Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)
EASA eRules: aviation rules for the 21st century
Rules are the core of the EU civil aviation system. The aim of the EASA eRules project is to make themaccessible to stakeholders in an efficient and reliable way.
The EASA eRules is a comprehensive, single system for structuring, sharing, and storing of rules. It is
the single, easy-access online database for all aviation safety rules applicable to European airspace
users.
The Easy Access Rules (EAR) are the output of the eRules project. They are consolidated versions of
those rules, combining EU regulations with EASA certification specifications (CSs), acceptable meansof compliance (AMC), and guidance material (GM) in an easy-to-read format with advanced navigation
features through links and bookmarks. EAR are regularly updated, following the adoption of an official
publication.
The EAR are available:—in PDF format;—

as dynamic online publications (online format) with a wide range of functionalities, such asfilters to obtain regulatory material tailored to one’s needs, a search function through the tableof contents to quickly access the relevant sections, and easy navigation for computers, tablets,
and mobiles; and—in XML (machine-readable format) that can be easily processed and automated by recipients,
producing output that is compatible and can be synchronised with local applications, searchdatabases, etc.

The EASA eRules system is developed and implemented in close cooperation with the Member States
and aviation industry to ensure that all its capabilities are relevant and effective.
Published August 20241
Copyright notice© European Union, 1998-2024
Unless otherwise specified, you can re-use the legal documents published in EUR-Lex for commercial or non-commercial
purposes […] ('© European Union, http://eur-lex.europa.eu/, 1998-2023') 2.

1

The published date represents the date when the consolidated version of the document was generated.

2Euro-Lex, Important Legal Notice: http://eur-lex.europa.eu/content/legal-notice/legal-notice.html.

Powered by EASA eRules

Page 2 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Disclaimer

DISCLAIMER
This document is issued by the European Union Aviation Safety Agency (referred to as both ‘EASA’ and‘the Agency’) to provide its stakeholders with an updated, consolidated, and easy-to-read publication.
It has been prepared by putting together the officially published EU regulations with the related EASA
acceptable means of compliance (AMC) and guidance material (GM) (including their amendments)
adopted so far. However, this document is not an official publication, and EASA accepts no liability fordamage of any kind resulting from the risks inherent in its use.

Powered by EASA eRules

Page 3 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

List of revisions

LIST OF REVISIONS
Published

Reason for revisionFirst Easy Access Rules document powered by eRules.
The EAR incorporate:—

Commission Implementing Regulation (EU) 2023/203 laying down rules forthe application of Regulation (EU) 2018/1139, as regards requirements forthe management of information security risks with a potential impact onaviation safety for organisations and competent authorities covered byCommission Regulation (EU) No 1178/2011, and amending said Regulation;—

Commission Delegated Regulation (EU) 2022/1645 laying down rules for theapplication of Regulation (EU) 2018/1139, as regards requirements for the
management of information security risks with a potential impact onaviation safety for organisations covered by Commission Regulations (EU)No 748/2012 and (EU) No 139/2014, and amending said Regulations;—

ED Decision 2023/008/R ‘Management of information security risks’ thatprovides for AMC & GM to the Articles of Regulation (EU) 2022/1645 andRegulation (EU) 2023/203;—

ED Decision 2023/009/R ‘Management of information security risks’ thatprovides for AMC & GM to support the Part-IS regulatory package
implementation - Part-IS.D.OR and Part-IS.I.OR; and—ED Decision 2023/010/R ‘Management of information security risks’ thatprovides for AMC & GM to support the Part-IS regulatory package
implementation - Part-IS.AR.

October 2023

To incorporate:—

Commission Implementing Regulation (EU) 2023/1769 amending Articles 2
and 6 of Commission Implementing Regulation (EU) 2023/203.

—

Commission Implementing Regulation (EU) 2024/1109 amending Articles 2
and 4 of Commission Implementing Regulation (EU) 2023/203.

—

Editorial changes to:June 2024

Powered by EASA eRules—

Article 15 and Annexes III, IV, V, VI, VII, VIII and IX to Commission
Implementing Regulation (EU) 2023/203;—

Articles 6 and 7 of Commission Delegated Regulation 2022/1645.

Page 4 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Note from the editor

NOTE FROM THE EDITOR
The content of this document is arranged as follows: the cover regulation (recitals and articles) of theimplementing rule (IR) appears first, then the IR annex points, followed by the related acceptablemeans of compliance (AMC) and guidance material (GM). As last, comes the delegated rule (DR) andthe DR annex points.
All elements (i.e. articles, IRs, DRs, AMC, and GM) are colour-coded and can be identified according to
the illustration below. The EU regulation or EASA Executive Director (ED) decision through which thearticle, IR, DR, AMC, or GM was introduced or last amended is indicated below the article, IR, DR, AMC,
or GM title in italics.

Cover regulation article
EU regulation

Implementing rule annex or delegated rule annex
EU regulation

Acceptable means of compliance
ED decision

Guidance material
ED decisionThis document will be updated regularly to incorporate further amendments.
The format of this document has been adjusted to make it user-friendly and for reference purposes.
Any comments should be sent to erules@easa.europa.eu.

Powered by EASA eRules

Page 5 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Incorporated amendments

INCORPORATED AMENDMENTS
IMPLEMENTING RULES (IRS) (COMMISSION REGULATIONS)
Incorporated Regulation

Regulation amendment

Applicability date1

Regulation (EU) 2023/203

Initial issue

22/2/20262

Regulation (EU) 2023/1769

n/a

5/10/2023

Regulation (EU) 2024/1109

n/a

1/5/2024

DELEGATED RULES (DRS) (COMMISSION REGULATIONS)
Incorporated Regulation

Regulation amendment

Applicability date

Regulation (EU) 2022/1645

Initial issue

16/10/2025

AMC & GM TO IRS (ED DECISIONS)
Incorporated ED Decisions

AMC/GM Issue No, Amendment No

Applicability date

ED Decision 2023/008/R

Issue 122/2/2026

ED Decision 2023/009/R

Issue 122/2/2026

ED Decision 2023/010/R

Issue 122/2/2026

Note: To access the official versions, please click on the hyperlinks provided above.

1

This is the main date of application (i.e. the date from which an act or a provision in an act produces its full legal effects) as defined in
the relevant cover regulation article. Some provisions of the regulations though may be applicable at a later date (deferred applicability).
Besides, there may be some opt-outs (derogations from certain provisions) notified by the Member States.

2‘As regards the case of the EGNOS air navigation service provider subject to Implementing Regulation (EU) 2017/373 it shall apply from
1 January 2026.’.

Powered by EASA eRules

Page 6 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Table of contents

TABLE OF CONTENTS
Disclaimer ...................................................................................... 3
List of revisions .............................................................................. 4
Note from the editor ...................................................................... 5
Incorporated amendments ............................................................. 6
Table of contents ........................................................................... 7
Implementing Regulation (EU) 2023/203 ...................................... 16
Cover Regulation to Implementing Regulation (EU) 2023/203 .............. 16
Article 1 – Subject matter .................................................................................. 20
GM1 Article 1 — Subject matter .............................................................................. 20

Article 2 – Scope ................................................................................................ 20
Article 3 – Definitions ........................................................................................ 22
GM1 Article 3 — Definitions .................................................................................... 23

Article 4 – Requirements for organisations and competent authorities .............. 25
Article 5 – Requirements arising from other Union legislation ............................ 25
Article 6 – Competent authority ........................................................................ 26
Article 7 – Submission of relevant information to NIS competent authorities ..... 26
Article 8 – Amendment to Regulation (EU) No 1178/2011 .................................. 27
Article 9 – Amendment to Regulation (EU) No 748/2012 .................................... 27
Article 10 – Amendment to Regulation (EU) No 965/2012 .................................. 27
Article 11 – Amendment to Regulation (EU) No 139/2014 .................................. 27
Article 12 – Amendment to Regulation (EU) No 1321/2014 ................................ 27
Article 13 – Amendment to Regulation (EU) 2015/340 ....................................... 27
Article 14 – Amendment to Regulation (EU) 2017/373 ....................................... 27
Article 15 – Amendment to Regulation (EU) 2021/664 ....................................... 27
Article 16 .......................................................................................................... 28

ANNEX I — INFORMATION SECURITY — AUTHORITY REQUIREMENTS[PART-IS.AR] ........................................................................................ 29
IS.AR.100 Scope ................................................................................................ 29
IS.AR.200 Information security management system (ISMS) .............................. 29
Powered by EASA eRules

Page 7 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Table of contents

GM1 IS.AR.200 Information security management system (ISMS) ............................ 30
AMC1 IS.AR.200(a)(1) Information security management system ............................. 36
GM1 IS.AR.200(a)(1) Information security management system (ISMS) .................... 37
AMC1 IS.AR.200(a)(8) Information security management system (ISMS) .................. 38
GM1 IS.AR.200(a)(8) Information security management system (ISMS) .................... 38
AMC1 IS.AR.200(a)(9) Information security management system (ISMS) .................. 38
AMC1 IS.AR.200(a)(11) Information security management system (ISMS) ................. 39
AMC1 IS.AR.200(c) Information security management system (ISMS) ....................... 39
GM1 IS.AR.200(c) Information security management system (ISMS) ......................... 40
GM1 IS.AR.200(d) Information security management system (ISMS) ........................ 40

IS.AR.205 Information security risk assessment ................................................. 41
GM1 IS.AR.205 Information security risk assessment ............................................... 42
AMC1 IS.AR.205(a) Information security risk assessment ......................................... 42
GM1 IS.AR.205(a) Information security risk assessment ........................................... 43
AMC1 IS.AR.205(b) Information security risk assessment ......................................... 43
GM1 IS.AR.205(b) Information security risk assessment ........................................... 44
GM2 IS.AR.205(b) Information security risk assessment ........................................... 45
AMC1 IS.AR.205(c) Information security risk assessment .......................................... 45
GM1 IS.AR.205(c) Information security risk assessment ........................................... 46
AMC1 IS.AR.205(d) Information security risk assessment ......................................... 51
GM1 IS.AR.205(d) Information security risk assessment ........................................... 51
GM2 IS.AR.205(d) Information security risk assessment ........................................... 52

IS.AR.210 Information security risk treatment ................................................... 53
GM1 IS.AR.210 Information security risk treatment ................................................. 54
AMC1 IS.AR.210(a) Information security risk treatment ........................................... 55

IS.AR.215 Information security incidents — detection, response and recovery ... 55
GM1 IS.AR.215 Information security incidents — detection, response and recovery . 56
AMC1 IS.AR.215(a) Information security incidents — detection, response and recovery............................................................................................................................... 56
GM1 IS.AR.215(a) Information security incidents — detection, response and recovery............................................................................................................................... 57
AMC1 IS.AR.215(b) Information security incidents — detection, response and recovery............................................................................................................................... 57
GM1 IS.AR.215(b) Information security incidents — detection, response and recovery............................................................................................................................... 58
AMC1 IS.AR.215(c) Information security incidents — detection, response and recovery............................................................................................................................... 59
GM1 IS.AR.215(b)&(c) Information security incidents — detection, response andrecovery ................................................................................................................. 59
GM1 IS.AR.215(c) Information security incidents— detection, response and recovery............................................................................................................................... 61

IS.AR.220 Contracting of information security management activities ................ 61
AMC1 IS.AR.220 Contracting of information security management activities ............ 62
GM1 IS.AR.220 Contracting of information security management activities .............. 63
GM2 IS.AR.220 Contracting of information security management activities .............. 63
GM3 IS.AR.220 Contracting of information security management activities .............. 64
GM4 IS.AR.220 Contracting of information security management activities .............. 65
GM5 IS.AR.220 Contracting of information security management activities .............. 66
Powered by EASA eRules

Page 8 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Table of contents

IS.AR.225 Personnel requirements..................................................................... 66
GM1 IS.AR.225 Personnel requirements .................................................................. 67
AMC1 IS.AR.225(a) Personnel requirements ............................................................ 67
GM1 IS.AR.225(a) Personnel requirements .............................................................. 67
AMC1 IS.AR.225(b) Personnel requirements ............................................................ 68
GM1 IS.AR.225(b) Personnel requirements .............................................................. 68
AMC1 IS.AR.225(c) Personnel requirements ............................................................. 68
GM1 IS.AR.225(c) Personnel requirements............................................................... 69
AMC1 IS.AR.225(d) Personnel requirements ............................................................ 69
GM1 IS.AR.225(d) Personnel requirements .............................................................. 69
AMC1 IS.AR.225(e) Personnel requirements ............................................................ 70
GM1 IS.AR.225(e) Personnel requirements .............................................................. 70

IS.AR.230 Record-keeping.................................................................................. 71
GM1 IS.AR.230 Record-keeping ............................................................................... 72
AMC1 IS.AR.230(a)(1)(iv)&(a)(4) Record-keeping ..................................................... 72
GM1 IS.AR.230(a)(1)(iv)&(a)(4) Record-keeping ....................................................... 72
AMC1 IS.AR.230(c)&(d) Record-keeping ................................................................... 72
GM1 IS.AR.230(c)&(d) Record-keeping..................................................................... 73

IS.AR.235 Continuous improvement .................................................................. 73
AMC1 IS.AR.235 Continuous improvement .............................................................. 74
GM1 IS.AR.235 Continuous improvement ................................................................ 74
AMC1 IS.AR.235(a) Continuous improvement .......................................................... 76
GM1 IS.AR.235(a) Continuous improvement ............................................................ 77
AMC1 IS.AR.235(b) Continuous improvement .......................................................... 78
GM1 IS.AR.235(b) Continuous improvement ............................................................ 79

Appendix I — Examples of threat scenarios with a potential harmful impact onsafety ................................................................................................................ 80
Appendix II — Main tasks stemming from the implementation of Part-IS, including
mapping to NIST CSF 1.1 competencies and ISO/IEC 27001 clauses and controls. 87
Appendix III — Examples of aviation services ..................................................... 93

ANNEX II — INFORMATION SECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR] ............................................................ 94
IS.I.OR.100 Scope .............................................................................................. 94
IS.I.OR.200 Information security management system (ISMS) ............................ 94
GM1 IS.I.OR.200 Information security management system (ISMS) .......................... 95
AMC1 IS.I.OR.200(a)(1) Information security management system (ISMS) .............. 101
GM1 IS.I.OR.200(a)(1) Information security management system (ISMS) ................ 102
AMC1 IS.I.OR.200(a)(12) Information security management system (ISMS) ............ 103
GM1 IS.I.OR.200(a)(12) Information security management system (ISMS) .............. 103
AMC1 IS.I.OR.200(a)(13) Information security management system (ISMS) ............ 104
AMC1 IS.I.OR.200(c) Information security management system (ISMS) ................... 104
GM1 IS.I.OR.200(c) Information security management system (ISMS) .................... 105
GM1 IS.I.OR.200(d) Information security management system (ISMS) .................... 105
AMC1 IS.I.OR.200(e) Information security management system (ISMS) .................. 107
GM1 IS.I.OR.200(e) Information security management system (ISMS) .................... 107
Powered by EASA eRules

Page 9 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Table of contents

IS.I.OR.205 Information security risk assessment ............................................. 108
GM1 IS.I.OR.205 Information security risk assessment ........................................... 109
AMC1 IS.I.OR.205(a) Information security risk assessment ..................................... 109
GM1 IS.I.OR.205(a) Information security risk assessment ....................................... 109
AMC1 IS.I.OR.205(b) Information security risk assessment ..................................... 110
GM1 IS.I.OR.205(b) Information security risk assessment ....................................... 110
GM2 IS.I.OR.205(b) Information security risk assessment ....................................... 111
AMC1 IS.I.OR.205(c) Information security risk assessment ..................................... 111
GM1 IS.I.OR.205(c) Information security risk assessment ....................................... 112
AMC1 IS.I.OR.205(d) Information security risk assessment ..................................... 117
GM1 IS.I.OR.205(d) Information security risk assessment ....................................... 117
GM2 IS.I.OR.205(d) Information security risk assessment ....................................... 118
AMC1 IS.I.OR.205(e) Information security risk assessment ..................................... 119
GM1 IS.I.OR.205(e) Information security risk assessment ....................................... 119

IS.I.OR.210 Information security risk treatment ............................................... 120
GM1 IS.I.OR.210 Information security risk treatment ............................................. 121
AMC1 IS.I.OR.210(a) Information security risk treatment ....................................... 122

