In the modern aviation landscape, a network firewall is just as critical as an engine firewall.

For decades, aviation safety has focused on physical risks: fatigue, corrosion, and weather. But with the introduction of EASA Part-IS (Information Security), the regulator has officially recognised that a cyber-attack can bring down an aircraft just as effectively as a mechanical failure.

If you are a Nominated Person or Compliance Manager, this guide covers everything you need to know about the complex new regulatory landscape before the February 22, 2026 deadline.

1. What is EASA Part-IS?

Part-IS is not a single rule; it is a suite of requirements designed to protect the aviation system from information security risks. Unlike generic standards like ISO 27001, which focus on data privacy, Part-IS is strictly safety-centric.

Its goal is simple but demanding: You must demonstrate that you can Identify, Protect, Detect, and Respond to cyber threats that could endanger flight safety.

2. The “Two Regulations” Confusion

The most common question we get is: “Is my deadline October 2025 or February 2026?” The answer depends on which specific regulation applies to your approval type. Part-IS is split into two legal acts:

A. The Delegated Regulation (EU) 2022/1645

• Applies to: Design Organisations (DOA), Production Organisations (POA), and Aerodrome Operators.
• The Annex: Known as Part-IS.D.OR.
• Deadline: October 16, 2025 (Already passed for many).

B. The Implementing Regulation (EU) 2023/203

• Applies to: Air Operators (AOC), Maintenance (Part-145), CAMOs, and Flight Schools (ATO).
• The Annex: Known as Part-IS.I.OR.
• Deadline: February 22, 2026.

3. The 3 Pillars of Compliance (Part-IS.I.OR)

For most operators (AOC/145), compliance falls under Part-IS.I.OR. Your Information Security Management System (ISMS) must be built on three pillars:

Pillar 1: Risk Management (IS.I.OR.205 & 210)

You can no longer rely on a generic IT risk register. You must map your “Critical Assets”—systems like the Electronic Flight Bag (EFB), Load Control Software, or Maintenance Laptops.

• The Requirement: You must assess the “Safety Consequence” of a cyber-attack. For example, if a hacker corrupts your NavData, what is the risk of a Catastrophic accident?
• The Output: A risk treatment plan that reduces these risks to an acceptable level.
• Read More: How to Conduct a Part-IS Risk Assessment

Pillar 2: Incident Response (IS.I.OR.220)

Prevention is not enough. You must have a system to detect and respond to attacks in real-time.

• The Scenario: A pilot notices their GPS position jumping erratically (Spoofing).
• The Response: Do they know how to disconnect the GPS and revert to raw data? Do they know how to report it to the CMM?
• Reporting: You must also have an External Reporting Scheme (IS.I.OR.230). Under IS.I.OR.230(c)(2), the report goes to the competent authority — as soon as possible, but not exceeding 72 hours from the time the condition has been known to the organisation.

Pillar 3: Competence & Training (IS.I.OR.240)

This is often the major stumbling block. IS.I.OR.240 requires that all personnel with access to critical information systems are competent.

• Why it matters: A generic “Don’t click phishing links” video is insufficient. Pilots need to know about GPS Spoofing. Mechanics need to know about Bridging Attacks via USB data loaders.
• Check Your Status: The IS.I.OR.240 Competence Checklist

4. Do I need a separate ISMS Manual?

Not necessarily. IS.I.OR.200(d) allows the processes, procedures, roles and responsibilities you establish to comply with IS.I.OR.200(a) to be integrated within other management systems you already have in place — in practice, for an AOC holder that means the management system under ORO.GEN.200, and for a Part-145 organisation the one under 145.A.200. Note that the regulation itself names no particular management system to integrate into, and Regulation (EU) 2023/203 also inserts new points ORO.GEN.200A and 145.A.200A requiring an ISMS “in addition to” that existing management system — so integration is about not duplicating effort, not about the ISMS being absorbed into what you already have. However, the ISMS processes (Risk Assessment, Reporting, Training) must be clearly identifiable and audited by your Compliance Monitoring team — the ground covered in our Part-IS management and compliance course for Nominated Persons and Compliance Managers.

5. Conclusion: The Clock is Ticking

With the February 22, 2026 deadline fast approaching, the time for “gap analysis” is over. You must now move to implementation.

If you have your manuals written but are struggling to prove Staff Competence (IS.I.OR.240), Raven can help. Our EASA Part-IS Awareness Training is the industry standard for role-specific cybersecurity training, designed specifically for Pilots, Engineers, and Operational Staff.

FAQ

Working through the two regulations in detail? Our full Part-IS implementation guide takes each clause of IS.I.OR and IS.D.OR in turn, with the evidence auditors expect for each.