The aviation industry is currently navigating its most significant regulatory shift in a decade. With the implementation of Regulation (EU) 2023/203, the European Union Aviation Safety Agency (EASA) has effectively mandated that cybersecurity be treated with the same rigor as airworthiness. This shift is essential for achieving Part-IS Compliance.

For Air Operators (AOC), Maintenance Organizations (Part-145), CAMOs, and Approved Training Organisations (ATOs), Part-IS.I.OR applies from 22 February 2026, per Article 16 of Regulation (EU) 2023/203. From that date, organizations must demonstrate that their Information Security Management System (ISMS) is not just written on paper, but fully operational within the workforce to ensure Part-IS Compliance.

The most challenging aspect for many operators is IS.I.OR.240. The duty falls on the organisation, not on individual staff: it must have processes in place to ensure it has sufficient personnel on duty to carry out the activities covered by the Annex, that those personnel have the necessary competence to perform their tasks, that they acknowledge the responsibilities associated with their assigned roles and tasks, and that the identity and trustworthiness of personnel who have access to in-scope information systems and data are appropriately established.

How do you certify an entire workforce before the deadline? The answer lies in mapping your training directly to the Acceptable Means of Compliance (AMC).

The “Competence” Gap

Many organizations have excellent IT security policies but lack the evidence to prove that a pilot, mechanic, or dispatcher understands them. This “Competence Gap” is a primary target for auditors during the transition phase.

Raven has developed a dedicated EASA Part-IS Awareness Training to bridge this specific gap. Unlike generic corporate cybersecurity courses, this syllabus acts as a direct extension of your compliance manual, mapping lesson-by-lesson to the regulatory requirements. The staff who build and maintain that manual and the ISMS behind it are served by our Part-IS management and compliance course.

Mapping Training to Regulation (Part-IS.I.OR)

To ensure audit readiness, our curriculum is structured to satisfy the following key regulatory domains:

1. Policy Awareness (IS.I.OR.200)

The regulation requires that all staff are aware of the organization’s information security policy.

• The Compliance Solution: Our Cyber Hygiene module covers the mandatory “Acceptable Use Policy” elements, including Access Control (IS.I.OR.200(a)(3)) and the “Clear Desk / Clear Screen” policy. This provides evidenced training that your staff understands the boundaries of your network.

2. Risk Identification (IS.I.OR.205)

Organisations must identify all their elements which could be exposed to information security risks — their activities, facilities and resources, the services they operate, provide, receive or maintain, and the equipment, systems, data and information that contribute to the functioning of those elements — together with the threats to them.

• The Compliance Solution: We move beyond theory by training staff to recognize threats specific to their role.
  • Pilots are trained to detect GPS Spoofing and EFB anomalies.
  • Engineers learn to identify “Bridging Attacks” where maintenance laptops can transfer malware to aircraft avionics.
  • In our view, this is what builds a working understanding of “Threat Scenarios” across the workforce.

3. The Reporting Scheme (IS.I.OR.215)

An ISMS is useless if staff do not report events. IS.I.OR.215 mandates an internal reporting scheme that promotes a “Just Culture”.

• The Compliance Solution: The course dedicates a full module to The Internal Alert, training staff to distinguish between a “Technical Glitch” and a “Security Event.” Crucially, it reinforces that reporting a mistake (like clicking a phishing link) is a safety duty, not a punishable offense.

4. Supply Chain Integrity (IS.I.OR.235)

Organizations are responsible for the risks introduced by their suppliers.

• The Compliance Solution: We teach the “Chain of Trust” principle. Staff learn to apply a “Reality Check” to data received from third-party vendors (such as NavData providers) before using it operationally, ensuring the organization maintains control over supplier risks.

5. Detection and Response (IS.I.OR.220)

Finally, the organization must have measures to “detect, respond to, and recover from” incidents.

• The Compliance Solution: The training provides immediate operational protocols for Containment. Staff are taught the “Golden Rule” of detection (recognizing illogical system behavior) and the specific steps to Disconnect and Isolate compromised systems to prevent the spread of an attack.

Training is only part of what an auditor will ask to see. Our step-by-step guide to EASA Part-IS covers the documentation, risk register and reporting evidence that sit alongside it.