IS.I.OR.215 Information security internal reporting scheme ............................. 122
AMC1 IS.I.OR.215(a)&(b) Information security internal reporting scheme............... 123
GM1 IS.I.OR.215(a)&(b) Information security internal reporting scheme ................ 123
GM2 IS.I.OR.215(a)&(b) Information security internal reporting scheme ................ 123
GM3 IS.I.OR.215(a)&(b) Information security internal reporting scheme ................ 124
GM1 IS.I.OR.215(c) Information security internal reporting scheme ....................... 124
GM1 IS.I.OR.215(d) Information security internal reporting scheme ....................... 125

IS.I.OR.220 Information security incidents — detection, response and recovery125
GM1 IS.I.OR.220 Information security incidents — detection, response and recovery............................................................................................................................. 126
AMC1 IS.I.OR.220(a) Information security incidents — detection, response andrecovery ............................................................................................................... 126
GM1 IS.I.OR.220(a) Information security incidents — detection, response and recovery............................................................................................................................. 127
AMC1 IS.I.OR.220(b) Information security incidents — detection, response andrecovery ............................................................................................................... 127
GM1 IS.I.OR.220(b) Information security incidents — detection, response and recovery............................................................................................................................. 128
AMC1 IS.I.OR.220(c) Information security incidents — detection, response and recovery............................................................................................................................. 129
GM1 IS.I.OR.220(b)&(c) Information security incidents — detection, response andrecovery ............................................................................................................... 129
GM1 IS.I.OR.220(c) Information security incidents — detection, response and recovery............................................................................................................................. 131

IS.I.OR.225 Response to findings notified by the competent authority ............. 131
AMC1 IS.I.OR.225 Response to findings notified by the competent authority .......... 132
GM1 IS.I.OR.225 Response to findings notified by the competent authority ........... 132

IS.I.OR.230 Information security external reporting scheme ............................ 132
GM1 IS.I.OR.230 Information security external reporting scheme ........................... 133
AMC1 IS.I.OR.230(a)&(b) Information security external reporting scheme .............. 133
Powered by EASA eRules

Page 10 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Table of contents

GM1 IS.I.OR.230(a)&(b) Information security external reporting scheme ................ 134
AMC1 IS.I.OR.230(c) Information security external reporting scheme ..................... 135
GM1 IS.I.OR.230(c) Information security external reporting scheme ....................... 135

IS.I.OR.235 Contracting of information security management activities ........... 135
GM1 IS.I.OR.235 Contracting of information security management activities .......... 136
GM2 IS.I.OR.235 Contracting of information security management activities .......... 136
GM3 IS.I.OR.235 Contracting of information security management activities .......... 137
AMC1 IS.I.OR.235(a) Contracting of information security management activities .... 139
GM1 IS.I.OR.235(a) Contracting of information security management activities ...... 140
GM2 IS.I.OR.235(a) Contracting of information security management activities ...... 140
AMC1 IS.I.OR.235(b) Contracting of information security management activities .... 141
GM1 IS.I.OR.235(b) Contracting of information security management activities ...... 141

IS.I.OR.240 Personnel requirements ................................................................ 141
GM1 IS.I.OR.240 Personnel requirements .............................................................. 142
AMC1 IS.I.OR.240(a)(2) Personnel requirements .................................................... 142
AMC1 IS.I.OR.240(a)(3) Personnel requirements .................................................... 143
GM1 IS.I.OR.240(a)(3) Personnel requirements ...................................................... 143
AMC1 IS.I.OR.240(b) Personnel requirements ........................................................ 143
GM1 IS.I.OR.240(b) Personnel requirements .......................................................... 144
GM1 IS.I.OR.240(b)&(c) Personnel requirements ................................................... 144
GM1 IS.I.OR.240(c) Personnel requirements .......................................................... 144
AMC1 IS.I.OR.240(d) Personnel requirements ........................................................ 144
GM1 IS.I.OR.240(e) Personnel requirements .......................................................... 145
AMC1 IS.I.OR.240(f) Personnel requirements ......................................................... 145
GM1 IS.I.OR.240(f) Personnel requirements ........................................................... 146
AMC1 IS.I.OR.240(g) Personnel requirements ........................................................ 146
GM1 IS.I.OR.240(g) Personnel requirements .......................................................... 146
AMC1 IS.I.OR.240(h) Personnel requirements ........................................................ 147
GM1 IS.I.OR.240(h) Personnel requirements .......................................................... 147
AMC1 IS.I.OR.240(i) Personnel requirements ......................................................... 147
GM1 IS.I.OR.240(i) Personnel requirements ........................................................... 147

IS.I.OR.245 Record-keeping ............................................................................. 148
GM1 IS.I.OR.245 Record-keeping ........................................................................... 149
AMC1 IS.I.OR.245(a)(1)(vi)&(a)(5) Record-keeping ................................................. 150
GM1 IS.I.OR.245(a)(1)(vi)&(a)(5) Record-keeping ................................................... 150
AMC1 IS.I.OR.245(c)&(d) Record-keeping............................................................... 150
GM1 IS.I.OR.245(c)&(d) Record-keeping ................................................................ 151

IS.I.OR.250 Information security management manual (ISMM) ........................ 151
GM1 IS.I.OR.250(a) Information security management manual (ISMM) .................. 152

IS.I.OR.255 Changes to the information security management system ............. 153
AMC1 IS.I.OR.255 Changes to the information security management system .......... 153
GM1 IS.I.OR.255 Changes to the information security management system............ 154
GM2 IS.I.OR.255 Changes to the information security management system............ 154

IS.I.OR.260 Continuous improvement .............................................................. 156
AMC1 IS.I.OR.260 Continuous improvement .......................................................... 156
GM1 IS.I.OR.260 Continuous improvement ............................................................ 157
AMC1 IS.I.OR.260(a) Continuous improvement ...................................................... 158
Powered by EASA eRules

Page 11 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Table of contents

GM1 IS.I.OR.260(a) Continuous improvement ........................................................ 159
AMC1 IS.I.OR.260(b) Continuous improvement ...................................................... 161
GM1 IS.I.OR.260(b) Continuous improvement........................................................ 161

Appendix I — Examples of threat scenarios with a potential harmful impact onsafety .............................................................................................................. 163
Appendix II — Main tasks stemming from the implementation of Part-IS, including
mapping to NIST CSF 1.1 competencies and ISO/IEC 27001 clauses and controls....................................................................................................................... 170
Appendix III — Examples of aviation services ................................................... 178

ANNEX III — INFORMATION SECURITY — ANNEXES VI (Part-ARA) and VII(Part-ORA) to Regulation (EU) No 1178/2011 ..................................... 179
ANNEX IV — INFORMATION SECURITY — Annex I (Part 21) to Regulation(EU) No 748/2012 ............................................................................... 180
ANNEX V — INFORMATION SECURITY — Annexes II (Part-ARO) and III(Part-ORO) to Regulation (EU) No 965/2012 ....................................... 181
ANNEX VI — INFORMATION SECURITY — Annex II (Part-ADR.AR) to
Regulation (EU) No 139/2014 ............................................................. 182
ANNEX VII — INFORMATION SECURITY — Annexes II (Part-145), III (Part66) and Vc (Part-CAMO) to Regulation (EU) No 1321/2014 ................. 183
ANNEX VIII — INFORMATION SECURITY — Annexes II (Part ATCO.AR)
and III (Part ATCO.OR) to Regulation (EU) 2015/340 ........................... 184
ANNEX IX — INFORMATION SECURITY — Annexes II (Part-ATM/ANS.AR)
and III (Part-ATM/ANS.OR) to Implementing Regulation (EU) 2017/373........................................................................................................... 185

Delegated Regulation (EU) 2022/1645 ........................................ 186
Cover Regulation to Delegated Regulation (EU) 2022/1645 ................ 186
EXPLANATORY MEMORANDUM ...................................................................... 186
Article 1 – Subject matter ................................................................................ 189
GM1 Article 1 — Subject matter ............................................................................ 189

Article 2 – Scope .............................................................................................. 189
Article 3 – Definitions ...................................................................................... 190
GM1 Article 3 — Definitions .................................................................................. 190

Article 4 – Requirements arising from other Union legislation .......................... 194
Article 5 – Competent authority ...................................................................... 194
Article 6 – Amendment to Regulation (EU) No 748/2012 .................................. 194
Powered by EASA eRules

Page 12 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Table of contents

Article 7 – Amendment to Regulation (EU) No 139/2014 .................................. 195
Article 8 .......................................................................................................... 195

ANNEX — INFORMATION SECURITY — ORGANISATION REQUIREMENTS[PART-IS.D.OR] ................................................................................... 196
IS.D.OR.100 Scope ........................................................................................... 196
IS.D.OR.200 Information security management system (ISMS) ......................... 196
GM1 IS.D.OR.200 Information security management system (ISMS) ....................... 197
AMC1 IS.D.OR.200(a)(1) Information security management system (ISMS) ............. 203
GM1 IS.D.OR.200(a)(1) Information security management system (ISMS) ............... 204
AMC1 IS.D.OR.200(a)(12) Information security management system (ISMS) ........... 205
GM1 IS.D.OR.200(a)(12) Information security management system (ISMS) ............. 205
AMC1 IS.D.OR.200(a)(13) Information security management system (ISMS) ........... 206
AMC1 IS.D.OR.200(c) Information security management system (ISMS) ................. 206
GM1 IS.D.OR.200(c) Information security management system (ISMS) ................... 207
GM1 IS.D.OR.200(d) Information security management system (ISMS) ................... 207
AMC1 IS.D.OR.200(e) Information security management system (ISMS) ................. 209
GM1 IS.D.OR.200(e) Information security management system (ISMS) ................... 209

IS.D.OR.205 Information security risk assessment ............................................ 209
GM1 IS.D.OR.205 Information security risk assessment .......................................... 210
AMC1 IS.D.OR.205(a) Information security risk assessment .................................... 211
GM1 IS.D.OR.205(a) Information security risk assessment ...................................... 211
AMC1 IS.D.OR.205(b) Information security risk assessment .................................... 212
GM1 IS.D.OR.205(b) Information security risk assessment ..................................... 212
GM2 IS.D.OR.205(b) Information security risk assessment ..................................... 213
AMC1 IS.D.OR.205(c) Information security risk assessment .................................... 213
GM1 IS.D.OR.205(c) Information security risk assessment ...................................... 214
AMC1 IS.D.OR.205(d) Information security risk assessment .................................... 219
GM1 IS.D.OR.205(d) Information security risk assessment ..................................... 219
GM2 IS.D.OR.205(d) Information security risk assessment ..................................... 220

IS.D.OR.210 Information security risk treatment .............................................. 221
GM1 IS.D.OR.210 Information security risk treatment ............................................ 222
AMC1 IS.D.OR.210(a) Information security risk treatment ...................................... 223

IS.D.OR.215 Information security internal reporting scheme ............................ 223
AMC1 IS.D.OR.215(a)&(b) Information security internal reporting scheme ............. 224
GM1 IS.D.OR.215(a)&(b) Information security internal reporting scheme ............... 224
GM2 IS.D.OR.215(a)&(b) Information security internal reporting scheme ............... 225
GM3 IS.D.OR. 215(a)&(b) Information security internal reporting scheme .............. 225
GM1 IS.D.OR.215(c) Information security internal reporting scheme ...................... 225
GM1 IS.D.OR.215(d) Information security internal reporting scheme ...................... 226

IS.D.OR.220 Information security incidents — detection, response and recovery....................................................................................................................... 226
GM1 IS.D.OR.220 Information security incidents — detection, response and recovery............................................................................................................................. 227
AMC1 IS.D.OR.220(a) Information security incidents — detection, response andrecovery ............................................................................................................... 227
Powered by EASA eRules

Page 13 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Table of contents

GM1 IS.D.OR.220(a) Information security incidents — detection, response and recovery............................................................................................................................. 228
AMC1 IS.D.OR.220(b) Information security incidents — detection, response andrecovery ............................................................................................................... 228
GM1 IS.D.OR.220(b) Information security incidents — detection, response and recovery............................................................................................................................. 229
AMC1 IS.D.OR.220(c) Information security incidents — detection, response andrecovery ............................................................................................................... 230
GM1 IS.D.OR.220(b)&(c) Information security incidents — detection, response andrecovery ............................................................................................................... 230
GM1 IS.D.OR.220(c) Information security incidents — detection, response and recovery............................................................................................................................. 232

IS.D.OR.225 Response to findings notified by the competent authority ............ 232
AMC1 IS.D.OR.225 Response to findings notified by the competent authority ........ 233
GM1 IS.D.OR.225 Response to findings notified by the competent authority .......... 233

IS.D.OR.230 Information security external reporting scheme ........................... 233
GM1 IS.D.OR.230 Information security external reporting scheme ......................... 234
AMC1 IS.D.OR.230(a)&(b) Information security external reporting scheme............. 234
GM1 IS.D.OR.230(a)&(b) Information security external reporting scheme .............. 235
AMC1 IS.D.OR.230(c) Information security external reporting scheme .................... 236
GM1 IS.D.OR.230(c) Information security external reporting scheme...................... 236

IS.D.OR.235 Contracting of information security management activities .......... 236
GM1 IS.D.OR.235 Contracting of information security management activities ........ 237
GM2 IS.D.OR.235 Contracting of information security management activities ........ 237
GM3 IS.D.OR.235 Contracting of information security management activities ........ 238
GM1 IS.D.OR.235(a) Contracting of information security management activities .... 241
AMC1 IS.D.OR.235(a) Contracting of information security management activities... 242
GM2 IS.D.OR.235(a) Contracting of information security management activities .... 243
AMC1 IS.D.OR.235(b) Contracting of information security management activities .. 243
GM1 IS.D.OR.235(b) Contracting of information security management activities .... 243

IS.D.OR.240 Personnel requirements ............................................................... 244
GM1 IS.D.OR.240 Personnel requirements ............................................................. 245
AMC1 IS.D.OR.240(a)(2) Personnel requirements ................................................... 245
AMC1 IS.D.OR.240(a)(3) Personnel requirements ................................................... 245
GM1 IS.D.OR.240(a)(3) Personnel requirements..................................................... 245
AMC1 IS.D.OR.240(b) Personnel requirements ....................................................... 246
GM1 IS.D.OR.240(b) Personnel requirements......................................................... 246
GM1 IS.D.OR.240(b)&(c) Personnel requirements .................................................. 246
GM1 IS.D.OR.240(c) Personnel requirements ......................................................... 247
AMC1 IS.D.OR.240(d) Personnel requirements ....................................................... 247
GM1 IS.D.OR.240(e) Personnel requirements ......................................................... 247
AMC1 IS.D.OR.240(f) Personnel requirements........................................................ 248
GM1 IS.D.OR.240(f) Personnel requirements ......................................................... 248
AMC1 IS.D.OR.240(g) Personnel requirements ....................................................... 248
GM1 IS.D.OR.240(g) Personnel requirements ......................................................... 249
AMC1 IS.D.OR.240(h) Personnel requirements ....................................................... 249
GM1 IS.D.OR.240(h) Personnel requirements......................................................... 249
AMC1 IS.D.OR.240(i) Personnel requirements ........................................................ 250
Powered by EASA eRules

Page 14 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Table of contents

GM1 IS.D.OR.240(i) Personnel requirements.......................................................... 250

IS.D.OR.245 Record-keeping ............................................................................ 251
GM1 IS.D.OR.245 Record-keeping .......................................................................... 252
AMC1 IS.D.OR.245(a)(1)(vi)&(a)(5) Record-keeping ................................................ 252
GM1 IS.D.OR.245(a)(1)(vi)&(a)(5) Record-keeping .................................................. 252
AMC1 IS.D.OR.245(c)&(d) Record-keeping ............................................................. 253
GM1 IS.D.OR.245(c)&(d) Record-keeping ............................................................... 253

IS.D.OR.250 Information security management manual (ISMM) ....................... 254
GM1 IS.D.OR.250(a) Information security management manual (ISMM) ................. 255

IS.D.OR.255 Changes to the information security management system ............ 255
AMC1 IS.D.OR.255 Changes to the information security management system ........ 256
GM1 IS.D.OR.255 Changes to the information security management system .......... 256
GM2 IS.D.OR.255 Changes to the information security management system .......... 257

IS.D.OR.260 Continuous improvement ............................................................. 258
AMC1 IS.D.OR.260 Continuous improvement ......................................................... 258
GM1 IS.D.OR.260 Continuous improvement........................................................... 259
AMC1 IS.D.OR.260(a) Continuous improvement..................................................... 261
GM1 IS.D.OR.260(a) Continuous improvement ...................................................... 262
AMC1 IS.D.OR.260(b) Continuous improvement .................................................... 263
GM1 IS.D.OR.260(b) Continuous improvement ...................................................... 264

Appendix I — Examples of threat scenarios with a potential harmful impact onsafety .............................................................................................................. 265
Appendix II — Main tasks stemming from the implementation of Part-IS, including
mapping to NIST CSF 1.1 competencies and ISO/IEC 27001 clauses and controls....................................................................................................................... 272
Appendix III — Examples of aviation services ................................................... 279

Powered by EASA eRules

Page 15 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

IMPLEMENTING REGULATION (EU) 2023/203
COVER REGULATION TO IMPLEMENTING REGULATION (EU) 2023/203
COMMISSION IMPLEMENTING REGULATION (EU) 2023/203
of 27 October 2022
laying down rules for the application of Regulation (EU) 2018/1139 of the European Parliament and of theCouncil, as regards requirements for the management of information security risks with a potential impact
on aviation safety for organisations covered by Commission Regulations (EU) No 1321/2014, No 965/2012,
No 1178/2011, 2015/340, 2017/373 and 2021/664, and for competent authorities covered by Commission
Regulations (EU) No 748/2012, No 1321/2014, No 965/2012, No 1178/2011, 2015/340, 2017/373, No
139/2014 and 2021/664 and amending Commission Regulations (EU) No 1178/2011, No 748/2012, No
965/2012, No 139/2014, No 1321/2014, 2015/340, 2017/373 and 2021/664
Regulation (EU) 2023/203

THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July
2018 on common rules in the field of civil aviation and establishing a European Union Aviation Safety
Agency, and amending Regulations (EC) No 2111/2005, (EC) No 1008/2008, (EU) No 996/2010, (EU)No 376/2014 and Directives 2014/30/EU and 2014/53/EU of the European Parliament and of theCouncil, and repealing Regulations (EC) No 552/2004 and (EC) No 216/2008 of the European
Parliament and of the Council and Council Regulation (EEC) No 3922/91(1), and in particular Articles
17(1) point (b), 27(1) point (a), 31(1) point (b), 43(1) point (b), 53(1) point (a) and 62(15) point (c)thereof
Whereas:(1)

In accordance with the essential requirements set out in Annex II, point 3.1(b), to Regulation(EU) 2018/1139, continuing airworthiness management organisations and maintenanceorganisations are to implement and maintain a management system to manage safety risks.

