilities

A5.3	Segregation
				of duties
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement is not directly addressed in ISO/IEC 27001:2022.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				implementation of the requirements of A5.2 and A5.3 should be
				used as a basis to fulfil the provisions of points IS.D.OR.240
				(b) and (c), but some adaptation may be needed.

This
				issue is covered in A5.2, but A5.3 may also be applicable. In
				addition, similar requirements for the ‘safety roles’ are
				laid down in the domain-specific ‘safety’ implementing or
				delegated acts of Regulation (EU) 2018/1139.
<a href="#_DxCrossRefBm1749084513">AMC1 IS.D.OR.240(b)</a>
				should be considered.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.240(d)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
4.3	Determining
				the scope of the information security management system

A5.2	Information
				security roles and responsibilities

A5.3	Segregation
				of duties
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				implementation of the requirements of A5.2 and A5.3, as well as
				the guidance of ISO/IEC 27002, allow the delegation of
				responsibility within organisations.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				option might be useful for large organisations or groups, where
				the ISMS is implemented as an ‘umbrella function’ over a
				group of organisations, where not all of them are subject to
				Part-IS.

The
				implementation of a ‘group CISO’ or an enterprise-wide ISMS
				could make use of this option in Part-IS.
Nevertheless,
				the common responsible person has to fulfil the competency
				requirements of point IS.D.OR.240(a)(3). This might be relevant
				in cases where the other activities of the organisation or group
				are not related to aviation.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.240(f)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.1	Resources
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				requirements of 7.1 should be implemented.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A
				systematic capacity planning of human resources is a key element
				of any management system. Therefore, such a process should be
				established in an ISMS. The possible additional requirement
				stemming from Part-IS has to be assessed, and the capacity
				planning updated accordingly.

The
				targeted safety levels set in the safety/information security
				assessment should never be jeopardised by a lack of resources,
				even temporarily.
<a href="#_DxCrossRefBm1749084450">AMC1 IS.D.OR.240(f)</a>
				should be considered.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.240(g)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.2	Competency

A6.3	Information
				security awareness, education and training
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				implementation of the requirements of 7.2 and A6.3 is sufficient
				to cover the requirement.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A
				systematic competency management process of staff is a key
				element of any management system. Therefore, such a process
				should be established in an ISMS. The possible additional
				requirement stemming from Part-IS has to be assessed and the
				competency requirements updated accordingly.
<a href="#_DxCrossRefBm1749084521">AMC1 IS.D.OR.240(g)</a>
				should be considered.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.240(h)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A6.2	Terms
				and conditions of employment
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				implementation of the requirements of A6.2 with some adaptation
				would be sufficient to cover the provision of point
				IS.D.OR.240(h).
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Point
				IS.D.OR.240(h) is (at least partially) covered by ISO/IEC
				27001:2022 A.6.2 ‘The employment contractual agreements should
				state the personnel’s and the organisation’s responsibilities
				for information security.’ and A.6.4 ‘disciplinary process’
				(see ‘Just Culture’).
It
				depends on the organisational culture and on whether job
				descriptions or role assignments need to be formally
				acknowledged. In many organisations, the assigned jobs and roles
				are mutually acknowledged by performing the tasks assigned.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.240(i)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
A5.19	Information
				security in supplier relationships

A6.1	Screening

A7.2	Physical
				entry

A8.3	Information
				access restriction

A8.5	Secure
				authentication
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				implementation of the requirements of A5.19, A6.1, A7.2, A8.3 and
				A8.5 might be sufficient controls to cover this requirement for
				the personnel of the organisation, as well as for contractors and
				suppliers.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
All
				the controls established in an ISO/IEC 27001:2022-compliant ISMS
				are designed to ensure the confidentiality and integrity of
				information. The implementation of those controls will provide
				sufficient protection to ensure compliance with this requirement.
<a href="#_DxCrossRefBm1749084527">AMC1 IS.D.OR.240(i)</a>
				should be considered.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084431">IS.D.OR.245</a>(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.5	Documented
				information

