EASA Part-IS: The Complete Implementation Guide
Part-IS turns a digital flaw into a safety flaw. That single reframing is what makes this regulation different from every information-security standard your IT department has met before — and it is why accountability for it sits with your Accountable Manager, not your service provider.
This guide is the operational reference: which of the two legal acts applies to your approval, what each clause of the Annex actually requires, and what an inspector will expect to see. Every clause number and date below is taken from the regulation itself.
Which regulation applies to you
Part-IS is not one act. It is two, with different annexes, different scopes and different dates. Getting this wrong is the most common early error.
| Delegated Regulation (EU) 2022/1645 | Implementing Regulation (EU) 2023/203 | |
|---|---|---|
| Annex | Part-IS.D.OR | Part-IS.I.OR |
| Applies to | Design Organisations (DOA), Production Organisations (POA) and Aerodrome Operators | Air Operators (AOC), Part-145 maintenance organisations, CAMOs and Approved Training Organisations (ATO) |
| Date of application | 16 October 2025 | 22 February 2026 |
If you hold an AOC, a Part-145 approval, a CAMO approval or an ATO approval, the rest of this guide concerns you: your obligations sit in Part-IS.I.OR and applied from 22 February 2026.
A note on clause references. You will see Part-IS clauses written three different ways across the industry — IS.OR.205, IS.I.OR.205, Part-IS.OR.205. Only the middle form is precise, because it identifies the annex. Throughout this guide we use the official IS.I.OR. prefix from Annex II of Regulation (EU) 2023/203. If you are a DOA, POA or aerodrome operator, your equivalent clauses carry the IS.D.OR. prefix.
What the regulation actually requires: the fourteen clauses
Part-IS.I.OR contains fourteen points. Most implementation guidance in circulation covers five or six of them. The table below is the complete set, with the official heading of each, so you can audit your own programme for the gaps.
| Clause | Official heading | What it means in practice |
|---|---|---|
| IS.I.OR.100 | Scope | Establishes which organisations and activities the Annex covers. |
| IS.I.OR.200 | Information security management system (ISMS) | The requirement to have an ISMS at all — policy, roles, and the system itself. |
| IS.I.OR.205 | Information security risk assessment | Identify all the elements that could be exposed to information security risk — your activities, facilities, resources and services, and the equipment, systems, data and information supporting them — plus your interfaces with other organisations. |
| IS.I.OR.210 | Information security risk treatment | Decide and implement what you will do about each assessed risk. |
| IS.I.OR.215 | Internal reporting scheme | An internal route for staff to report events, operating under Just Culture. |
| IS.I.OR.220 | Information security incidents — detection, response, and recovery | Detect anomalies, contain them, and restore normal operation. |
| IS.I.OR.225 | Response to findings notified by the competent authority | How you respond when your authority raises a finding. This clause is frequently mis-cited as the supply-chain requirement — it is not. |
| IS.I.OR.230 | External reporting scheme | Reporting to the competent authority. See the 72-hour obligation below. |
| IS.I.OR.235 | Contracting of information security management activities | The actual supply-chain clause. Contracted activities must comply and work under your oversight. |
| IS.I.OR.240 | Personnel requirements | The organisation must have processes ensuring its personnel have the necessary competence to perform their tasks — the clause most organisations struggle to evidence. |
| IS.I.OR.245 | Record-keeping | What ISMS records you keep, and for how long. |
| IS.I.OR.250 | Information security management manual (ISMM) | The documented manual describing your ISMS. |
| IS.I.OR.255 | Changes to the ISMS | Managing and notifying changes to the ISMS. |
| IS.I.OR.260 | Continuous improvement | Measuring effectiveness and improving over time. |
Two clauses worth quoting directly
Contracting — IS.I.OR.235. The regulation requires that “when contracting any part of the activities referred to in point IS.I.OR.200 to other organisations, the contracted activities comply with the requirements of this Regulation and the contracted organisation works under its oversight.” In short: you may contract the work, but not the accountability. Your contracts need an information-security interface, and your oversight of it must be demonstrable.
External reporting — IS.I.OR.230. A report must be submitted to the competent authority “as soon as possible, but not exceeding 72 hours from the time the condition has been known to the organisation.” Note the addressee: your competent authority, which under Article 6(1) is the authority designated under your own Part — for most operators the national aviation authority rather than EASA directly. Note also the trigger — 72 hours from the moment the condition became known, which puts the weight on your detection and escalation chain. This duty sits alongside, and is expressly without prejudice to, occurrence reporting under Regulation (EU) No 376/2014: satisfying one does not discharge the other.
Risk assessment: the clause that decides whether you pass
IS.I.OR.205 is where most programmes fail, and the failure is almost always the same one: a risk register imported from an IT or ISO 27001 context, scored on business impact. Part-IS does not ask what a compromise costs you. It asks what it does to flight safety.
A compliant assessment traces a named system or data flow to a physical safety consequence. Our step-by-step walkthrough builds one from scratch, ending in a completed risk-register row:
- Part-IS Risk Assessment Example: The Step-by-Step Guide — the five-step method, with a worked register entry and the mitigation taxonomy under IS.I.OR.210.
Implementation by approval type
The regulation is proportionate to the size and complexity of your organisation, but the shape of the work differs sharply by approval. These are the role-specific guides:
Part-145 maintenance organisations
The most useful framing in a hangar is that laptops, USB drives and portable data loaders have become safety-critical tooling — and you already have a mature discipline for controlling safety-critical tooling.
- Part-IS for Part-145: What Engineers Need to Know — the three MRO-specific risk classes, and which MOE chapters need amending.
CAMOs
A CAMO is a data factory. What it most needs to protect is the integrity of airworthiness records, and its largest exposure is usually the subcontractor chain under IS.I.OR.235.