(2)

In addition, in accordance with the essential requirements set out in Annex IV, point 3.3(b) andpoint 5(b), to Regulation (EU) 2018/1139, pilot training organisations, cabin crew training
organisations, aero-medical centres for aircrew and operators of flight simulation training
devices are to implement and maintain a management system to manage safety risks.

(3)

Moreover, in accordance with the essential requirements set out in Annex V, point 8.1(c), to
Regulation (EU) 2018/1139, air operators are to implement and maintain a management system
to manage safety risks.

(4)

Furthermore, in accordance with the essential requirements set out in Annex VIII, point 5.1(c)and point 5.4(b), to Regulation (EU) 2018/1139, air traffic management and air navigation
service providers, U-space service providers and single common information service providers,
and training organisations and aero-medical centres for air traffic controllers are to implement
and maintain a management system to manage safety risks.

1

OJ L 212, 22.8.2018, p. 1.

Powered by EASA eRules

Page 16 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203(5)

Those safety risks may derive from different sources, such as design and maintenance flaws,
human performance aspects, environmental threats and information security threats.
Therefore, the management systems implemented by the European Union Aviation Safety
Agency (‘the Agency’) and the national competent authorities and organisations referred to in
the recitals above, should take into account not only safety risks stemming from random events,
but also safety risks deriving from information security threats where existing flaws may be
exploited by individuals with a malicious intent. Those information security risks are constantly
increasing in the civil aviation environment as the current information systems are becoming
more and more interconnected, and increasingly becoming the target of malicious actors.

(6)

The risks associated with those information systems are not limited to possible attacks to thecyberspace, but encompass also threats, which may affect processes and procedures as well as
the performance of human beings.

(7)

A significant number of organisations already use international standards, such as ISO 27001, inorder to address the security of digital information and data. Those standards may not fully
address all the specificities of civil aviation. Therefore, it is appropriate to set out requirements
for the management of information security risks with a potential impact on aviation safety.

(8)

It is essential that those requirements cover all aviation domains and their interfaces, sinceaviation is a highly interconnected system of systems. Therefore, they should apply to all theorganisations and competent authorities covered by Regulation (EU) No 748/2012, Regulation(EU) No 1321/2014, Regulation (EU) No 965/2012, Regulation (EU) No 1178/2011, Regulation(EU) 2015/340, Regulation (EU) No 139/2014 and Regulation (EU) 2021/664, also those that are
already required to have a management system in accordance with the existing Union aviation
safety legislation. However, some organisations should be excluded from the scope of thisRegulation in order to ensure appropriate proportionality to the lower information security risks
they pose to the aviation system.

(9)

The requirements laid down in this Regulation should ensure a consistent implementation
across all aviation domains, while creating a minimal impact on the Union aviation safety
legislation already applicable to those domains.

(10) The requirements laid down in this Regulation should be without prejudice to information
security and cybersecurity requirements laid down in Point 1.7 of the Annex to Commission
Implementing Regulation (EU) 2015/1998(1) and in Article 14 of Directive (EU) 2016/1148 of theEuropean Parliament and of the Council(2).
(11) The security requirements laid down in Articles 33 to 43 of Title V “Security of the Programme”
of Regulation (EU) 2021/696 of the European Parliament and of the Council3 are considered tobe equivalent with the requirements laid down in this Regulation, except as regards point
IS.I.OR.230 of Annex II to this Regulation which should be complied with.

1 Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of thecommon basic standards on aviation security (OJ L 299, 14.11.2015, p. 1).
2

Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of
security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).
3 Regulation (EU) 2021/696 of the European Parliament and of the Council of 28 April 2021 establishing the Union Space Programme andthe European Union Agency for the Space Programme and repealing Regulations (EU) No 912/2010, (EU) No 1285/2013 and (EU) No
377/2014 and Decision No 541/2014/EU

Powered by EASA eRules

Page 17 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

Powered by EASA eRules

Page 18 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203(12) In order to provide legal certainty, the interpretation of the term ‘information security’ as
defined in this Regulation, reflecting its common use in civil aviation globally, should beconsidered as being consistent with that of the term ‘security of network and information
systems’ as defined in Article 4(2) of Directive (EU) 2016/1148. The definition of information
security used for the purposes of this Regulation should not be interpreted as divergent fromthe definition of security of network and information systems laid down in Directive (EU)2016/1148.
(13) In order to avoid duplication of legal requirements, where organisations covered by thisRegulation are already subject to security requirements arising from Union acts referred to inrecitals (10) and (11) which are in their effect equivalent to the provisions laid down in thisRegulation, compliance with those security requirements should be considered to constitutecompliance with the requirements laid down in this Regulation.
(14) Organisations covered by this Regulation that are already subject to security requirements
arising from Regulation (EU) 2015/1998 or Regulation (EU) 2021/696, or both, should also
comply with the requirements of Annex II (Part IS.I.OR.230 “Information security externalreporting scheme”) to this Regulation as neither Regulation contains provisions related toexternal reporting of information security incidents.
(15) For the sake of completeness, Regulations (EU) No 1178/2011, No 748/2012, No 965/2012, No
139/2014, No 1321/2014, 2015/340, 2017/373 and 2021/664 should be amended in order tointroduce the information security management system requirements prescribed in thisRegulation together with the management systems set out therein, and to set out thecompetent authorities’ requirements as regards the oversight of organisations implementing
the aforementioned information security management requirements.
(16) In order to provide organisations with sufficient time to ensure compliance with the new rules
and procedures, this Regulation should apply 3 years after its entry into force, except for the air
navigation service provider of the European Geostationary Navigation Overlay Service (EGNOS)
defined in Commission Implementing Regulation (EU) 2017/3731, where due to the ongoingsecurity accreditation of the EGNOS system and services in line with Regulation (EU) 2021/696,
it should become applicable from 1 January 2026.
(17) The requirements laid down in this Regulation are based on Opinion No 03/2021(2), issued by
the Agency in accordance with Article 75(2) points (b) and (c) and Article 76(1) of Regulation(EU) 2018/1139.
(18) The requirements laid down in this Regulation are in accordance with the opinion of theCommittee for the application of common safety rules in the field of civil aviation establishedby Article 127 of Regulation (EU) 2018/1139,
HAS ADOPTED THIS REGULATION:

1

Commission Implementing Regulation (EU) 2017/373 of 1 March 2017 laying down common requirements for providers of air traffic
management/air navigation services and other air traffic management network functions and their oversight, repealing Regulation (EC)No 482/2008, Implementing Regulations (EU) No 1034/2011, (EU) No 1035/2011 and (EU) 2016/1377 and amending Regulation (EU)No 677/2011, (OJ L 062 8.3.2017, p. 1)
2

https://www.easa.europa.eu/document-library/opinions

Powered by EASA eRules

Page 19 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

Article 1 – Subject matter
Regulation (EU) 2023/203

This Regulation sets out the requirements to be met by the organisations and competent authorities
in order:(a)to identify and manage information security risks with potential impact on aviation safety which
could affect information and communication technology systems and data used for civil aviation
purposes,(b)

to detect information security events and identify those which are considered information
security incidents with potential impact on aviation safety,(c)to respond to, and recover from, those information security incidents.

GM1 Article 1 — Subject matter
ED Decision 2023/008/R

When taking measures under this Regulation, affected entities — irrespective of their size — areencouraged to ensure that the measures they take are proportionate to the nature and safety risk of
their activities.

Article 2 – Scope
Regulation (EU) 2024/1109

1.

This Regulation applies to the following organisations:(a)maintenance organisations subject to Section A of Annex II (Part-145) to Regulation (EU)No 1321/2014 (1), except those solely involved in the maintenance of aircraft inaccordance with Annex Vb (Part-ML) to Regulation (EU) No 1321/2014;(b)continuing airworthiness management organisations (CAMOs) subject to Section A of
Annex Vc (Part-CAMO) to Regulation (EU) No 1321/2014, except those solely involved in
the continuing airworthiness management of aircraft in accordance with Annex Vb (PartML) to Regulation (EU) No 1321/2014;(c)

air operators subject to Annex III (Part-ORO) to Regulation (EU) No 965/2012(2), except
those solely involved in the operation of any of the following:(i)an ELA 2 aircraft as defined in Article 1(2), point (j) of Regulation (EU) No
748/2012(3);(ii)

single-engine propeller-driven aeroplanes with a Maximum Operational Passenger
Seating Configuration of 5 or less that are not classified as complex motor-powered

1 Commission Regulation (EU) No 1321/2014 of 26 November 2014 on the continuing airworthiness of aircraft and aeronautical products,

parts and appliances, and on the approval of organisations and personnel involved in these tasks (OJ L 362, 17.12.2014, p. 1).
2

Commission Regulation (EU) No 965/2012 of 5 October 2012 laying down technical requirements and administrative procedures related
to air operations pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (OJ L 296, 25.10.2012, p. 1)
3 Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules for the airworthiness and environmental

certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations (OJ
L 224, 21.8.2012, p. 1).

Powered by EASA eRules

Page 20 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

aircraft, when taking off and landing at the same aerodrome or operating site andoperating under Visual Flight Rules (VFR) by day rules;(iii)

single-engine helicopters with a Maximum Operational Passenger Seating
Configuration of 5 or less that are not classified as complex motor-powered
aircraft, when taking off and landing at the same aerodrome or operating site andoperating under VFR by day rules.

(d)approved training organisations (ATOs) subject to Annex VII (Part-ORA) to Regulation (EU)No 1178/2011(1), except those solely involved in training activities of ELA2 aircraft as
defined in Article 1(2), point (j) of Regulation (EU) No 748/2012, or solely involved intheoretical training;(e)aircrew aero-medical centres subject to Annex VII (Part-ORA) to Regulation (EU) No
1178/2011;(f)flight simulation training device (FSTD) operators subject to Annex VII (Part-ORA) to
Regulation (EU) No 1178/2011, except those solely involved in the operation of FSTDs for
ELA2 aircraft as defined in Article 1(2), point (j) of Regulation (EU) No 748/2012;(g)

air traffic controller training organisations (ATCO TOs) and ATCO aero-medical centres
subject to Annex III (Part ATCO.OR) to Regulation (EU) 2015/340(2);(h)

organisations subject to Annex III (Part-ATM/ANS.OR) to Regulation (EU) 2017/373 (3),except the following service providers:(i)

air navigation service providers holding a limited certificate in accordance withpoint ATM/ANS.OR.A.010 of that Annex;(ii)

flight information service providers declaring their activities in accordance withpoint ATM/ANS.OR.A.015 of that Annex;(i)U-space service providers and single common information service providers subject toRegulation (EU) 2021/664(4).

(j)

approved organisations involved in the design or production of ATM/ANS systems and
ATM/ANS constituents subject to Commission Implementing Regulation (EU)2023/17695.

1 Commission Regulation (EU) No 1178/2011 of 3 November 2011 laying down technical requirements and administrative procedures related

to civil aviation aircrew pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (OJ L 311, 25.11.2011, p.
1).
2 Commission Regulation (EU) 2015/340 of 20 February 2015 laying down technical requirements and administrative procedures relating to

air traffic controllers' licences and certificates pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council,
amending Commission Implementing Regulation (EU) No 923/2012 and repealing Commission Regulation (EU) No 805/2011 (OJ L 63,
6.3.2015, p. 1).
3 Commission Implementing Regulation (EU) 2017/373 of 1 March 2017 laying down common requirements for providers of air traffic

management/air navigation services and other air traffic management network functions and their oversight, repealing Regulation (EC) No
482/2008, Implementing Regulations (EU) No 1034/2011, (EU) No 1035/2011 and (EU) 2016/1377 and amending Regulation (EU) No
677/2011 (OJ L 62, 8.3.2017, p. 1).
4

Commission Implementing Regulation (EU) No 2021/664 of 22 April 2021 on a regulatory framework for the U-space (OJ L 139, 23.4.2021,
p. 161).
5 Commission Implementing Regulation (EU) 2023/1769 of 12 September 2023 laying down technical requirements and administrative

procedures for the approval of organisations involved in the design or production of air traffic management/air navigation services systems
and constituents and amending Implementing Regulation (EU) 2023/203 (OJ L 228, XX.9.2023, p. 19).

Powered by EASA eRules

Page 21 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

2.

This Regulation applies to the competent authorities, including the European Union Aviation
Safety Agency (‘the Agency’), referred to Article 6 of this Regulation and in Article 5 of DelegatedRegulation (EU) 2022/1645.

3.

This Regulation also applies to the competent authority responsible for the issuance,
continuation, change, suspension or revocation of aircraft maintenance licences in accordancewith Annex III (Part-66) to Regulation (EU) No 1321/2014.

3a.

This Regulation also applies to the competent authority designated in accordance with Annex I(Part-AR.UAS) to Commission Implementing Regulation (EU) 2024/11091.

4.

This Regulation is without prejudice to information security and cybersecurity requirements laid
down in point 1.7 of the Annex to Regulation (EU) 2015/1998(2) and in Article 14 of Directive(EU) 2016/1148 of the European Parliament and of the Council(3).

Article 3 – Definitions
Regulation (EU) 2023/203

For the purpose of this Regulation, the following definitions shall apply:(1)‘information security’ means the preservation of confidentiality, integrity, authenticity andavailability of network and information systems;(2)‘information security event’ means an identified occurrence of a system, service or network
state indicating a possible breach of the information security policy or failure of information
security controls, or a previously unknown situation that can be relevant for information
security;(3)‘incident’ means any event having an actual adverse effect on the security of network andinformation systems as defined in Article 4(7) of Directive (EU) 2016/1148;(4)‘information security risk’ means the risk to organisational civil aviation operations, assets,
individuals, and other organisations due to the potential of an information security event.
Information security risks are associated with the potential that threats will exploit
vulnerabilities of an information asset or group of information assets;(5)‘threat’ means a potential violation of information security which exists when there is an entity,
circumstance, action or event that could cause harm;(6)‘vulnerability’ means a flaw or weakness in an asset or a system, procedures, design,
implementation, or information security measures that could be exploited and results in a
breach or violation of the information security policy.

