Part-IS for Part-145: What Engineers Need to Know

For decades, the “Golden Rule” of aircraft maintenance has been tool control. Every socket, wrench, and screwdriver must be accounted for before an aircraft is released. If a tool is left behind, it is a Foreign Object Debris (FOD) risk that could cause a serious incident or accident.

Under Part-IS, the definition of a “tool” has changed.

Laptops, USB sticks, and Portable Data Loaders (PDLs) are now safety-critical tools. A virus introduced into an avionics bay via a corrupted maintenance laptop is the new “digital FOD.” This article explains Part-IS for Part-145 MROs, focusing on what engineers and quality managers need to do to keep the hangar secure.

The New Hangar Hazard: Digital FOD

Modern aircraft are essentially flying data centers. Maintenance is no longer just about changing filters and lubricating actuators; it involves uploading navigation databases, updating FMS software, and downloading engine health monitoring data.

Part-IS mandates that Part-145 organizations treat these digital activities with the same rigor as physical repairs. The regulation (Implementing Regulation (EU) 2023/203) requires MROs to identify and protect “Critical Assets”—equipment that, if compromised, could endanger the safety of the aircraft.

3 Critical Risks in the MRO Environment

Unlike an office environment, a hangar is dirty, fast-paced, and mobile. This creates unique cyber risks that standard IT policies often miss.

1. Portable Data Loaders (PDLs) & USB Sticks

The humble USB stick is the most dangerous item in a hangar. Engineers often use personal USB drives to transfer software updates or manuals.

• The Risk: A USB drive infected with malware from a home PC is plugged into a PDL. The malware moves from the PDL into the aircraft’s avionics during a software load.
• Part-IS Requirement: “Digital Tool Control.” Just as you wouldn’t bring a personal wrench to work, you cannot use personal media. USB sticks must be issued, serialized, and scanned for viruses before every use.

2. Connected Test Equipment

Ground support equipment (GSE) is getting smarter. Hydraulic rigs and power units now have Wi-Fi for remote diagnostics.

• The Risk: An attacker accesses the hangar’s Wi-Fi and modifies the parameters of a test rig, causing it to over-pressurize a system during a test, leading to invisible structural damage.
• Part-IS Requirement: Segregation. The hangar Wi-Fi used for guest internet should never be the same network used for maintenance data or connected tools.

3. The “Unpatched” Maintenance Laptop

Many specialized diagnostic tools (like engine Borescope kits or legacy avionics loaders) run on old operating systems (Windows XP/7) because the vendor software hasn’t been updated.

• The Risk: These outdated systems are full of known security holes. If they connect to the internet, they can be easily hacked.
• Part-IS Requirement: Compensatory Controls. If you must use a Windows XP laptop, it must be permanently air-gapped (never connected to the internet) and strictly controlled.

“Digital Tool Control”: A Concept for Engineers

The easiest way to implement Part-IS in a Part-145 environment is to speak the engineer’s language. Stop calling it “Cybersecurity” and start calling it “Digital Tool Control.”

Implementation for the Quality Manager

If you are a Quality Manager (QM) or Compliance Monitoring Manager (CMM), you need to update your Maintenance Organisation Exposition (MOE).

• Update MOE Chapter 2 (Safety Policy): Include Information Security as a key safety objective.
• Update MOE Chapter 3 (Quality System): Add “Information Security Audits” to your audit plan. You need to verify that engineers are actually scanning USBs and locking laptops.
• Vendor Control: If you hire external NDT specialists who bring their own laptops, your procedures must dictate how their devices are checked before they connect to your aircraft.
• Train your staff. Raven offers EASA Part-IS Awareness Training which includes scenario related to maintenance events.

Conclusion

Part-IS for Part-145 is not about turning mechanics into IT experts. It is about extending the culture of safety and discipline to the digital tools we use every day.

An engineer would never install a bogus part from an unapproved supplier. Similarly, under Part-IS, they must never install software from an unverified USB stick. The principle is identical: Only trust what you can verify.