Navigate / EASA / INFORMATION SECURITY DEC 2025 / Implementing Regulation (EU) 2023/203 / ANNEX I -- INFORMATION SECURITY -- AUTHORITY REQUIREMENTS [PART-IS.AR] / IS.AR.200 Information security management system (ISMS) /

AMC1 IS.AR.200(a)(8) Information security management system (ISMS)

AMC1 IS.AR.200(a)(8) Information security management system (ISMS)

ED Decision 2023/010/R

COMPLIANCE MONITORING

When establishing compliance with the provisions under point IS.AR.200(a)(8), the competent authority should implement a function to periodically monitor compliance of the management system with the relevant requirements and adequacy of the procedures including the establishment of an internal audit process and an information security risk management process. Compliance monitoring should include a feedback mechanism of audit findings to the person of the competent authority as identified in IS.AR.225(a) to ensure implementation of corrective actions as necessary.

Frequently Asked Questions

The competent authority should implement a function to periodically monitor compliance of the management system with the relevant requirements and adequacy of the procedures, including the establishment of an internal audit process and an information security risk management process.

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

The compliance monitoring function should include the establishment of an internal audit process and an information security risk management process.

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

Compliance monitoring should include a feedback mechanism of audit findings to the person of the competent authority as identified in IS.AR.225(a) to ensure implementation of corrective actions as necessary.

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

The purpose is to ensure implementation of corrective actions as necessary, by feeding audit findings back to the person of the competent authority identified in IS.AR.225(a).

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

ED Decision 2023/010/R.

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

It monitors compliance of the management system with the relevant requirements and adequacy of the procedures.

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

The feedback is directed to the person of the competent authority as identified in IS.AR.225(a).

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

It is one of the processes that should be established as part of the compliance monitoring function, along with an internal audit process.

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

Table of Contents Ask question Discover more

AI for Aviation Professionals

Aviation.Bot is an AI tool that assists you with aviation compliance.

Details

Source-Title: AMC1 IS.AR.200(a)(8) Information security management system (ISMS)

Erulesid: ERULES-1963177438-21688

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-IS.AR

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: IS.AR.200 Information security management system (ISMS)

Origin: EASA

Category: EAR