1 Commission Implementing Regulation (EU) 2024/1109 of 10 April 2024 laying down rules for the application of Regulation (EU) 2018/1139

of the European Parliament and of the Council as regards competent authority requirements and administrative procedures for thecertification, oversight and enforcement of the continuing airworthiness of certified unmanned aircraft systems, and amending
Implementing Regulation (EU) 2023/203 (OJ L, 2024/1109, 17.5.2024, ELI: http://data.europa.eu/eli/reg_impl/2024/1109/oj).
2 Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of thecommon basic standards on aviation security (OJ L 299, 14.11.2015, p. 1).
3 Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of

security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

Powered by EASA eRules

Page 22 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

GM1 Article 3 — Definitions
ED Decision 2023/008/R

For the sake of common understanding, the following is a description of the terms used in the AMC &GM to Part-IS.D.OR of Commission Delegated Regulation (EU) 2022/1645 as well as in the AMC & GM
to Part-IS.AR and Part-IS.I.OR of Commission Implementing Regulation (EU) 2023/203:
Assessment

In the context of management system performance monitoring,
continuous improvement and oversight, it refers to a planned anddocumented activity performed by competent personnel to evaluate andanalyse the achieved level of performance, effectiveness and maturity, as
well as compliance in relation to the organisation’s policy and objectives.
Note: An assessment focuses on required outcomes and the overall
performance, looking at the organisation as a whole. The main objectiveof the assessment is to identify the strengths and weaknesses to drive
continuous improvement.
Remark: For ‘risk assessment’, please refer to the definition below.

Attack vector (or attack The path, interface, and actions by which an attacker executes an attack,path)
as defined in EUROCAE ED-202.
Audit

It refers to a systematic, independent, and documented process for
obtaining evidence, and evaluating it objectively to determine the extent
to which requirements are complied with.
Note: Audits may include inspections.

Competency

It is a combination of individual skills, practical and theoretical knowledge,
attitude, training, and experience.

Correction

It is the action to eliminate a detected non-compliance.

Corrective action

It is the action taken to eliminate or mitigate the root cause(s) and preventthe recurrence of an existing detected non-compliance or other
undesirable conditions or situations. Proper determination of the root
cause(s) is crucial for defining effective corrective actions to prevent
reoccurrence.

Deficiency

It is as a deviation from compliance with or a non-fulfilment of any
requirement or objectives, either from a regulatory or an organisation’s
perspective, either completely or partially.

Experience

It is the fact or state of having been affected by or gained knowledge andskills through observation, participation or doing.

Functional chain

The concept of functional chain dictates that information security risks areshared along organisations due to their respective interfaces, such as
supplier-customer relationships. Safety effects caused by information
security threats primarily materialise at aircraft level, originating upstreamof the aircraft. In the functional chain concept, each organisation assesses
its information security risks, which it may not be able to address andhence may expose other organisations to risks. It should pass related
information to the immediate partner(s) downstream for well-informed
risk management purposes and to ensure that the whole chain isPowered by EASA eRules

Page 23 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

adequately protected, even when no organisation has full visibility orcontrol.
HazardInformation
control

It is a condition or an object with the potential to cause or contribute toan aircraft incident or accident.
security It is a measure that reduces risk.

Intentional
It refers to the deliberate act of engaging in electronic activities orunauthorised electronic communications (e.g. access to, or modification of, computerinteraction
systems, networks, or data) without proper authorisation or

permission and with the intent to disclose sensitive information,
modify data, disrupt normal operations, or deny access to legitimate
users.

1

Just culture

It means a culture in which front-line operators or other persons are notpunished for actions, omissions or decisions taken by them that arecommensurate with their experience and training, but in which grossnegligence, wilful violations and destructive acts are not tolerated, as
defined in Article 2 of Regulation (EU) No 376/20141.

Knowledge

Content of information needed to perform adequately in the job at an
acceptable level, usually obtained through formal education and on-thejob experience. This knowledge is necessary for job performance but is not
sufficient on its own.

Management (activity)

In the general organisational context, it refers to the activities aimed at
directing, controlling, and continually improving the organisation withinappropriate structures. In the context of Commission DelegatedRegulation (EU) 2022/1645 and Commission Implementing Regulation(EU) 2023/203 it means, more specifically, the supervision and making ofdecisions necessary to achieve the organisation’s safety and information
security objectives.

Management system

It refers to a set of interrelated or interacting system elements to establish
policies, objectives and processes to achieve those objectives, where thesystem elements include the organisational structure, roles andresponsibilities, planning and operations.

Risk assessment

It is an evaluation that is based on engineering and operational judgement
and/or analysis methods in order to establish whether the achieved or
perceived risk is acceptable.

Risk register

It refers to a physical or digital means of documentation used as a risk
management tool that acts as a repository for all identified risks andRegulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on the reporting, analysis
and follow-up of occurrences in civil aviation, amending Regulation (EU) No 996/2010 of the European Parliament andof the Council and repealing Directive 2003/42/EC of the European Parliament and of the Council and Commission
Regulations (EC) No 1321/2007 and (EC) No 1330/2007 (OJ L 122, 24.4.2014, p. 18) (https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=CELEX%3A32014R0376&qid=1669377456448).

Powered by EASA eRules

Page 24 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

contains additional information about each risk, such as the nature of therisk, mitigation measures, ownership, status, etc.
SafetyIt refers to the state in which risks associated with aviation activities,
related to, or in direct support of the operation of aircraft, are reduced
and controlled to an acceptable level, as defined in ICAO Annex 19.

Safety risk

It refers to the predicted likelihood and severity of the consequences oroutcomes of a hazard.
Note: The term ‘likelihood’ is used instead of the term ‘probability’ toreflect a subjective analysis of the possibility of occurrence rather than apurely statistical assessment.

Article 4 – Requirements for organisations and competentauthorities
Regulation (EU) 2024/1109

1.

The organisations referred to in Article 2(1) shall comply with the requirements of Annex II (PartIS.I.OR) to this Regulation.

2.

The competent authorities referred to in Article 2(2), (3) and (3a) shall comply with therequirements of Annex I (Part-IS.AR) to this Regulation.

Article 5 – Requirements arising from other Union legislation
Regulation (EU) 2023/203

1.

Where an organisation referred to in Article 2(1) complies with security requirements laid downin accordance with Article 14 of Directive (EU) 2016/1148 that are equivalent to therequirements laid down in this Regulation, compliance with those security requirements shallbe considered to constitute compliance with the requirements laid down in this Regulation.

2.

Where an organisation referred to in Article 2(1) is an operator or an entity referred to in thenational civil aviation security programmes of Member States laid down in accordance with
Article 10 of Regulation (EC) No 300/2008 of the European Parliament and of the Council1, thecybersecurity requirements contained in point 1.7 of the Annex to Regulation (EU) 2015/1998
shall be considered to be equivalent with the requirements laid down in this Regulation, except
as regards point IS.I.OR.230 of Annex II to this Regulation that shall be complied with as such.

3.

Where the organisation referred to in Article 2(1) is the air navigation service provider of theEuropean Geostationary Navigation Overlay Service (EGNOS) referred to in Regulation (EU)2021/6962, the security requirements contained in Articles 33 to 43 of Title V of that Regulation
are considered to be equivalent with the requirements laid down in this Regulation, except as
regards point IS.I.OR.230 of Annex II to this Regulation that shall be complied with as such.

1

Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation
security and repealing Regulation (EC) No 2320/2002, OJ L 97, 9.4.2008, p. 72
2 Regulation (EU) 2021/696 of the European Parliament and of the Council of 28 April 2021 establishing the Union Space Programme andthe European Union Agency for the Space Programme and repealing Regulations (EU) No 912/2010, (EU) No 1285/2013 and (EU) No
377/2014 and Decision No 541/2014/EU (OJ L 170, 12.5.2021, p. 69).

Powered by EASA eRules

Page 25 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

4.

The Commission, after consulting the Agency and the Cooperation Group referred to in Article
11 of Directive (EU) 2016/1148, may issue guidelines for the assessment of the equivalence of
requirements laid down in this Regulation and Directive (EU) 2016/1148.

Article 6 – Competent authority
Regulation (EU) 2023/1769

1.

Without prejudice to the tasks entrusted to the Security Accreditation Board (SAB) referred toin Article 36 of Regulation (EU) 2021/696, the authority responsible for certifying andoverseeing compliance with this Regulation shall be:(a)with regard to organisations referred to in Article 2(1), point (a), the competent authority
designated in accordance with Annex II (Part-145) to Regulation (EU) No 1321/2014;(b)with regard to organisations referred to in Article 2(1), point (b), the competent authority
designated in accordance with Annex Vc (Part-CAMO) to Regulation (EU) No 1321/2014;(c)with regard to organisations referred to in Article 2(1), point (c), the competent authority
designated in accordance with Annex III (Part-ORO) to Regulation (EU) No 965/2012;(d)with regard to organisations referred to in Article 2(1), points (d) to (f), the competentauthority designated in accordance with Annex VII (Part-ORA) to Regulation (EU) No
1178/2011;(e)with regard to organisations referred to in Article 2(1), point (g), the competent authority
designated in accordance with Article 6(2) of Regulation (EU) 2015/340;(f)with regard to organisations referred to in Article 2(1), point (h), the competent authority
designated in accordance with Article 4(1) of Regulation (EU) 2017/373;(g)with regard to organisations referred to in Article 2(1), point (i), the competent authority
designated in accordance with Article 14(1) or 14(2), as applicable, of Regulation (EU)2021/664.

(h)with regard to organisations referred to in Article 2(1), point (j), the competent authority
designated in accordance with Article 3(1) of Implementing Regulation (EU) 2023/1769.

2.

Member States may, for the purposes of this Regulation, designate an independent andautonomous entity to fulfil the assigned role and responsibilities of the competent authorities
referred to in paragraph 1. In that case, coordination measures shall be established between
that entity and the competent authorities, as referred to in paragraph 1, to ensure effective
oversight of all the requirements to be met by the organisation.

3.

The Agency shall cooperate in full compliance with the applicable rules on secrecy, protectionof personal data and protection of classified information with the European Union Agency for
the Space Programme (EUSPA), and the SAB referred to in Article 36 of Regulation (EU)2021/696 in order to ensure effective oversight of the requirements applicable to EGNOS air
navigation service provider.

Article 7 – Submission of relevant information to NIS competentauthorities
Regulation (EU) 2023/203

Competent authorities under this Regulation shall inform, without undue delay, the single point ofcontact designated in accordance with Article 8 of Directive (EU) 2016/1148 of any relevantPowered by EASA eRules

Page 26 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

information included in notifications submitted pursuant to point IS.I.OR.230 of Annex II to thisRegulation and point IS.D.OR.230 of Annex I to Delegated Regulation (EU) 2022/1645 by operators ofessential services identified in accordance with Article 5 of Directive (EU) 2016/1148.

Article 8 – Amendment to Regulation (EU) No 1178/2011
Regulation (EU) 2023/203

Annexes VI (Part-ARA) and VII (Part-ORA) to Regulation (EU) No 1178/2011 are amended inaccordance with Annex III to this Regulation.

Article 9 – Amendment to Regulation (EU) No 748/2012
Regulation (EU) 2023/203

Annex I (Part 21) to Regulation (EU) No 748/2012 is amended in accordance with Annex IV to thisRegulation.

Article 10 – Amendment to Regulation (EU) No 965/2012
Regulation (EU) 2023/203

Annexes II (Part-ARO) and III (Part-ORO) to Regulation (EU) No 965/2012 are amended in accordancewith Annex V to this Regulation.

Article 11 – Amendment to Regulation (EU) No 139/2014
Regulation (EU) 2023/203

Annex II (Part-ADR.AR) to Regulation (EU) No 139/2014 is amended in accordance with Annex VI tothis Regulation.

Article 12 – Amendment to Regulation (EU) No 1321/2014
Regulation (EU) 2023/203

Annexes II (Part-145), III (Part-66) and Vc (Part-CAMO) to Regulation (EU) No 1321/2014 are amendedin accordance with Annex VII to this Regulation.

Article 13 – Amendment to Regulation (EU) 2015/340
Regulation (EU) 2023/203

Annexes II (Part ATCO.AR) and III (Part ATCO.OR) to Regulation (EU) 2015/340 are amended inaccordance with Annex VIII to this Regulation.

Article 14 – Amendment to Regulation (EU) 2017/373
Regulation (EU) 2023/203

Annexes II (Part-ATM/ANS.AR) and III (Part-ATM/ANS.OR) to Regulation (EU) 2017/373 are amendedin accordance with Annex IX to this Regulation.

Article 15 – Amendment to Regulation (EU) 2021/664
Regulation (EU) 2023/203

For the consolidated version of Regulation (EU) 2021/664, please refer to the Easy Access Rules for Uspace (Regulation (EU) 2021/664).

Powered by EASA eRules

Page 27 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
Cover Regulation to Implementing
Regulation (EU) 2023/203

Article 16
Regulation (EU) 2023/203

This Regulation shall enter into force on the twentieth day following that of its publication in the
Official Journal of the European Union.
It shall apply from 22 February 2026.
However, as regards the case of the EGNOS air navigation service provider subject to Regulation (EU)2017/373 it shall apply from 1 January 2026.
Regulation (EU) 2023/203

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels,
For the Commission
The President
Ursula VON DER LEYEN

Powered by EASA eRules

Page 28 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

ANNEX I — INFORMATION SECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]
IS.AR.100 Scope
Regulation (EU) 2023/203

This Part establishes the management requirements to be met by the competent authorities referred
to in Article 2(2) of this Regulation.
The requirements to be met by those competent authorities for the performance of their certification,
oversight and enforcement activities are contained in the Regulations referred to in Article 2(1) of thisRegulation and in Article 2 of Delegated Regulation (EU) 2022/1645.

IS.AR.200 Information security management system (ISMS)
Regulation (EU) 2023/203(a)In order to achieve the objectives set out in Article 1, the competent authority shall set up,
implement and maintain an information security management system (ISMS) which ensuresthat the competent authority:(1)

establishes a policy on information security setting out the overall principles of thecompetent authority with regard to the potential impact of information security risks onaviation safety;(2)

identifies and reviews information security risks in accordance with point IS.AR.205;(3)

defines and implements information security risk treatment measures in accordance withpoint IS.AR.210;(4)

defines and implements, in accordance with point IS.AR.215, the measures required todetect information security events, identifies those which are considered incidents witha potential impact on aviation safety, and responds to, and recovers from, those
information security incidents;(5)complies with the requirements contained in point IS.AR.220 when contracting any partof the activities described in point IS.AR.200 to other organisations;(6)complies with the personnel requirements contained in point IS.AR.225;(7)complies with the record-keeping requirements contained in point IS.AR.230;(8)monitors compliance of its own organisation with the requirements of this Regulationand provides feedback on findings to the person referred to in point IS.AR.225 (a) toensure effective implementation of corrective actions;(9)

protects the confidentiality of any information that the competent authority may haverelated to organisations subject to its oversight and the information received through theorganisation’s external reporting schemes established in accordance with point
IS.I.OR.230 of Annex II (Part-IS.I.OR) to this Regulation and point IS.I.OR.230 of Annex I(Part-IS.I.OR) to Delegated Regulation (EU) 2022/1645;

Powered by EASA eRules

Page 29 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR](10) notifies the Agency of changes that affect the capacity of the competent authority toperform its tasks and discharge its responsibilities as defined in this Regulation;(11) defines and implements procedures to share, as appropriate and in a practical and timely
manner, relevant information to assist other competent authorities and agencies, as wellas organisations subject to this Regulation, to conduct effective security risk assessments
relating to their activities.
(b)

In order to continuously meet the requirements referred to in Article 1, the competent authority
shall implement a continuous improvement process in accordance with point IS.AR.235.

(c)

The competent authority shall document all key processes, procedures, roles andresponsibilities required to comply with point IS.AR.200(a) and establish a process for amending
this documentation.

(d)

The processes, procedures, roles and responsibilities established by the competent authority inorder to comply with point IS.AR.200(a) shall correspond to the nature and complexity of its
activities, based on an assessment of the information security risks inherent to those activities,
and may be integrated within other existing management systems already implemented by thecompetent authority.

GM1 IS.AR.200 Information security management system (ISMS)ED Decision 2023/010/R

An information security management system (ISMS) is a systematic approach to establish,
implement, operate, monitor, review, maintain and continuously improve the state of information
security of an organisation. Its objective is to protect the information assets, such that the operationaland safety objectives of an organisation can be reached in a risk-aware, effective and efficient manner.
Generally speaking, an ISMS establishes an information security risk management process, based upon
the results of information security impact analyses, which basically determine its scope. If information
security breaches may cause or contribute to aviation safety consequences, information security
requirements need to limit their impact on levels of aviation safety, which are deemed acceptable.
Hence, all roles, processes, or information systems, which may cause or contribute to aviation safety
consequences, are within the scope of Regulation (EU) 2023/203. The ISMS provides for means to
decide on needed information security controls for all architectural layers (governance, business,
application, technology, data) and domains (organisational, human, physical, technical). It further
allows to manage the selection, implementation, and operation of information security controls.
Finally, it allows to manage the governance, risk management and compliance (GRC) within the ISMS
scope.
The risk management process is thus based on aviation safety risk assessments and derived
information security risk acceptance levels, which are designed to effectively treat and manage
information security risks with a potential impact on aviation safety caused by threats exploiting
vulnerabilities of information assets in aeronautical systems. Interacting bow-ties allow for a higherlevel and non-exhaustive illustration of how different disciplines of risk assessment may need tocollaborate to establish a common risk perspective, as depicted in Figure 1.