A5.9	Inventory
				of information and other associated assets

A5.13	Labelling
				of information

A8.10	Information
				deletion

A8.13	Information
				backup
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Record-keeping
				and retention are an inherent part of the document control system
				under 7.5 of ISO/IEC 27001:2022. Controls A5.9, A5.13, A8.10 and
				A8.13 also apply.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Chapter
				7.5.1 b) states that the ISMS has to include ‘documented
				information determined by the organisation as being necessary for
				the effectiveness of the information security management system.’
				This includes the records defined in point IS.D.OR.245(a)(1).
				Chapter 7.5.3 requires, under f), also document control for
				retention and disposition. Part-IS requirements have to be
				integrated into the existing system, especially the minimum
				duration of record-keeping of five years.

The
				minimum set of records, as defined in point IS.D.OR.245(a)(1)
				should be covered in the inventory of assets. For the coverage,
				the content of <a href="#_DxCrossRefBm1749084530">GM1 IS.D.OR.245</a>
				also applies.

As
				records are not only information assets, the requested ‘record
				retention policy’ may be integrated into a wider policy as
				recommended by ISO/IEC 27002:2022 above.
<a href="#_DxCrossRefBm1749084531">AMC1 IS.D.OR.245(a)(1)(vi)&amp;(a)(5)</a>
				should be implemented.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.245(b)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.5	Documented
				information

A5.9	Inventory
				of information and other associated assets

A5.10	Acceptable
				use of information and other associated assets

A5.13	Labelling
				of information

A5.34	Privacy
				and protection of personal identifiable information (PII)

A8.10	Information
				deletion

A8.13	Information
				backup
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Record-keeping
				and retention are an inherent part of the document control system
				under 7.5 of ISO/IEC 27001:2022. Controls A5.9, A5.13, A8.10 and
				A8.13 will also apply and, due to GDPR issues specifically, also
				A5.10 and A5.34.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Chapter
				7.5.1 b) states that the ISMS has to include ‘documented
				information determined by the organisation as being necessary for
				the effectiveness of the information security management system.’
				This includes the records defined in point IS.D.OR.245(a)(1).
				Chapter 7.5.3 requires, under f), also document control for
				retention and disposition. Part-IS requirements have to be
				integrated into the existing system, especially the minimum
				duration of record-keeping of five years.

However,
				whereas there is no retention duration specified in ISO/IEC
				27001:2022, point IS.D.OR.245(a) specifies three years after the
				person has left the organisation.
As
				these records fall under the GDPR Regulation, each organisation
				has to ensure that they are handled accordingly. It is
				recommended that the procedures are used not only for records
				related to ISMS, but also for the entire HR personnel files of
				the staff.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.245(c)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.5	Documented
				information

A5.13	Labelling
				of information
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Record-keeping
				and retention are an inherent part of the document control system
				under 7.5 of ISO/IEC 27001:2022 as well as control A5.13.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Chapter
				7.5.3, under a), requires for the information that ‘it is
				available and suitable for use, where and when it is needed’.
				Part-IS requirements have to be integrated into the existing
				system.

ISO/IEC 27002:2022
				A5.13 states ‘Procedures for information labelling should cover
				information and other associated assets in all formats.’;
				therefore, the Part-IS requirement is fulfilled with control
				A5.13.
A
				series of AMC material to the implementing and delegated acts
				regarding safety (e.g. AMC1 ARA.GEN.220(a), AMC1 145.A.55) also
				covers this issue.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.245(d)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.5	Documented
				information

