AviationBot
Navigate / EASA / INFORMATION SECURITY DEC 2025 / Delegated Regulation (EU) 2022/1645 / ANNEX -- INFORMATION SECURITY -- ORGANISATION REQUIREMENTS [PART-IS.D.OR] / IS.D.OR.200 Information security management system (ISMS) /

AMC1 IS.D.OR.200(e) Information security management system (ISMS)

EASA Logo
AMC1 IS.D.OR.200(e) Information security management system (ISMS)

ED Decision 2023/009/R

DEROGATION

Organisations should follow the directions provided in AMC1 IS.D.OR.205(a) and AMC1 IS.D.OR.205(b) to perform a documented information security risk assessment to seek the approval from the competent authority of a derogation under point IS.D.OR.200(e). In order to justify the grounds for an derogation, the risk assessment is expected to provide explanations for the exclusion of all elements from the scope of the ISMS. It is up to the authority to determine whether this assessment is deemed satisfactory for a derogation to be granted.

Organisations that would like to have the risk assessment performed by a third party should consider the requirements of IS.D.OR.235 and the related AMC.

Frequently Asked Questions

Organisations should follow the directions provided in AMC1 IS.D.OR.205(a) and AMC1 IS.D.OR.205(b) to perform a documented information security risk assessment to seek the approval from the competent authority of a derogation under point IS.D.OR.200(e).

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

The risk assessment is expected to provide explanations for the exclusion of all elements from the scope of the ISMS.

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

It is up to the authority to determine whether this assessment is deemed satisfactory for a derogation to be granted.

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

Organisations that would like to have the risk assessment performed by a third party should consider the requirements of IS.D.OR.235 and the related AMC.

* Aviation.Bot's Suggestion - Always consult the original regulation for confirmation

Table of Contents Ask question Discover more

AI for Aviation Professionals

Aviation.Bot is an AI tool that assists you with aviation compliance.

Details
Source-Title: AMC1 IS.D.OR.200(e) Information security management system (ISMS)
Erulesid: ERULES-1963177438-21623
Domain: Information Security (IS)
Amendedby: Issue 1
Applicabilitydate: 22 February, 2026
Entryintoforcedate: 14 July, 2023
Regulatorysource: ED Decision 2023/009/R Navigate
Regulatorysubject: Part-IS.D.OR
Typeofcontent: AMC to DR
Origin: EASA
Category: EAR