Powered by EASA eRules

Page 30 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Figure 1: Bow-tie representation of management of aviation safety risks posed by information
security threats
The ISMS in this Regulation should bring together the information security and aviation safetycompetencies in most of the processes, including, for instance, identifying critical systems or threats,
and assessing potential impacts on and risks to aviation safety.
ISMS implementation and maintenance
An ISMS, as defined in this Regulation, employs the perspectives of governance, risk and compliance,
and an approach that combines the safety risk and performance dimensions to determine theinformation security controls that are appropriate to and compliant with the specific context and caneffectively provide the level of protection required to achieve the aviation safety objectives by:——

Governance perspective refers to providing management direction and leadership aimed toachieve the entity’s own overarching objectives:—

leadership and commitment of the senior management defining and ensuring the close
involvement of the management and a ‘top-down’ ISMS implementation—

information security and safety objectives aligned and consistent with the entity’sbusiness objectives and monitored by, e.g., management reviews—

information security policies stating the principles and objectives to be achieved—roles, responsibilities, competencies and resources required for an effective ISMS—

effective, target-group-oriented communication to internal and external stakeholders

Risk perspective refers to a key aspect of an ISMS in an aviation safety context according to thisRegulation, and serves as a basis for transparent decision-making and prioritisation of controls
and risk treatment options. It further refers to the assessment, treatment and monitoring of
information security risks in support of the management of aviation safety risks for the key
processes and information assets upon which they depend. This includes protection
requirements, risk exposure, attitude towards risks and risk acceptance criteria, methods andindustry standards.

Powered by EASA eRules

Page 31 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]—

Compliance perspective refers to the compliance with regulatory, legal and contractual
requirements. This includes:—

this Regulation,—

the entity’s own policies and standards and may further include international or industry
standards adopted by the entity from ISO, EUROCAE, etc.

This perspective comprises the definition, implementation and maintenance of the required
information security provisions whose effectiveness and compliance should be regularly
monitored and assured by, e.g., (internal) audits.
Based on these perspectives, we may identify the following processes and subject areas that havebeen shown to be relevant for the establishment of an effective ISMS. These ISMS processes andsubject areas can be summarised as follows:(a)context establishment defining the scope, interfaces, dependencies and requirements ofinterested parties;(b)leadership and commitment of the senior management;(c)information security and safety objectives;(d)information security policies;(e)roles, responsibilities, competencies and resources required for an effective ISMS;(f)communication to internal and external stakeholders to achieve a sufficient level of information
security awareness and training of all involved parties;(g)

information security risk management including risk assessment and treatment;(h)information security incident management establishing processes for the handling of
information security incidents and vulnerabilities;(i)

performance & effectiveness monitoring, measurement and evaluation;(j)internal audits and management reviews;(k)corrections and corrective actions;(l)continuous improvement;(m)relationship with suppliers;(n)documentation, record-keeping, and evidence collection.

Additional critical success factors for the implementation and operation of an ISMS include thefollowing:—

The ISMS should be integrated with the entity’s processes and overall management structure
or even — at least partially, with safeguards for their respective integrity, and as reasonably
applicable — with an overarching management system comprising information security,
aviation safety and quality management.

—

Information security has to be considered at an early stage in the overall design of processes
and procedures, of systems and of information security controls, to be seamlessly integrated,
for maximum effectiveness, minimal functional interference and optimised cost. None of thesebenefits can be achieved by integrating it later.

Powered by EASA eRules

Page 32 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]—

The risk management process determines appropriate characteristics of preventive controls toreach and maintain acceptable risk levels.

—

The incident management process ensures that the organisation detects, reacts and responds
to information security incidents in a timely manner. This is achieved by defining
responsibilities, procedures, scenarios and response plans in advance to ensure a coordinated,targeted and efficient response.

—

Continuous monitoring and reassessment are undertaken and improvements are made in
response.

The above-mentioned core components are related to the requirements in this Regulation, for which
Figure 2 provides a high-level depiction of the aspects that are more prominent in the implementation
phase and those that characterise the operational phase, as well as the review and possible
improvement, if the functions do not perform as planned.

Figure 2: Representation of the Part-IS requirements from an ISMS’s life cycle perspective

Powered by EASA eRules

Page 33 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Plan-Do-Check-Act approach
The Plan-Do-Check-Act (PDCA) refers to a process approach that is often used to establish, implement,
operate, monitor, review and improve management systems. Figure 3 depicts the PDCA applied to an
ISMS.

Figure 3: Plan-Do-Check-Act approach applied to an ISMS

Benefits of an ISMS
The benefits of a management system operating in a dynamic, uncertain or unpredictable risk
environment are realised in the long term only when the organisation improves existing controls,
processes and solutions based on the assessments of risks, performance and maturity as well as thelearnings from incidents, audits, non-conformities and their root causes. A successful adoption anddeployment of an ISMS allows an entity to:—achieve greater assurance to the management and interested parties that its information assets
are adequately protected against threats on a continual basis;—increase its trustworthiness and credibility providing confidence to interested parties that
information security risks with an impact on aviation safety are adequately managed;—

increase the resilience of the entity’s key processes against unauthorised electronic interactions
and maintains the entity’s ability to decide and act;—

support the timely detection of control gaps, vulnerabilities or deficiencies aimed to prevent
information security incidents or at least to minimise their impact;

Powered by EASA eRules

Page 34 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]—

detect and timely react to changes in the entity’s environment including system architecture
and threat landscape or the adoption of new technologies;—

provide a foundation for effective and efficient implementation of a comprehensive
information security strategy in times of digital transformation, increasing interconnectivity ofsystems, emerging information security threats and new technologies.

Relation to ISO/IEC 27001
The international standard ISO/IEC 27001 is a widely adopted standard for ISMS which specifies
generic requirements for establishing, implementing, maintaining and continually improving an ISMS.
It also includes requirements for the assessment and treatment of information security risks. The
requirements are applicable to all entities, regardless of type, size or nature. The conformity of an
ISMS with the ISO/IEC 27001 standard can be certified by an accredited certification body. ISO/IEC
27001 is compatible with other management system standards (quality, safety, etc.) that have also
adopted the structure and terms defined in Annex SL to ISO/IEC Directives, Part 1, Consolidated ISO
Supplement. This compatibility allows an entity to operate a single management system that meetsthe requirements of multiple management system standards.
ISO/IEC 27001 allows entities to define their own scope of audit and their own organisational risk
appetite. This, in turn, leads to information security requirements that provide the ISMS with criteria
for the acceptability of information security risks in line with the entity’s risk appetite (see Figure4).

Figure 4: Relation between the entity’s risk appetite and the information security objectives
The requirements for an ISMS specified by this Regulation are in most parts consistent and alignedwith ISO/IEC 27001; however, this Regulation introduces provisions specific to the context of aviation
safety. If an ISO/IEC 27001-based ISMS is already operated by an entity for a different scope andcontext, it can be adapted and extended to the scope and context of this Regulation in astraightforward manner based on an analysis of the scope and the gaps. In order to take credit from
ISO/IEC 27001 certifications to achieve compliance with Part-IS, aviation safety needs to be includedin the organisational risk management, with the relevant risk acceptance level determined by theapplicable regulation (see Figure 5). Therefore, careful determination of the scope of the ISMS related
to aviation safety risks is needed, as it might differ from the one related to the other organisational
Powered by EASA eRules

Page 35 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

risks. To allow demonstration of compliance with Regulation (EU) 2023/203, careful delineation
between aspects of the ISMS related to aviation safety risks and other organisational risks may berequired. This could have an influence upon the decision to integrate ISMSs.

Figure 5: Introduction of aviation safety aspects in the entity’s risk appetite

PART-IS versus ISO/IEC 27001 cross reference table
For a mapping between the main tasks required under Part-IS and the clauses and associated controls
in ISO/IEC 27001, refer to Appendix II.

AMC1 IS.AR.200(a)(1) Information security management system
ED Decision 2023/010/R

The competent authority should define and document the scope of the ISMS, by determining
activities, processes, supporting systems, and identifying those which may have an impact on aviation
safety.
The information security policy should be endorsed by the person identified as per IS.AR.225(a) andreviewed at planned intervals or if significant changes occur. Moreover, the policy should cover at
least the following aspects with a potential impact on aviation safety by:(a)committing to comply with applicable legislation, consider relevant standards and bestpractices;(b)

setting objectives and performance measures for managing information security;(c)defining general principles, activities, processes for the competent authority to appropriately
secure information and communication technology systems and data;(d)committing to apply ISMS requirements into the processes of the competent authority;(e)committing to continually improve towards higher levels of information security process
maturity as per IS.AR.235;

Powered by EASA eRules

Page 36 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR](f)committing to satisfy applicable requirements regarding information security and its proactive
and systematic management and to the provision of appropriate resources for its
implementation and operation;(g)

assigning information security as one of the essential responsibilities for all managers;(h)committing to promote the information security policy through training or awareness sessions
within the competent authority to all personnel on a regular basis or upon modifications;(i)encouraging the implementation of a ‘Just-Culture’ and the reporting of vulnerabilities,
suspicious/anomalous events and/or information security incidents;(j)committing to communicate the information security policy to all relevant parties, as
appropriate.

Note: A significant change is a notable alteration or modification that has a meaningful impact on thecompetent authority operations, such as a structural change within the authority due toreorganisations, a change in the business processes (e.g. working from home, use of personal devices),a technological evolution (e.g. distributed computing resources, artificial intelligence/machinelearning) or an evolution in the threat landscape.

GM1 IS.AR.200(a)(1) Information security management system(ISMS)ED Decision 2023/010/R

INFORMATION SECURITY POLICY AND OBJECTIVES

The information security policy should suit the competent authority’s purpose and direct its own
information security activities. Such policy should contain the needs for information security in thecompetent authority’s context, a high-level statement of direction and intent of the information
security activities, the principles and most important strategic and tactical objectives to be achievedby the ISMS, as well as the general information security objectives or a specification of a framework(who, how) for setting information security objectives. The information security policy should also
contain a description of the established ISMS, including roles, responsibilities and references to topicspecific policies and standards.
The information security objectives should be:—consistent and aligned with the information security policy and consider the applicable
information security requirements, derived from the overarching competent authority’s
objectives, and the results from the risk assessment and treatment (which, in turn, supports theimplementation of the competent authority’s strategic goals and information security policy);—

regularly reviewed to ensure that they are up to date and still appropriate;—measurable if practicable (to be able to determine whether the objective has been met), aimed
to be SMART (specific, measurable, attainable, realistic, timely) and aligned with all affected
responsible persons.

When defining information security objectives, e.g., based on the overarching competent authority’s
objectives, the information security requirements or the results of risk assessments, it should bedetermined how these objectives will be achieved. The degree to which information security
objectives are achieved must be measurable. If possible, it should be measured by key performanceindicators (KPIs) which have been defined in advance (refer to resources such as COBIT 5 forPowered by EASA eRules

Page 37 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Information Security). It is recommended to start with the definition of a limited number of
information security objectives which are relevant for the competent authority, more of a long-term
nature and measurable with a reasonable effort relative to the delivered benefits.

AMC1 IS.AR.200(a)(8) Information security management system(ISMS)ED Decision 2023/010/R

COMPLIANCE MONITORING

When establishing compliance with the provisions under point IS.AR.200(a)(8), the competentauthority should implement a function to periodically monitor compliance of the management systemwith the relevant requirements and adequacy of the procedures including the establishment of aninternal audit process and an information security risk management process. Compliance monitoringshould include a feedback mechanism of audit findings to the person of the competent authority as
identified in IS.AR.225(a) to ensure implementation of corrective actions as necessary.

GM1 IS.AR.200(a)(8) Information security management system(ISMS)ED Decision 2023/010/R

COMPLIANCE MONITORING

For the purpose of compliance monitoring, internal audits should be conducted at planned intervals
to provide assurance on the status of the ISMS to the management and to provide information on thefollowing:—

conformity of the ISMS to the requirements of this Regulation and the competent authority’s
own requirements either stated in the information security policy, procedures and contracts orderived from information security objectives or outcomes of the risk treatment process;—effective implementation and maintenance of the ISMS.

Internal audits should follow an independent approach and a decision-making process based onevidence. Moreover, when setting up an audit programme, the importance of the processes
concerned, and definitions of the audit criteria and scopes should be considered. Documented
information should be retained evidencing the audit results, their reporting to the relevant
management and the audit programme.

AMC1 IS.AR.200(a)(9) Information security management system(ISMS)ED Decision 2023/010/R

When establishing compliance with the provisions under points IS.AR.200(a)(9), the competentauthority should implement and maintain information security controls that are sufficiently robustand effective to protect information and ensure the need-to-know principle (i.e. limiting access to
information to only those who need it to perform their duties). It should protect the source of
information in accordance with the relevant provisions established in Regulation (EU) 2018/1139. It
should also comply with Regulation (EU) No 376/2014.

Powered by EASA eRules

Page 38 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

AMC1 IS.AR.200(a)(11) Information security management system(ISMS)ED Decision 2023/010/R

When establishing compliance with the provisions under point IS.AR.200(a)(11), the competentauthority should implement and maintain a process to proactively share applicable and relevant
information for performing information security risk assessments with other competent authorities,
the Agency and other affected organisations within the scope of this Regulation, as soon as it becomesaware of such information. The competent authority should define and document which kind of
information needs to be shared and with whom.

AMC1 IS.AR.200(c) Information security management system(ISMS)ED Decision 2023/010/R

When establishing compliance with the provisions under point IS.AR.200(c), the competent authority
should:(a)

provide an outline of the structure of the specific information security personnel (internal andexternal), including their roles and responsibilities that will be used to manage and maintain theelements included within the scope of the ISMS and will be approved by the person identified
in IS.AR.225(a). The competent authority should review the outline of the structure at plannedintervals or if significant changes occur (see the Note in AMC1 IS.AR.200(a)(1));(b)

identify and categorise all relevant contracted organisations or qualified entities used to
implement the ISMS. The competent authority should define and document procedures for the
management of interfaces with all other entities and coordination between the competentauthority and other national authorities, contracted organisations or qualified entities;(c)identify and define all key processes and procedures, and internal and external reporting
schemes that will be used to maintain compliance with the objectives of this Regulation overthe life cycle of the ISMS. The competent authority may adjust existing processes or proceduresfor compliance;(d)identify and document any other information that will be used to maintain compliance with theobjectives of this Regulation;(e)when creating and updating documented information, ensure appropriate identification anddescription (e.g. a title, date, author, or reference number) as well as a review and an approval
for suitability and adequacy;(f)control the documented information required by the ISMS to ensure that it is:(1)

available and suitable for use, where and when it is needed;(2)adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

Powered by EASA eRules

Page 39 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.200(c) Information security management system (ISMS)ED Decision 2023/010/R

The amount of documented information that should be developed to maintain compliance with theobjectives of this Regulation may vary between competent authorities due to various factors, such as
size and complexity, or the need for harmonisation with other management processes already inplace. As general guidance, taking into account the documents required to comply with point
IS.AR.200(a) and the record-keeping requirements referred to in IS.AR.230, the following is a nonexhaustive list of information that should be documented:(a)information security policy that should include the authority’s information security objectives— see IS.AR.200(a)(1);(b)

responsibilities and accountabilities for roles relevant to information security — see thepersonnel requirements referred to in points IS.AR.225(a) and (b) and the related AMC and GM;(c)scope of the ISMS and the interfaces with, and dependencies on, other parties — see
IS.AR.200(a)(2) and the information security requirements referred to in points IS.AR.205(a) and
(b);

(d)

information security risk management process — see the information security requirements
referred to in points IS.AR.205 and IS.AR.210;(e)archive of the risks identified in the information security risk assessment along with theassociated risk treatment measures (often referred to as ‘risk register’ or ‘risk ledger’) — see
IS.AR.230;(f)evidence of the competencies necessary for the personnel performing the activities required
under this Regulation — see IS.AR.225(c) and the related AMC and GM;(g)evidence of the current competencies of the personnel performing the activities required under
this Regulation — see IS.AR.230(b)(1);(h)(key) performance indicators derived from evidence of the monitoring and measurement of the
ISMS processes.