A5.10	Acceptable
				use of information and other associated assets

A5.12	Classification
				of information

A5.33	Protection
				of records

A8.12	Data
				leakage prevention
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Record-keeping
				and retention are an inherent part of the document control system
				under 7.5 of ISO/IEC 27001:2022. Controls A5.10, A5.12, A5.33 and
				A8.12 will also apply.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Chapter
				7.5.3, under d), requires ‘storage and preservation, including
				the preservation of legibility’. Part-IS requirements have to
				be integrated into the existing system.
The
				application of A5.33 and A8.12 has a strong relationship to A7.5
				(Protecting against physical and environmental threats), A7.10
				(Storage media), A8.3 (Information access restriction), A8.13
				(Information backup), A8.14 (Redundancy of information processing
				facilities), A8.15 (Logging), A8.17 (Clock synchronization) and
				A8.24 (Use of cryptography).
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084429">IS.D.OR.250</a>(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.5	Documented
				information

A5.13	Labelling
				of information
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Document
				control is an inherent part of the ISMS under 7.5 of ISO/IEC
				27001:2022. Control A5.13 is also an ‘anchor point’ for this
				requirement. ISO/IEC 27001:2022 does not specifically request a
				document called ‘information security management manual’,
				made available to the authority.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Chapter
				7.5.1 b) states that the ISMS has to include ‘documented
				information determined by the organisation as being necessary for
				the effectiveness of the information security management system’
				which will allow the inclusion of the ISMS manual in the
				documentation.

Part-IS
				requires a specific ISMS manual (ISMM), made available to the
				competent authority.

It
				has to be made clear to the competent authority which set of
				documented information constitutes the ‘approved manual’. The
				document ‘statement of applicability’ (SOA), mandatory for
				all ISO/IEC 27001:2022-certified organisations may be helpful
				(e.g. by adding an additional column to label specific documents
				as part of a ‘virtual’ ISMS Manual). <a href="#_DxCrossRefBm1749084536">GM1 IS.D.OR.250(a)</a>
				also provides associated guidance.
It
				has to be ensured that all information listed in point
				IS.D.OR.250(a) is covered.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.250(b)
IS.D.OR.250(c)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.5	Documented
				information

A5.5	Contact
				with authorities 

</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Document
				control is an inherent part of the ISMS under 7.5 of ISO/IEC
				27001:2022.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				use of the same procedure as the one implemented for the ‘safety
				regulations’ (see above) is recommended also for the approval,
				update and communication processes with the competent authority.
Many
				organisations have their documented information available via
				document management systems (e.g. MS SharePoint). The access of
				the competent authority to these systems has to be managed in
				accordance with the rules of any other external access in respect
				of A5.15, A5.18, A6.6, A7.9, A8.3, A8.7, A8.11, and A8.24.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.250(d)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
7.5	Documented
				information
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				possibility of ISMM integration with other expositions or manuals
				has no specific counterpart in ISO/IEC 27001:2022. However,
				following the ISO ‘Annex SL’ structure, ISO/IEC 27001:2022
				enables an easy integration of other management system standards.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
There
				is a tendency in the aviation industry to integrate different
				management systems, depending on the structure of the
				organisation.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084428">IS.D.OR.255</a>(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
6.3	Planning
				of changes

A5.5	Contact
				with authorities 

</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Change
				management is an inherent part of the ISMS under 6.3 of
				ISO/IEC 27001:2022, but there is no provision for approval
				of a procedure by a competent authority.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				use of the same procedure as the one implemented for the ‘safety
				regulations’ (see above) is recommended also for the approval
				of changes not requiring prior approval by the competent
				authority. This procedure should be extended to Part-IS in
				agreement with the competent authority.

Note:

This
				recommendation will only work if the competent authority is the
				authority as laid down in Article 6(1) of <a href="http://data.europa.eu/eli/reg_impl/2023/203/oj">Regulation
				(EU) 2023/203</a> or Article 5(1) of
				<a href="http://data.europa.eu/eli/reg_del/2022/1645/oj">Regulation
				(EU) 2022/1645</a>.

