Navigate / EASA

21.A.239A Information security management system

Regulation (EU) 2022/1645

In addition to the design management system required by point 21.A.239, the design organisation shall establish, implement and maintain an information security management system in accordance with Commission Delegated Regulation (EU) 2022/1645 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

[applicable from 16 October 2025 – Regulation (EU) 2022/1645]