GM1 IS.AR.200(d) Information security management system (ISMS)ED Decision 2023/010/R

PROPORTIONALITY IN ISMS IMPLEMENTATION

When implementing the processes and procedures, as well as establishing the roles andresponsibilities required under point IS.AR.200(d), the competent authority should primarily consider
the risks that it may be posing to other organisations, as well as its own risk exposure. Other aspects
that may be relevant include the authority’s needs and objectives, information security requirements,
its own processes, and the size, complexity and structure of the authority, all of which may changeover time.
INTEGRATION OF ISMS UNDER THIS REGULATION WITH EXISTING MANAGEMENT SYSTEMS

A competent authority may take advantage of existing management systems when implementing an
ISMS by integrating it with those existing systems.

Powered by EASA eRules

Page 40 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

By integrating the ISMS with existing management systems, the competent authority may reduce theeffort and costs required to implement and maintain the ISMS, while also ensuring consistency andalignment with the authority’s overall management approach. Below is a non-exhaustive list of
potential synergies that can be exploited when integrating the ISMS with an existing management
system:—Leverage existing policies and procedures: an authority may use its existing policies andprocedures as a foundation for its ISMS. This may help to ensure consistency and minimise theneed for additional documentation.

—

Align the ISMS with other management systems: an authority may align the ISMS with othermanagement systems, such as safety management systems (SMSs), to ensure that the ISMS isconsistent with the authority’s overall management approach.

—

Use existing risk management processes: an authority may use their existing risk management
processes to identify and assess the information security risks potentially leading to aviation
safety risks.

—

Reuse existing controls: an authority may reuse existing controls, such as access controls or
incident management process, to implement the information security controls required by the
ISMS.

—

Continuous improvement process: an authority may use the continuous improvement process
of existing management systems to improve the ISMS over time.

IS.AR.205 Information security risk assessment
Regulation (EU) 2023/203(a)

The competent authority shall identify all the elements of its own organisation which could be
exposed to information security risks. This shall include:(1)

the competent authority’s activities, facilities and resources, and the services thecompetent authority operates, provides, receives or maintains;(2)

the equipment, systems, data and information that contribute to the functioning of theelements referred to in point (1)(b)

The competent authority shall identify the interfaces that its own organisation has with otherorganisations, and which could result in the mutual exposure to information security risks.

(c)

For the elements and interfaces referred to in points (a) and (b), the competent authority shallidentify the information security risks which may have a potential impact on aviation safety.
For each identified risk, the competent authority shall:(1)

assign a risk level according to a predefined classification established by the competentauthority;(2)

associate each risk and its level with the corresponding element or interface identified inaccordance with points (a) and (b).

The predefined classification referred to in point (1) shall take into account the potential of
occurrence of the threat scenario and the severity of its safety consequences. Through thisclassification, and taking into account whether the competent authority has a structured andrepeatable risk management process for operations, the competent authority shall be able toPowered by EASA eRules

Page 41 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

establish whether the risk is acceptable or needs to be treated in accordance with point
IS.AR.210.
In order to facilitate the mutual comparability of risks assessments, the assignment of the risk
level per point (1) shall take into account relevant information acquired in coordination withthe organisations referred to in point (b).
(d)

The competent authority shall review and update the risk assessment carried out in accordancewith points (a), (b) and (c) in any of the following cases:(1)

there is a change in the elements subject to information security risks;(2)

there is a change in the interfaces between the competent authority’s organisation andother organisations, or in the risks communicated by the other organisations;(3)

there is a change in the information or knowledge used for the identification, analysis andclassification of risks;(4)

there are lessons learnt from the analysis of information security incidents.

GM1 IS.AR.205 Information security risk assessment
ED Decision 2023/010/R

Part-IS does not require the use of any specific information security framework, such as ISO, NIST orothers to develop the risk assessment or in general to implement risk management. Each frameworkoffers different benefits and none of these frameworks is perfect for an individual competentauthority, and should be customised and tailored to meet the overall needs of a competent authority
as well as the specific need to consider aviation safety aspects.
Competent authorities whose information security frameworks have achieved industry certifications
can provide this information as supporting artefacts; however, these competent authorities should
show the applicability of the industry certification to the scope of this Regulation (see GM1 IS.AR.200).
General guidance on risk management, including risk assessment, can be found in ISO/IEC 27005 andISO/IEC 31000 as well as NIST SP 800-30. Competent authorities may also wish to consider aviationspecific guidance as defined in the risk management chapter of the latest version of EUROCAE ED201A and, as appropriate to the specific operating environment, in the chapters of EUROCAE ED-204A,
EUROCAE ED-205A and EUROCAE ED-206 covering risk management.

AMC1 IS.AR.205(a) Information security risk assessment
ED Decision 2023/010/R

When conducting an information security risk assessment, the competent authority should ensurethat all relevant aviation safety elements are identified and included in the ISMS scope as per IS.AR.200
and related AMC.
A means to comply with the requirement in point IS.AR.205(a) is to perform a preliminary high-levelrisk assessment or impact assessment, carried out in accordance with a documented methodology
and following precise criteria for the inclusion in and exclusion from the ISMS scope of the elements
listed in IS.AR.205(a).

Powered by EASA eRules

Page 42 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.205(a) Information security risk assessment
ED Decision 2023/010/R

SCOPE AND BOUNDARIES IDENTIFICATIONThe competent authority should develop clear and comprehensive understanding of its aviation
activities and services, the related processes and associated information systems, and the relevant
data flows and information exchanges that define the scope of the ISMS and the boundaries for risk
assessment. Therefore, the competent authority should develop corresponding documentation on
resources and dependencies related to computing, networking and contracted services which havethe potential to affect the information security and safety of the functions, services or capabilities
within the scope of the risk assessment.
The following non-exhaustive list provides examples of items that may be considered for theidentification of the aforementioned scope and boundaries. The level of detail of the analysis can be
an iterative process, with the effort commensurate with the expected level of risk. As stated above,
the purpose is to establish understanding of all relevant assets, resources and dependencies that are
directly a part of the functions, services and capabilities through the following activities:(a)

Identification of operational inputs and outputs relevant to the functions, services andcapabilities of the authority; these can be related to:—internal or external sources;—internal or external leased or managed services, or other dependencies;(b)

Identification of all relevant assets (i.e. hardware, software, network and computing resources)used to create, process, transmit, store or receive the aforementioned operational inputs andoutputs;(c)

Identification of the operating environments (e.g. office, public access area, access-controlled
room, etc.) and locations for all relevant assets;(d)

For each asset included in the scope, identification of the specific methods, processes andresources that will be used to manage, operate and maintain each asset throughout its life cycle,
including:—internal or contracted resources;—

contracted companies remotely managing the assets (i.e. provider of managed services).

AMC1 IS.AR.205(b) Information security risk assessment
ED Decision 2023/010/R

The competent authority should, as part of the information security risk assessment, identify theinterfaces it has with other parties such as service providers, supply chains and other third parties,
based on the exchange of data and information and the assets used for that exchange, which could
lead to a situation where information security risks, as a result of mutual exposure, may either:—increase aviation safety risks faced by other parties; and/or—

increase aviation safety risks faced by the organisation.

Powered by EASA eRules

Page 43 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.205(b) Information security risk assessment
ED Decision 2023/010/R

RISK INFORMATION SHARINGInterfacing parties should share information with each other about the potential exposure to
information security risks by following, for instance, the approach detailed in EUROCAE ED-201A
Appendix B — B.1, B.2 and B.3. The purpose of this exchange of information is to enable the parties
to establish a matching mapping for the services identified under IS.AR.205(a), including informationand data flows, in order to:(a)illustrate (e.g. through a functional diagram) the relationships of logical and physical paths
connecting the different parts involved;(b)

clearly identify all assets (i.e. hardware, software, network and computing resources) that will
be used in the exchange;(c)identify all functions, activities and processes, including their respective information and data,
which will be created, transmitted, processed, received and stored, and associate those withthe responsible party which provides or performs those functions, activities and processes;(d)determine for these paths, constituting the so-called functional chains, the role of theinterfacing party as a producer, processor, dispatcher, or consumer of the information or data
involved;(e)determine whether one interfacing party acts as an originator or receiver of a flow across suchpath.

TWO CATEGORIES OF INTERFACING ORGANISATIONSThere are two categories of interfacing organisations: those that are subject to Regulation (EU)2023/203 or Regulation (EU) 2022/1645, and those that are not.
Where the competent authority has interfaces with an organisation that is subject to Regulation (EU)2023/203 or Regulation (EU) 2022/1645, each entity:—

is responsible for the identification of the interfaces that its own organisation has with otherorganisations, and which could result in the mutual exposure to information security risks. The
entity may benefit from the sharing of risk information as this exchange allows for a moreaccurate assessment of those risks.

—remains accountable for the proper management of the information security risks within thescope of its own ISMS.

In all other cases, the competent authority is accountable for the proper management of theinformation security risks that may arise from its exposure to the interfacing entity. Where these risks
need to be treated, the competent authority always has the option of implementing mitigating
measures and controls within its own boundaries. In the specific case where the interfacing entity is a
supplier, the competent authority may decide to manage the risks through contractual arrangements
and require the supplier to implement mitigating measures and controls within its own organisation.

Powered by EASA eRules

Page 44 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM2 IS.AR.205(b) Information security risk assessment
ED Decision 2023/010/R

EXAMPLES OF AVIATION SERVICES

Examples of aviation services that may be considered when determining the ISMS scope and interfaces
are provided in Appendix III.

AMC1 IS.AR.205(c) Information security risk assessment
ED Decision 2023/010/R

The competent authority should use a risk management framework that includes a methodology for
assigning risks with a risk level and establishing criteria for determining risk acceptance or further
treatment.
The competent authority should provide documented evidence of assessment of risks which have apotential impact on aviation safety including the level of risks. The competent authority should
associate each risk with the relevant elements and interfaces identified under IS.AR.205 (a) and (b),and document whether the risk is acceptable or requires further treatment.
The competent authority should provide the assurance that the risk assessment process is carried out
with the necessary rigour and discipline by documenting the process and its robustness. By doing so,
the competent authority should consider:(a)reproducibility of the assessment’s inputs and results;(b)repeatability of the assessment over time in a way that the results of the different priorassessments can be compared to determine the changes;(c)

the gathering of inputs that are relevant and valid, in particular:

(d)

(1)

the information that allows the determination of the safety consequences;(2)

the information that allows the determination of the potential of occurrence of the threat
scenario;

iterative refinement over time allowing for more fine-grained threat scenarios as inputs tobecome available, with the aim of reducing uncertainty regarding threats, vulnerabilities,
effectiveness of existing controls, and dependencies on external entities, in particular by:(1)

refining initial high-level threat scenarios with greater detail and specificity as more data
is gathered;(2)

refining data on known vulnerabilities by continuously updating information about their
exploitability and the associated consequences;(3)

reviewing the effectiveness of existing controls, and consider newly available controls;(4)

refining the understanding of the dependencies on external entities and theirimplications for the competent authority’s risk profile.

Powered by EASA eRules

Page 45 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.205(c) Information security risk assessment
ED Decision 2023/010/R

RISK ASSESSMENT

The risk classification levels for potential of occurrence of the threat scenario and severity of the safety
consequences listed below may be applied; however, this does not prevent the competent authority
from developing additional intermediate categories if it deems this necessary for risk assessments.
The competent authority should specify and document the applied, entity-specific classification levels
with an accurate qualitative or quantitative definition in terms of a range or interval of numericalvalues in order to enable a sufficiently calibrated, consistent estimation, evaluation andcommunication within the competent authority or with the interfacing entities. The potential of
occurrence of the threat scenario may be expressed as an interval of likelihoods including the durationof the observation. Supporting documentation and methods can be found in EUROCAE ED-203A,
Chapter 3.6 which references the evaluation of the potential of occurrence of the threat scenario in
the Security Risk Assessment of EUROCAE ED-202A.
Note 1: The phrase ‘duration of the observation’ refers to the time period during which a threat
scenario is observed or monitored. It is essential in determining the likelihood of the threat scenario
occurring, since the probability of occurrence may vary depending on the length of the observation
period.
Note 2: EUROCAE ED-202A and EUROCAE ED-203A were originally developed for aircraft information
security risk assessment, but the generic principles developed in those documents can be adapted toother frameworks when deemed useful by the authority.
In order to facilitate the mutual comparability of risks assessment methodologies between interfacing
entities, the competent authority may associate the assessment of the potential of occurrence of thethreat scenario with one of the following categories:—

High potential of occurrence: the threat scenario is likely to occur. The attack related to thethreat scenario is feasible and similar threat scenarios have occurred many times in the past.

—

Medium potential of occurrence: the threat scenario is unlikely to occur. The attack related tothe threat scenario is possible and a similar threat scenario may have occurred in the past.

—

Low potential of occurrence: the threat scenario is very unlikely to occur. The materialisation of
the threat scenario is theoretically possible; however, it is not known to have occurred.

The evaluation of the potential of occurrence of the threat scenario may be based on the following
aspects:
Protection (as defined in EUROCAE ED-203A)—

Security measures and architecture that deny access to assets: the degree to which an asset isopen to access from compromised systems—

Access to security measures: the degree to which a security measure prevents access/attack toitself from compromised systems—

Failure of mechanism: the degree to which the known implementation of a security measure
will fail to prevent an attack—

Detection methods or procedures to recognise the attack and appropriately respond to reduce
the potential of occurrence of the threat scenario

Powered by EASA eRules

Page 46 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Exposure reduction (as defined in EUROCAE ED-203A)—

Conditions under which an external access connection can be used by a user or attacker—

Limits on the functionality of an external access connection—

Organisational policies that control the time-to-feasibility for developing attack tools specific to
the product—

Vulnerability management including intelligence, scanning, treatment and retesting aimed to
discover, detect and treat reported or detected vulnerabilities in a fast, risk-prioritised mannerwith high assurance in order to reduce the attack surface—

Reduction of the severity of a successful attack (i.e. through a redundant system that canmaintain the continuity of service in case of a denial of service of a system critical for aviation
safety)Attack attempt (as defined in EUROCAE ED-203A)—

The capability of the attackers which is determined by the resources and expertise required fortheir attack
The capability of the attackers can be assessed through several ways, for instance:—

information from computer emergency response teams (CERTs) / computer security
incident response teams (CSIRTs), information sharing and analysis centres (ISACs);—

analyses of past activities, tactics, techniques and procedures (TTPs) and success rate of
attacks.

For the same reason, the competent authority may associate the outcome of the evaluation of
the severity of the safety consequences with one of the following categories:—

High severity: those immediate or delayed scenarios that can cause or contribute to an
unsafe condition where an unsafe condition means an occurrence associated with theoperation of an aircraft in which:—a person is fatally or seriously injured;—

the aircraft sustains damage or structural failure;—

the aircraft is either missing or completely inaccessible;—

Moderate severity: those immediate or delayed scenarios that can cause or contribute tosafety incidents where an incident means any occurrence other than an accident,
associated with the operation of an aircraft, which affects or could affect the safety ofoperations;—

Low severity: those immediate or delayed scenarios that can cause or contribute tonegligible safety consequences.

Examples for high, moderate, and low severity can be found in EUROCAE ED-201A, Appendix B
for products, ATM systems and airspace.
If the competent authority cannot determine the safety effect, the assessment should identify
assumptions from the risk-sharing information at interfaces with other organisations along thefunctional chain, leading up to the safety effect.

Powered by EASA eRules

Page 47 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Some of those assumptions can be granted with the certification of products: where assets are
subject to product certification from other aviation regulations addressing product information
security, the organisation performing the risk assessment may consider the perimeter of the
product certification as already covered. This should be acceptable under the condition that thiscertification is up to date and that the instructions provided by the OEM to maintain thecertification validity are implemented by the organisation.
Additional information can also be found in Regulation (EU) 2015/1018 on mandatory reportingof occurrences. Further examples of impact severity classifications for aviation domains can befound in EUROCAE ED-201A, Appendix B — Tables B-5, B-6 and B-7.
Risk acceptance criteria
Risk acceptance criteria are critical and should be developed, specified and documented. The criteria
may define multiple thresholds, with a desired target risk level, but allowing also for the person
identified in IS.AR.225(a) to accept risks above this level under defined circumstances and conditions.
In order to facilitate the mutual comparability of risk assessments between interfacing entities, thecompetent authority should classify the risks in the following categories:—

unacceptable risk;—

conditionally acceptable risk;—

acceptable risk.