- Part-IS for CAMOs: Specific Requirements & Implementation Guide — identifying your in-scope elements, subcontractor liability, and the two options for amending your CAME.
- Contracted vs Subcontracted CAMO Activities Under Part-CAMO — the contracting distinction that determines where your oversight obligation lands.
Flight crew and flight operations
The threat that matters most in the cockpit is not the one that fails loudly. Jamming removes a service and annunciates. Spoofing corrupts truth silently — a loss of integrity with no flag.
- GPS Spoofing vs. Jamming: A Pilot’s Guide to Part-IS Threats — recognition cues, the containment procedure, and how crew reporting feeds IS.I.OR.215.
Competence under IS.I.OR.240 — and the two levels of training
IS.I.OR.240 places the duty on the organisation, not on individual staff. Points (f) to (i) require you to have processes in place ensuring you have sufficient personnel on duty for the activities covered by the Annex, that they have the necessary competence to perform their tasks, that they acknowledge the responsibilities attached to their assigned roles, and that the identity and trustworthiness of personnel with access to in-scope systems and data are appropriately established. It is the clause organisations find hardest to evidence, because “we ran a cyber-awareness module” does not demonstrate that a line engineer understands the specific threat scenarios in their operational environment.
In practice that competence obligation splits across two distinct populations, which is why Raven runs two courses at different levels:
| Part-IS Awareness Training | Part-IS Management & Compliance | |
|---|---|---|
| For | Personnel with access to in-scope information systems — typically crew, engineers, ground and dispatch staff | Accountable Managers, Compliance Monitoring Managers, Safety Managers, Nominated Persons and the people building the ISMS |
| Purpose | Evidence workforce competence for the tasks personnel actually perform | Design, implement and audit the ISMS itself |
| Course | EASA Part-IS Awareness Training | EASA Part-IS Management & Compliance |
Use these to test your existing programme before you buy anything:
- The IS.I.OR.240 Competence Checklist: Is Your Aviation Staff Audit-Ready? — a domain-by-domain audit aid for Compliance Monitoring Managers.
- Part-IS Compliance: Building the Human Firewall — how a syllabus maps clause by clause to the requirements.
If you already hold ISO 27001
ISO 27001 is a genuine head start and EASA does not ask you to discard it. But certification alone does not satisfy Part-IS, for one structural reason: ISO permits you to accept a risk on cost-benefit grounds. Part-IS does not, where accepting it would erode the safety margin.
- Part-IS vs. ISO 27001: Key Differences for Aviation Organizations — where the two diverge, and how to bridge rather than rebuild.
Governance: why this is a management obligation
Part-IS treats information security risk as a safety matter, which is why it is a management responsibility rather than an IT one. The regulation does not require a formal link between your ISMS and your SMS — but IS.I.OR.200(d) does permit the processes, procedures, roles and responsibilities you establish to be integrated within management systems you already operate, and EASA guidance notes that an organisation may align the ISMS with other management systems, safety management systems among them. Note that Regulation (EU) 2023/203 separately inserts new points requiring the ISMS in addition to your existing management system, so integration is about not duplicating effort rather than folding one into the other.
- Beyond the IT Department: Why EASA Part-IS is Every Manager’s Business — accountability, contracted activities, and the questions to ask this week.
- EASA Part-IS: A Guide to Regulation (EU) 2023/203 & 2022/1645 — the two-act structure in detail.
- EASA Part-IS ISMS: Safeguarding Aviation in the Digital Age — why an ISMS and an SMS share the same objective.
Where organisations get stuck
- The Top 5 Part-IS Challenges for Aviation Organizations — ISMS/SMS integration, the subcontractor chain, unpatchable legacy systems, the competence gap and SME resourcing.
- Legacy technology that cannot be patched is not an automatic non-compliance — it calls for compensatory controls such as air-gapping and removable-media restriction, documented as part of your risk treatment under IS.I.OR.210.
Frequently asked questions
When did Part-IS apply?
Regulation (EU) 2023/203 applies from 22 February 2026 for air operators, Part-145 organisations, CAMOs and ATOs. The Delegated Regulation (EU) 2022/1645 applied from 16 October 2025 for design organisations, production organisations and aerodrome operators.
Which clause covers suppliers and subcontractors?
IS.I.OR.235, “Contracting of information security management activities”. Contracted activities must comply with the Regulation and the contracted organisation must work under your oversight. IS.I.OR.225 is a different clause — it covers your response to findings raised by the competent authority.
How quickly must an incident be reported externally?
Under IS.I.OR.230, as soon as possible and not exceeding 72 hours from when the condition became known to the organisation, to your competent authority. This is a separate duty from occurrence reporting under Regulation (EU) No 376/2014.
Does Part-IS apply to individual staff?
No. Article 2(1) and IS.I.OR.100 address organisations — Part-145 organisations, CAMOs, air operators, ATOs, aero-medical centres, FSTD operators, ATM/ANS organisations and U-space service providers. The Regulation imposes no duty on individuals; the obligations concerning personnel fall on the organisation.
Do we need a separate ISMS manual?
IS.I.OR.250 requires an information security management manual. Whether that lives as a standalone document or as a defined part of your existing exposition is an organisational choice — what matters is that it exists and is auditable.
Do we need to hire a CISO?
The requirements are proportionate to the size and complexity of the organisation. In smaller organisations the responsibility is commonly held by an existing postholder rather than a dedicated appointment.
Regulatory references on this page are taken from Commission Implementing Regulation (EU) 2023/203 and Commission Delegated Regulation (EU) 2022/1645. Always verify against the current consolidated text and any applicable AMC/GM before relying on it for compliance decisions.
Responses