Under the new Part-IS (Information Security) regulations, a digital flaw is now legally treated with the same gravity as a mechanical flaw. If you are a manager in a Part-145, Part-CAMO, or Air Operations environment, here is why this is no longer just an “IT problem.”

What Changes Under Part-IS

1. The End of the “Digital Silo”

Historically, if a server went down or an email was phished, it was a headache for the IT team. Under Part-IS, if that server carries maintenance records or flight planning data, it is now a safety hazard.

• The Change: Part-IS does not, in fact, require a formal link between your Information Security Management System (ISMS) and your Safety Management System (SMS). What IS.I.OR.200(d) does is permit the Part-IS processes, procedures, roles and responsibilities to be integrated within management systems you already have in place, and EASA’s guidance material (GM1 IS.I.OR.200(d)) notes that an organisation “may align the ISMS with other management systems, such as safety management systems (SMSs)”. That alignment is an option most organisations sensibly take — not an obligation.
• The Goal: To ensure that a “Cyber Event” is triaged by people who understand flight safety, not just people who understand firewalls.

2. Accountability Has a New Name

One of the most significant updates in the Part-IS framework is the clarity on Management Accountability.

• IS.I.OR.240 gives the Accountable Manager a defined set of duties: they must have the corporate authority to ensure the activities required by the Regulation can be financed and carried out, ensure the necessary resources are available, establish and promote the information security policy, and demonstrate a basic understanding of the Regulation. They also appoint the person or group who ensures the organisation complies, and the person or group managing compliance monitoring, and they sign the ISMM statement required by IS.I.OR.250(a)(1). What the Regulation does not do is make the Accountable Manager personally responsible for information security — the duty to set up, implement and maintain the ISMS sits with the organisation. The shift is one of leadership and accountability, not a new job for the IT department.
• You cannot “outsource” this responsibility to a third-party IT provider. While you can hire experts to manage the tech, the liability for a safety-impacting breach stays with the certificate holder. Managers who have to own that responsibility in practice are the audience for our Part-IS ISMS and compliance manager course.

3. The “Extended Enterprise” (Your Vendors are Your Weak Link)

In a modern aviation environment, we are all connected. Your CAMO uses cloud software; your Part-145 uses digital manuals; your pilots use EFBs.

• The Risk: A hacker doesn’t need to break into your office if they can break into your software provider’s office.
• The Requirement: We describe this internally as “supply chain oversight” — that is Raven’s own shorthand, not a term used in the regulation. In the rule itself, the relevant clause is IS.I.OR.235 “Contracting of information security management activities”, which covers information security management activities you contract out to other organisations.

4. Moving from “Paper” to “Practice”

The legal position first: Part-IS.I.OR applies from 22 February 2026 under Article 16 of Implementing Regulation (EU) 2023/203. From that date the requirements of Annex II apply in full to the organisations in its scope — it is not a staged deadline and not a maturity threshold you can be part-way through.

EASA guidance material discusses a PSOE model (a maturity framework) as a way of describing how well an organisation’s arrangements are working in practice. It is a guidance and audit-practice lens, not a clause of the regulation:

• Present: Do you have the manuals?
• Suitable: Do the manuals fit your size?
• Operational: Are people actually following the rules?
• Effective: Is the system actually stopping threats?

The PSOE language above is commentary, drawn from EASA guidance material and common industry practice, on how maturity tends to be assessed at audit — it does not soften or postpone the applicability date. Treat it as a way of talking about the quality of your evidence, not as permission to arrive at 22 February 2026 with only paperwork in place.

Three Questions Every Aviation Manager Should Ask Today:

1. Do we have a list of our “Critical Assets”? (Which software, if deleted today, would ground our fleet?)
2. Is our CISO talking to our Safety Manager? (Do they even have each other’s phone numbers?)
3. How fast can we report? (If we discover a breach on Friday night, can we notify the Authority by Monday morning to meet the 72-hour rule?)

Part-IS Awareness Training

Checking the competence of your team is one of the main requirements of Part-IS. Raven’s “EASA Part-IS Awareness Training” is designed to train personnel working in Part-145, AOC and CAMOs who have never dealt with cybersecurity before.

Management accountability is only one strand of the regulation. Our complete EASA Part-IS implementation guide maps out every clause, deadline and deliverable in one place.