For what concerns the conditional acceptance of risks, the criteria for acceptance should take into
account how long a risk is expected to exist (temporary or short-term activity or exposure), or may
include requirements for the commitment of future treatments to reduce the risk at an acceptablelevel within a defined time duration, and show how the risk will be managed over time through theauthority’s risk governance processes.
Moreover, risks should be conditionally accepted only under the condition that the competentauthority demonstrates the presence of a comprehensive risk management structure that includes
risk assessment, risk treatment and risk monitoring processes for operations. The risk management
should consider the variability and consistency of threat likelihood, vulnerability, existing controls,
external dependencies, and safety impact. This is typically achieved when the competent authority
reaches a higher level of maturity that is representative of functionality and repeatability of
information security risk management — see GM1 IS.AR.235(a).
The following Figure 1 depicts a risk acceptance matrix based on the aforementioned categories thatcan be used by interfacing organisations for mutual comparability.

Powered by EASA eRules

Page 48 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Figure 1: Example of a risk acceptance matrix for comparison purposes* The potential of occurrence of the threat scenario is reassessed in a timely manner (refer to
IS.AR.205(d)) and monitored to ensure that it remains low and that if the risk materialises, it is early
detected and dealt with.

A comprehensive risk management structure typically entails the following aspects and processes:—

a repeatable and reproduceable risk assessment. If the risk factors are considered fairly
uncertain and within some wide value range or not sufficiently precise, further iterations of therisk assessment are performed involving additionally gathered or detailed information and amore in-depth assessment in order to reduce uncertainty and increase precision;—a thorough review of those risks proposed to be conditionally acceptable that is performed by
the person identified in IS.AR.225(a) who may impose additional conditions for the risk
retention, including risk treatment measure and the timeline for its implementation;—

strict monitoring of the key risk indicators that includes a defined, reliable detection of thepotentially evolving risk materialisation;—

an incident response scheme is in place with reactive measures that are triggered by detection
mechanisms in order to immediately contain the consequences, in particular, for risk scenarios
involving a high severity level.

Note: As detailed in NIST SP-800 Rev.1, repeatability refers to the ability to repeat the assessment in
the future, in a manner that is consistent with and hence comparable to prior assessments —enabling
the organisation to identify trends. Therefore, a risk assessment process can be classified as‘repeatable’ when under similar conditions an entity or a person delivers consistent results.
As detailed in NIST SP-800 Rev.1, reproducibility refers to the ability of different experts to produce
the same results from the same data. Therefore, a risk assessment process can be classified as‘reproducible’ when another entity or person, given the same inputs, assumptions, information
security context and threat environment can replicate the same steps and reach the same conclusions.

Powered by EASA eRules

Page 49 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Threat scenario identification
A threat scenario is one of the possible ways a threat could materialise. Typically, a threat scenario
describes a potential attack targeting one or more vulnerabilities of assets, as well as processes.
The purpose of the threat scenario identification under this Regulation is to develop a list of scenariosthat may lead to an information security threat having an impact on aviation safety.
A threat scenario, in general, is characterised by the following:—a threat source of the information security attack;—an attack vector and a path through the organisation up to the asset;—

the information security controls that would mitigate the attack;—the consequence of the attack including the affected safety aspects.

Threat scenario identification guidance can be found in EUROCAE ED-202A, Chapter 3.4. This is not
the only source where guidance can be found, and the competent authority may refer to different
guidance more appropriate for their application.
Additional methods to identify relevant threat scenarios
When conducting this analysis, both information security and safety aspects should be coordinatedthroughout the process to ensure mutual understanding of the threat preventive measures andmitigating measures being applied. In the following Figure 2 the interactions between information
security and aviation safety are depicted through a ‘bow-tie’ diagram that highlights the links between
risk controls and the underlying management system.

Figure 2: Interactions between information security and aviation safety risk management areas
Note: A preventive barrier or measure is a proactive action or control implemented to reduce thelikelihood of a risk, hazard, or threat materialising, while a mitigating measure is an action or control
designed to reduce the severity or impact of an undesired event, would it occur.

Powered by EASA eRules

Page 50 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Examples of threat scenarios
Threat catalogues may provide guidance and elements for the elaboration of threat scenarios that are
relevant for the organisation. References can be found in ARINC 811 – Att. 3 – Tables 3-7 and 3-8 forthe threat catalogue examples and other threat catalogue examples as they are provided by EU
institutions — for example, the ENISA threat taxonomy. However, this is not an exhaustive list of
examples, and the identification of threat scenarios should therefore not be limited to those examples
only. In addition, other relevant resources containing information on information security threats andthe information security threat landscape should be consulted to support the risk assessment processwith relevant inputs.
A set of examples of threat scenarios can be found in Appendix I.

AMC1 IS.AR.205(d) Information security risk assessment
ED Decision 2023/010/R

The competent authority should take into account the following criteria when establishing compliancewith the objectives contained in point IS.AR.205(d):(a)

The risk assessment performed under points IS.AR.205 (a), (b) and (c) should be reviewed atregular intervals to identify and account for relevant changes. The periodicity at which potentialchanges have to be evaluated should be determined by the authority performing theassessment considering the criticality of the assets within the scope of the risk assessment,
levels of residual risk of the assets within the scope of the risk assessment and any contractualor regulatory requirements. A higher criticality or level of risk will require more frequent review.

(b)

The periodicity of risk assessment reviews should be documented by the competent authority
and include the justification, date of approval and information about the risk owner.

GM1 IS.AR.205(d) Information security risk assessment
ED Decision 2023/010/R

The criteria to consider for the frequency of the risk assessment review may be the risk level as wellas the criticality and complexity of the assets concerned. The objective of a risk assessment review isto trigger the revaluation of risks, their likelihood and impact in case of relevant changes. One possible
way is to have a tiered approach to risk assessment, with a higher-level risk assessment being used forthe identification of changes. The higher-level risk assessment could allow the identification of thedetailed risks that should be reviewed in a next step. Risk assessments should be subject to regularreviews to:(a)allow for continuous improvement of the quality of risk assessment;(b)ensure efficiency and effectiveness of risk controls and mitigating measures in both their designand operation;(c)review plans and actions for risk treatment;(d)identify any organisational change which may require a review of the priorities as well as of thetreatment of risks;(e)maintain an overview of the complete risk picture; and(f)identify any emerging risks.

Powered by EASA eRules

Page 51 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Risk assessment reviews should involve the risk owners, project teams and other stakeholders asapplicable. Evidence of risk assessment review should be documented and should include:—

evidence of approval of the review by the designated risk owner; and—the rationale behind or basis for the risk owner’s approval of the review.

Such evidence may comprise, but is not limited to:—reports which constitute a form of documentation to track information security risks potentially
impacting an organisation;—

the documentation of the information security risk assessment;—

exerts from a business or security risk registry.

The periodicity of risk assessment reviews should be documented by the authority in information
security manuals, processes or procedures and should align with wider change management activities
and management reviews of information security. Further guidance on criteria and frequency of risk
assessment review can be found in EUROCAE ED-201A Chapter 4, as well as in EUROCAE ED-205A,
Chapter 3.2 (for ATMS/ANS).

GM2 IS.AR.205(d) Information security risk assessment
ED Decision 2023/010/R

The following are examples of changes that should be identified during the risk assessment review asthey may trigger an update of the risk assessments:
(a)

(b)

there is a change in the elements subject to information security risks as identified in
IS.AR.205(a); a change in the elements will include:—

additions to, or removals from, the scope of the risk assessment of individual elements;—changes to design or configuration of elements within the scope of the risk assessmentthat have the potential to alter the risk assessment outcomes; or—changes to values, which would potentially trigger changes to impact levels, of elements
within the scope of the risk assessment;

there is a change in the interfaces between the authority and other parties with which theauthority shares information security risks or relies upon to mitigate information security risks(e.g. supply chains, service providers, cloud providers and customers), as identified in
IS.AR.205(b), or between the system within the scope of the risk assessment and any otherinterconnected systems, or in the risks notified to the authority by other parties, as identified
in IS.AR.205(b), or owners or managers of the other systems including:—establishment of new interfaces;—

removal of existing interfaces;—changes to existing interfaces that would have the potential to alter the risk assessment
outcomes.

Note: Some organisational or system interconnections may be with entities that are not within
the scope of this Regulation as defined in Article 2 and therefore are not subject to therequirements of Part-IS. Where this is the case, these entities should be informed of their
responsibility to report such changes as listed above, through contractual arrangements andPowered by EASA eRules

Page 52 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

reporting requirements between the affected entities on a case-by-case basis and whereapplicable;
(c)

(d)

there is a change in the information or knowledge used for the identification, analysis andclassification of risks including:—changes to threats and their values or addition of new threats that have not previously
been assessed;—changes to vulnerabilities or addition of new vulnerabilities that have not previously beenassessed;—changes in impacts or consequences of assessed threats or vulnerabilities;—changes in aggregation of risks that may result in unacceptable levels of risks;—changes or improvements in the risk management process, risk assessment approach andrelated activities;—changes or improvements in the treatments of risks;—changes in the criteria used to determine acceptance and treatments of risks;

there are lessons learned from the analysis of information security incidents including:—understanding why and how incidents have occurred; and—reviewing all types of incidents including those due to external factors, technical reasonsor human errors (inadvertent behaviour). For human intentional acts, a distinction canbe made between malign and benign actions.

IS.AR.210 Information security risk treatment
Regulation (EU) 2023/203(a)

The competent authority shall develop measures to address unacceptable risks identified inaccordance with point IS.AR.205, shall implement them in a timely manner and shall check theircontinued effectiveness. Those measures shall enable the competent authority to:(1)

control the circumstances that contribute to the effective occurrence of the threat
scenario;(2)

reduce the consequences to aviation safety associated with the materialisation of thethreat scenario;(3)

avoid the risks.

Those measures shall not introduce any new potential unacceptable risks to aviation safety.
(b)

The person referred to in point IS.AR.225(a) and other affected personnel of the competentauthority shall be informed of the outcome of the risk assessment carried out in accordancewith point IS.AR.205, the corresponding threat scenarios and the measures to be implemented.
The competent authority shall also inform organisations with which it has an interface inaccordance with point IS.AR.205(b) of any risk shared between competent authority and theorganisation.

Powered by EASA eRules

Page 53 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.210 Information security risk treatment
ED Decision 2023/010/R

Unacceptable risks identified in accordance with point IS.I.OR.205 require a risk treatment processthat may lead to the introduction of information security measures, often referred to as information
security controls.
For each identified risk, the competent authority should define the specific risk treatment measures,
methods or resources that will be used over the life cycle of each asset to:—

manage risk reduction;—

monitor and maintain each asset;—

update and fulfil activities for configuration management;—

manage supply chain;—manage contracted services or service provider.

The review of risk treatment measures should include life cycle considerations which are introducedby equipment, procedures and personnel.
A risk treatment plan as an outcome of the risk management process should include a prioritisationof risks, the corresponding information on the objectives and means for risk treatment to reach an
acceptable level of risk, as well as agreed timelines specifying by when responsible personnel shouldhave implemented the risk treatment measures. The timelines for the implementation of a risktreatment measure should be agreed by the personnel responsible for the implementation and should
be communicated to and accepted by the person identified in IS.AR.225(a).
Any subsequent implementation delay, together with its cause, reason, rationale or necessity, should
be documented in the risk treatment plan, for risks that may lead to an unsafe condition. The delay isalso subject to the acceptance by the person identified in IS.AR.225(a). The identified person may
condition such acceptance on the implementation or availability of compensating controls or reactive
measures to monitor, early detect and timely respond to the materialisation of the risk in treatment.
In order to timely respond, the incident response team may be informed to trigger their preparedness.
The risk treatment plan can act as a means of communication with the Agency to demonstrateeffective treatment of unacceptable risks. Similarly, this plan can be utilised to communicate tointerfacing organisations how shared risks are controlled.
In accordance with IS.AR.205(d), a regular or conditional review of the risk assessment is necessary,and this includes the review of the risk treatment measures developed under IS.AR.210(a) to identify
whether they are still effective or they require adaptations.
In addition, the competent authority should also consider the potential impact on the effectiveness ofrisk treatment measures where a shared information security risk may arise as a result of theinteraction between interfacing entities (see IS.AR.220 and related AMC).

Powered by EASA eRules

Page 54 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

AMC1 IS.AR.210(a) Information security risk treatment
ED Decision 2023/010/R(a)

The risk treatment process should reach at least one of the objectives listed under IS.AR.210(a).

(b)

When establishing compliance with the objectives under points IS.AR.210(a)(1) and
IS.AR.210(a)(2), the competent authority should take into account that:

(c)

(1)

the measures developed under these points should be implemented according to a risktreatment plan with defined, risk-based priorities, objectives and agreed timelines andowners;(2)

life cycle considerations should be identified and associated to ensure continuous
effectiveness of the information security measures including exchange of data with otherentities;(3)

it should review and update the risk assessment, according to IS.AR.205(d), to evaluate
whether the measures developed under these points introduce new unacceptable risks
or modify existing risks into a way that they become unacceptable.

Risk treatment should be documented and recorded, for example, in a risk registry, even if therisk has been avoided.

IS.AR.215 Information security incidents — detection, response andrecovery
Regulation (EU) 2023/203

(a)

(b)

(c)

Based on the outcome of the risk assessment carried out in accordance with point IS.AR.205
and the outcome of the risk treatment performed in accordance with point IS.AR.210, thecompetent authority shall implement measures to detect events that indicate the potential
materialisation of unacceptable risks and which may have a potential impact on aviation safety.
Those detection measures shall enable the competent authority to:(1)

identify deviations from predetermined functional performance baselines;(2)

trigger warnings to activate proper response measures, in case of any deviation.

The competent authority shall implement measures to respond to any event conditions
identified in accordance with point (a) that may develop or have developed into an information
security incident. Those response measures shall enable the competent authority to:(1)

initiate the reaction of its own organisation to the warnings referred to in point (a)(2) byactivating predefined resources and course of actions;(2)contain the spread of an attack and avoid the full materialisation of a threat scenario;(3)

control the failure mode of the affected elements defined in point IS.AR.205(a).

The competent authority shall implement measures aimed at recovering from information
security incidents, including emergency measures, if needed. Those recovery measures shallenable the competent authority to:(1)

remove the condition that caused the incident, or constrain it to a tolerable level;(2)

restore a safe state of the affected elements defined in point IS.AR.205(a) within arecovery time previously defined by its own organisation.

Powered by EASA eRules

Page 55 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.215 Information security incidents — detection,
response and recovery
ED Decision 2023/010/R

Without prejudice to the definition of ‘information security event’ in Article 3 of Regulation (EU)2023/203, those events that indicate the potential materialisation of unacceptable risks include both
occurrences (i.e. anything that causes harm or has the potential to cause harm) and discovery ofvulnerabilities. In fact, information security risks are associated with the potential that threats will
exploit vulnerabilities, therefore the discovery of an exploitable vulnerability is an information security
event.
In light of this, in the context of this Regulation:—

detection activities required under IS.AR.215(a) include vulnerability discovery;—

response activities required under IS.AR.215(b) include vulnerability management.

AMC1 IS.AR.215(a) Information security incidents — detection,
response and recovery
ED Decision 2023/010/R

DETECTION

When complying with the requirement in IS.AR.215(a), the competent authority should define andimplement a strategy to detect information security incidents which may have a potential impact onsafety.
This should be done in a way to ensure that at least the detection strategy is able to cover all known
information security threats to their assets that may materialise in a safety hazard having an
unacceptable consequence.
DETECTION STRATEGY

In order to determine the scope of the event detection, the competent authority should:(a)identify a list of threat scenarios from the risks identified under IS.AR.205;(b)

identify, as a minimum, those assets that, if compromised, contribute to the scenario(s) that
may materialise in an unsafe condition. For this identification of the assets, the measures
introduced under IS.AR.210 should also be considered.

Note: The contribution of an asset to the threat scenario and the materialisation of an unsafe
condition should be assessed also by considering the whole functional chain. In some cases, the asset
may be at the end of a functional chain and if it is compromised, the effect on safety is direct and may
be immediate; conversely, if the asset is far from the end of a functional chain and it is compromised,the effect should propagate and may be delayed.

Powered by EASA eRules

Page 56 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.215(a) Information security incidents — detection,
response and recovery
ED Decision 2023/010/R

DETECTION STRATEGY

When developing the detection strategy, for those items within the scope of event detection, thecompetent authority should define the conditions that trigger a process that, for example, would
require personnel intervention and further analysis. These conditions on the items may be definedusing elements from the:(a)expected functional baseline: engage in the identification of deviations from the expectedfunctional operation of the system (excluding information security functions/controls);(b)expected information security baseline: engage in the identification of deviations from theexpected information security operation of information security controls.

