For decades, the “Golden Rule” of aircraft maintenance has been tool control. Every socket, wrench, and screwdriver must be accounted for before an aircraft is released. If a tool is left behind, it is a Foreign Object Debris (FOD) risk that could cause a serious incident or accident.

Under Part-IS, the definition of a “tool” has changed.

Laptops, USB sticks, and Portable Data Loaders (PDLs) are now safety-critical tools. A virus introduced into an avionics bay via a corrupted maintenance laptop is the new “digital FOD.” This article explains Part-IS for Part-145 MROs, focusing on what engineers and quality managers need to do to keep the hangar secure.

The New Hangar Hazard: Digital FOD

Modern aircraft are essentially flying data centers. Maintenance is no longer just about changing filters and lubricating actuators; it involves uploading navigation databases, updating FMS software, and downloading engine health monitoring data.

Part-IS mandates that Part-145 organizations treat these digital activities with the same rigor as physical repairs. The regulation (Implementing Regulation (EU) 2023/203) requires MROs to identify all their elements which could be exposed to information security risks — their activities, facilities, resources and services, together with the equipment, systems, data and information that contribute to the functioning of those elements — and to protect them.

3 Critical Risks in the MRO Environment

Unlike an office environment, a hangar is dirty, fast-paced, and mobile. This creates unique cyber risks that standard IT policies often miss.

1. Portable Data Loaders (PDLs) & USB Sticks

The humble USB stick is the most dangerous item in a hangar. Engineers often use personal USB drives to transfer software updates or manuals.

• The Risk: A USB drive infected with malware from a home PC is plugged into a PDL. The malware moves from the PDL into the aircraft’s avionics during a software load.
• Part-IS Requirement: controls over the digital tools you use — what we informally call digital tool control. Just as you wouldn’t bring a personal wrench to work, you cannot use personal media. USB sticks must be issued, serialized, and scanned for viruses before every use.

2. Connected Test Equipment

Ground support equipment (GSE) is getting smarter. Hydraulic rigs and power units now have Wi-Fi for remote diagnostics.

• The Risk: An attacker accesses the hangar’s Wi-Fi and modifies the parameters of a test rig, causing it to over-pressurize a system during a test, leading to invisible structural damage.
• Part-IS Requirement: Segregation. The hangar Wi-Fi used for guest internet should never be the same network used for maintenance data or connected tools.

3. The “Unpatched” Maintenance Laptop

Many specialized diagnostic tools (like engine Borescope kits or legacy avionics loaders) run on old operating systems (Windows XP/7) because the vendor software hasn’t been updated.

• The Risk: These outdated systems are full of known security holes. If they connect to the internet, they can be easily hacked.
• Part-IS Requirement: Compensatory Controls. If you must use a Windows XP laptop, it must be permanently air-gapped (never connected to the internet) and strictly controlled.

Digital tool control: a way of explaining Part-IS to engineers

The easiest way to implement Part-IS in a Part-145 environment is to speak the engineer’s language. Stop calling it “cybersecurity” and start calling it digital tool control. This is our own descriptive label, not a term used in the regulation, but it lands quickly on the shop floor.

Physical Tool Control (Part-145)	The digital equivalent under Part-IS
Inspect tool for damage before use.	Scan USB/Laptop for malware before use.
Use only approved/calibrated tools.	Use only approved/verified software versions.
Return tool to shadow board.	Log off and secure the laptop after task.
Report lost tooling immediately.	Report lost USBs or weird laptop behavior immediately.

Implementation for the Quality Manager

If you are a Quality Manager (QM) or Compliance Monitoring Manager (CMM), you need to update your Maintenance Organisation Exposition (MOE) — and if you are the person who will own the ISMS documentation, our Part-IS course for management and compliance postholders covers that drafting work.

• Update MOE Chapter 2 (Safety Policy): Include Information Security as a key safety objective.
• Update MOE Chapter 3 (Quality System): Add “Information Security Audits” to your audit plan. You need to verify that engineers are actually scanning USBs and locking laptops.
• Vendor Control: If you hire external NDT specialists who bring their own laptops, your procedures must dictate how their devices are checked before they connect to your aircraft.
• Train your staff. Raven offers EASA Part-IS Awareness Training which includes scenario related to maintenance events.

Conclusion

Part-IS for Part-145 is not about turning mechanics into IT experts. It is about extending the culture of safety and discipline to the digital tools we use every day.

An engineer would never install a bogus part from an unapproved supplier. Similarly, under Part-IS, they must never install software from an unverified USB stick. The principle is identical: Only trust what you can verify.

If your organisation also runs a CAMO, our Part-IS for CAMOs guide covers the airworthiness-data side of the same regulation, and if you’re benchmarking against an existing ISO 27001 programme, Part-IS vs. ISO 27001 sets out exactly where the two diverge.

Part-145 is one of several approval types caught by the rule. For the wider picture, including CAMO, AOC and ATO obligations, read our complete Part-IS implementation guide.