WARNING:
An
				organisation with a derogation approval in accordance with
				point IS.D.OR.200(e) needs to assess for all changes (also
				those not requiring prior approval) whether the criteria for the
				approved derogation are still valid. If not, the change needs the
				approval of the competent authority/authorities prior to being
				implemented.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.255(b)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
6.3	Planning
				of changes

A5.5	Contact
				with authorities
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Change
				management is an inherent part of the ISMS under 6.3 of
				ISO/IEC 27001:2022. However, ISO/IEC 27001:2022 does not
				require any kind of approval by a competent authority.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				use of the same procedure as the one implemented for the
				‘safety-regulations’ (see above) is recommended also for the
				approval of changes in agreement with the competent authority.

Note:
This
				recommendation will only work if the competent authority is the
				authority as laid down in Article 6(1) of Regulation (EU)
				2023/203 or Article 5(1) of Regulation (EU) 2022/1645.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
<a href="#_DxCrossRefBm1749084430">IS.D.OR.260</a>(a)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
9.3	Management
				review

10.1	Continual
				improvement

A5.35	Independent
				review of information security
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
This
				requirement reflects a combination of requirements 9.3 and 10.1
				of ISO/IEC 27001:2022 with references to requirements 4.4
				and 5.2. While ISO/IEC 27001:2022 focuses on ISMS
				suitability, adequacy and effectiveness, point IS.D.OR.260(a)
				requires also a periodical maturity assessment of the ISMS.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
ISO/IEC
				27001:2022, 4.4 shows a clear requirement (‘shall’) for ISMS
				maintenance and improvement. The top management has a
				responsibility for continuous ISMS improvement as per ISO/IEC
				27001:2022 5.2(d). The planning section also requires continuous
				improvement (ISO/IEC 27001:2022 6.1.1(c)).

Point
				IS.D.OR.260(a) requires an assessment of the effectiveness and
				maturity of the ISMS on a calendar basis or following an
				information security incident. This assessment should be
				performed by using indicators. ISO/IEC 27001:2022 Chapter 9.3.1
				defines a very similar approach for the management review
				process. Chapter 10.1 indicates a more independent process to
				improve the ISMS. The process in Chapter 10.1 is seen as more of
				a bottom-up approach, whereas that in Chapter 9.3 is intended to
				be top-down.

The
				results from A5.35 should all be used as inputs for continuous
				improvement.

Point
				IS.D.OR.260(a) also requires a maturity assessment of the ISMS.

Each
				organisation should establish which maturity model will be
				followed and which targeted maturity level is expected to be
				reached and by when.
For
				the maturity assessment, point (b) of <a href="#_DxCrossRefBm1749084544">AMC1 IS.D.OR.260(a)</a>
				and <a href="#_DxCrossRefBm1749084467">GM1 IS.D.OR.260(a)</a>
				provides guidance on how to ensure compliance with
				point IS.D.OR.260(a).
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080" rowspan="6">
IS.D.OR.260(b)
</td>
<td bgcolor="#d9d9d9">
Related
				ISO/IEC 27001:2022 clauses and controls
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
10.2	Non-conformity
				and corrective action

A5.7	Threat
				intelligence
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Part-IS
				particularity
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Point
				IS.D.OR.260(b) addresses the improvement measures, i.e.
				corrections and corrective actions for the deficiencies detected
				in point IS.D.OR.260(a) and the continuous improvement process.
This
				requirement reflects mainly requirement 10.2 of ISO/IEC
				27001:2022, even if the term used is ‘non-conformity’, while
				point IS.D.OR.260(b) uses the term ‘deficiencies’. Deficiency
				has a broader meaning than non-conformity. It encompasses the
				case of a targeted maturity level that would not be reached at
				the planned date; that would be a deficiency but not necessarily
				a non-conformity.
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
Guidance
				on Part-IS implementation
</td>
</tr>
<tr valign="top">
<td bgcolor="#d9d9d9">
The
				provisions listed in ISO/IEC 27001:2022 10.2 can be used to take
				corrective actions, to resolve both non-conformities and maturity
				level gaps.
</td>
</tr>
</tbody>
</table>