These conditions should consider both abnormal behaviour and substantial deviations from thebaselines and relevant correlation of multiple independent events.
Further guidance on the objectives for the establishment of a detection strategy can be found in
EUROCAE ED-206, Chapter 4.

AMC1 IS.AR.215(b) Information security incidents — detection,
response and recovery
ED Decision 2023/010/R(a)

INCIDENTS
The competent authority should take into account the following aspects when establishingcompliance with the objectives contained in point IS.AR.215(b) relative to incidents:(1)

Preparation of procedures and delineation of roles and responsibilities to respond in atimely, effective and orderly manner to any relevant information security incidents.

(2)

The response procedure should:

(3)

(i)

consider the warnings, unitary or combined, from IS.AR.215(a)(2), and assess theirpotential impacts on aviationsafety;(ii)

establish, in accordance with IS.AR.215(b)(2), a containment strategy for each
asset category considering the potential worst-case effect and the mission
constraints, and provide criteria indicating when the incident is contained;(iii)

define, in accordance with IS.AR.215(b)(3), the acceptable impact on safety andinformation security of each asset in scope when they fail due to thematerialisation of a threat scenario.

The response time should be commensurate with the impact level assessed in (2)(iii).

Powered by EASA eRules

Page 57 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

(4)

(5)

(b)

The response measures implemented under IS.AR.215(b) should be based on the
response procedure referred to in the above point (a)(2) and they should, in particular,consider the following:(i)the maximum acceptable safety level degradation of the assets within the scope of
the incident;(ii)

the actions, such as resistance, containment, deception and control of the possible
ways systems can fail, which will contribute to achieving the acceptable safety level
degradation identified in point (i) while minimising impact on operations;(iii)

the resources required to implement the actions specified in point (ii).

The response time and the measures should take into account the potential immediate
negative impact on safety if the measure is taken before it has been fully verified that it
would not cause additional immediate safety impacts.

VULNERABILITIESThe competent authority should take into account the following aspects when establishingcompliance with the objectives contained in point IS.AR.215(b) relative to vulnerabilities:(1)

Establishment of a vulnerability management strategy defining procedures, roles andresponsibilities to respond in a timely, effective and orderly manner to any detected
relevant vulnerabilities.

(2)

The response measures implemented under point IS.AR.215(b) should be based on the
maximum acceptable risk of the items within the scope of the vulnerability, considering
the worst-case scenario of the vulnerability being exploited.

(3)

The response time should be commensurate with the pre-triage done on the warnings
and with the assessment of the potential impact of the vulnerability, if it is exploited.

GM1 IS.AR.215(b) Information security incidents — detection,
response and recovery
ED Decision 2023/010/R

An attack is considered contained (i.e. it is not spreading any further) when the boundaries of theincident have been identified and the threat does not propagate beyond these boundaries. Further
guidance can be found in EUROCAE ED-206 – Chapter 5.
The term ‘warning’ as used in IS.AR.215 should be understood as an alert that would require timely
awareness and response from the information security events management team.
In the context of information security response, ‘deception’ refers to a range of techniques that aim
to mislead potential attackers or malicious users, thereby protecting the system and its data.
Deception techniques, such as honeypots or breadcrumb trails, are designed to confuse, slow down,
or divert attackers, increasing their cost and risk while providing defenders with valuable time andintelligence.
Guidance regarding the vulnerability management strategy can be found in EUROCAE ED-206, Chapter
3.4 — Vulnerability management considerations. This is not the only source where guidance can befound, and the organisation may refer to different guidance more appropriate for their application.

Powered by EASA eRules

Page 58 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

AMC1 IS.AR.215(c) Information security incidents — detection,
response and recovery
ED Decision 2023/010/R

When complying with the requirement in IS.AR.215(c), the competent authority should develop an
incident recovery procedure including at least the following:(a)a list of those assets that enable safe operations, as well as the dependencies among them,constituting the scope of the recovery;(b)a description of the process with the necessary priority actions to be executed for a return to asafe and secure state for the assets within the scope of the recovery;(c)

the resources required to execute the actions defined in point (b) to ensure that these resources
are readily available after an incident has occurred;(d)the objectives for recovery time that should be set in relation to the safety criticality of theassets within the scope of the recovery.

GM1 IS.AR.215(b)&(c) Information security incidents — detection,
response and recovery
ED Decision 2023/010/R

RECOVERY OBJECTIVES AND TIMING

Point IS.AR.215(b) addresses event conditions which may develop or have developed into information
security incidents, that may have a potential impact on aviation safety, and require response andrecovery measures to be in place to ensure that operational safety remains above a minimum
acceptable level.
The level of operations and safety may be interrelated, so in some cases when the level of operations
is compromised by an information security incident and drops, the level of safety does the same. Thisis, for instance, the case of air traffic control; if air traffic services are reduced or became unreliable,
the safety of flights is reduced too.
However, in other cases the relation between the level of operations and safety may be the inverse,or they may be decoupled, so when an incident occurs and the level of operations drops, the level ofsafety is preserved. One example is the compromise of the software loading process on board theaircraft. In this case, a detected incident followed by the decision to interrupt the software loading
operations would preserve the existing level of safety.
The following Figure 1 depicts a conceptual framework that may be considered for the definition of
the response and recovery objectives, including the recovery time. It represents, in the worst-casescenario, how the expected level of operational safety (safety level) for a process or an activity mayvary over time when an information security incident occurs. In this scenario, the safety level is first
reduced by the incident and then it degrades as long as the time passes. The figure also shows the
expected effect that mitigating measures and controls should have, respectively: in containing theoperational safety drop as soon as an incident occurs, and in improving the recovery, i.e. the returnto the expected safety level.

Powered by EASA eRules

Page 59 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Figure 1: Conceptual framework for the definition of the response and recovery objectives

As mentioned, there might be different relations between the level of operations and safety thatwould lead to a different representation of the above figure. In certain cases, an incident may have adelayed effect on the safety level (e.g. a compromised development environment) as depicted in
Figure 2, or it may have no impact if properly controlled, as in the case of the compromised software
loading process mentioned before, which is depicted in Figure 3.

Moreover, it should be noticed that there might be different ways the same incident can be dealt withsince there are several factors that may affect safety.

Powered by EASA eRules

Page 60 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

In practical terms, the objectives for recovery time under AMC1 IS.AR.215(c) may be expressed as alist of resources and services to be restored by order of priority, within the scope of the recovery.
Guidance about objectives for recovery time can be found in EUROCAE ED-206, Chapter 7.3.5.

GM1 IS.AR.215(c) Information security incidents— detection,
response and recovery
ED Decision 2023/010/R

A recovery procedure or recovery plan should describe incident recovery actions and the internal orexternal resources that are involved (e.g. staff, IT, buildings, providers). Guidance about incident
recovery plan can be found in ED 206, Chapter 7 – Recover.
The resources required to apply the recovery measures should be available in order to implement therecovery actions in a timely manner after an incident has occurred. Those resources may be internallyavailable or provided by contracted organisations as provided for in IS.AR.220. The contracting ofrecovery activities should be established before an incident occurs (proactive) and the contract should
include provisions for the contracted party to react in a timely manner.
The return to a safe and secure state may initially require emergency measures, which are actions thatare initiated based on the best information available at the time, before complete understanding of
the situation is achieved and these measures can potentially degrade the level of service orfunctionalities. The return to a safe and secure state should be evaluated against the initial risk
assessment and may only temporarily differ from the normal operational conditions. However, any
increase of residual risk and the duration of this risk increase, i.e. due to the implementation of
emergency measures, should be documented and accepted at the right level of accountability.
The recovery activities mentioned here may also be the outcome of the response to incidents forwhich the authority has received information that requires the implementation of adequate measuresin order to react to information security incidents or vulnerabilities with a potential impact on aviation
safety.
In such context the authority may not have a process or a recovery plan covering the specificoccurrence. Therefore, the definition from the authority of a specific recovery plan is usually required.

IS.AR.220 Contracting of information security management
activities
Regulation (EU) 2023/203

The competent authority shall ensure that when contracting any part of the activities referred to inpoint IS.AR.200 to other organisations, the contracted activities comply with the requirements of thisRegulation and the contracted organisation works under its oversight. The competent authority shallensure that the risks associated with the contracted activities are appropriately managed.

Powered by EASA eRules

Page 61 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

AMC1 IS.AR.220 Contracting of information security management
activities
ED Decision 2023/010/R(a)

OVERSIGHT OF THE CONTRACTED ORGANISATION

In order to exercise oversight of the contracted organisation, the competent authority should have:(1)

a process to ensure compliance with the provisions regarding contracted activities contained inthis Regulation;(2)

a structured process to follow the expected execution of the contract that includes:(i)

definition and agreement of the scope of the activities;(ii)

definition of the roles and responsibilities of the parties (i.e. competent authority andcontracted organisation);(iii)

definition and review of KPIs;(iv)

reaction to deviation from contractual obligations;(v)performance of compliance audits, according to predefined scope and objectives, withthe aim of evaluating operational and associated assurance activities;(vi)

provision of feedback on the result of the compliance audits both within the competentauthority and to the contracted organisation, and response to findings. The feedback on
the outcome of the compliance audits within the competent authority should reach theperson of the competent authority as identified in IS.AR.225(a) to ensure propermonitoring of the response to findings (i.e. implementation of corrective actions) or, if
deemed necessary, termination of the contract.

Note: The right of the competent authority to conduct compliance audits of the contractedorganisation should be included in the contract between the parties.
(b)

MANAGEMENT OF THE RISKS ASSOCIATED WITH THE CONTRACTED ACTIVITIESIn order to properly manage the risks associated with the contracted activities, the competentauthority should meet the following criteria:(1)

A prior assessment of the suppliers is conducted before outsourcing any information security
management activities. The assessment should evaluate suppliers’ competencies, sustainability
as well as qualifications in relation to the activities to be contracted.

(2)

There is an assessment of the risks associated with the provision of the contracted activities
that has been agreed between the competent authority and the contracted organisation.

(3)

The competent authority establishes and maintains appropriate information security
communication channels with the contracted organisation.

Powered by EASA eRules

Page 62 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.220 Contracting of information security management
activities
ED Decision 2023/010/R

Competent authorities may decide to outsource certain activities to suppliers, both for their own
operational needs and for the purpose of complying with this Regulation (information security
management activities). Activities contracted for operational needs may fall within the scope of PartIS and therefore the relevant information security risks have to be managed in accordance with therequirements in points IS.AR.205 and IS.AR.210. Instead, information security management activities
are subject to the specific provisions of IS.AR.220 because matters relating to these activities can havea major impact on the competent authority.
Therefore the objectives of point IS.AR.220 are:(a)to protect critical and sensitive information and assets when being handled by organisations
contracted for the provision of information security management activities (includingorganisations in the supply chain) at either their facilities or the competent authority facilities,
or when being transmitted between the competent authority and contracted organisations, orbeing remotely accessed by contracted organisations;(b)to prevent information security risks from being introduced through products and services
developed or provided by the contracted organisations to the competent authority, in the frameof the provision of information security management activities;(c)to ensure that information security risks are managed throughout all the stages of the relation
with the contracted organisations.

GM2 IS.AR.220 Contracting of information security management
activities
ED Decision 2023/010/R(a)

The contracting of information security management activities is a means to allocate tasks fromthe competent authority to third parties (contracted organisations). The competent authority
remains responsible for the oversight of the contracted organisation(s) and accountable forcompliance with this Regulation.

(b)

A contract could take the form of a written agreement, letter of agreement, service letter
agreement, memorandum of understanding, etc. as appropriate for the contracted activities.

Powered by EASA eRules

Page 63 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM3 IS.AR.220 Contracting of information security management
activities
ED Decision 2023/010/R

EXAMPLES

The following Table 1 provides some examples of information security management activities that
may be contracted in relation to the provisions referred to as in IS.AR.200.

Table 1: Examples of information security management activities that may be contracted
IS.AR.200 points related to activities

Example of contracted activity(a)(1): establishes a policy on information security
setting out the overall principles of the competentauthority with regard to the potential impact of
information security risks on aviation safety;(a)(2): identifies and reviews information security
risks in accordance with point IS.AR.205;

Information security policy drafting and consultancy(a)(3): defines and implements information
IS.AR.215 security risk treatment measures inaccordance with point IS.AR.210;(a)(4): defines and implements, in accordance withpoint IS.AR.215, the measures required to detect
information security events, identifies those which
are considered incidents with a potential impact
on aviation safety, and responds to, and recovers
from, those information security incidents;(a)(5): complies with the requirements containedin point IS.AR.220 when contracting any part of theactivities described in point IS.AR.200 to otherorganisations;(a)(6): complies with the personnel requirements
contained in point IS.AR.225;(a)(7): complies with the record-keeping
requirements contained in point IS.AR.230;

Powered by EASA eRules

Identify activities, facilities and resources.
Identify interfaces with other organisations which
could be exposed to information security risks.
Perform risk analysis or part of it, e.g. identify andclassify information security risks.
Define, develop and implement measures.
Verify the initial and the continued effectiveness of
the implemented measures (e.g. red-team/blue-teamexercises, penetration testing, vulnerability scanning,etc.).
Communicate to the involved stakeholders theoutcome of the risk assessment and their
responsibilities as part of the risk treatment process.
Define, develop and implement measures to detect
events.
Define, develop and implement measures to respondto any event conditions.
Define, develop and implement measures aimed atrecovering from information security incidents.
Not applicable

Contracted organisation to ensure that sufficientpersonnel is on duty to perform the activities related
to this Regulation
Define, develop and deliver adequate training toachieve the competencies required by the staff.
Perform pre-employment checks.
Define, develop and implement secured archiving.
Provision of secure data centre (as a service)
Provision of records updates

Page 64 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

IS.AR.200 points related to activities(a)(8): monitors compliance of its own organisation
with the requirements of this Regulation andprovides feedback on findings to the personreferred to in point IS.AR.225(a) to ensure effective
implementation of corrective actions;(a)(9): protects the confidentiality of any
information that the competent authority may
have related to organisations subject to its
oversight and the information received throughthe organisation’s external reporting schemes
established in accordance with point IS.I.OR.230 ofAnnex II (Part-IS.I.OR) to this Regulation and point
IS.D.OR.230 of the Annex (Part-IS.D.OR) to
Delegated Regulation (EU) 2022/1645;(a)(10): notifies the Agency of changes that affectthe capacity of the competent authority toperform its tasks and discharge its responsibilities
as defined in this Regulation;(a)(11): defines and implements procedures toshare, as appropriate and in a practical and timely
manner, relevant information to assist othercompetent authorities and agencies, as well asorganisations subject to this Regulation, to conduct
effective information security risk assessments
relating to their activities.
(b): In order to continuously meet therequirements referred to in Article 1, thecompetent authority shall implement a continuous
improvement process in accordance with point
IS.AR.235.
(c): The competent authority shall document all
key processes, procedures, rolesand
responsibilities required to comply with point
IS.AR.200(a)Example of contracted activity
Compliance monitoring activities including theplanning and the execution of independent audits

Define, develop and implement solutions to protect
the confidentiality of any information.

Not applicableNot applicable

Execute independent effectiveness and maturity
assessments.
Define, develop and implement the necessary
improvement measures.
Production of documentation to detail all key
processes, procedures, roles and responsibilities
required to comply with point IS.AR.200(a) (e.g.
information security policies, general description of
the staff, procedures to specify compliance).
Define, develop and implement processes forapproving amendments and changes.

GM4 IS.AR.220 Contracting of information security management
activities
ED Decision 2023/010/R

PRIOR ASSESSMENT

The purpose of the prior assessment is to evaluate suppliers’ competencies, sustainability as well as
qualifications in relation to the information security activities to be contracted. This prior assessment
may need to be carried out taking into account other legal requirements or procurement proceduresthat apply to the competent authority, and may therefore be carried out in different ways, such as:

Powered by EASA eRules

Page 65 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR](a)in case of public bids, inclusion of eligibility requirements in the procurement documents forthe potential suppliers;(b)review of the information security certifications granted by external and impartial auditors to
the potential suppliers;(c)review of self-assessment questionnaires compiled by the potential suppliers.

RISK ASSESSMENT ASSOCIATED WITH THE PROVISION OF THE CONTRACTED ACTIVITIESThe risk assessment should take into account the maturity level of the contracted organisation, andshould consider the following:(a)identification and assessment of critical and sensitive information and assets that may beshared with, or provided by, external suppliers;(b)

identification of the information security requirements of the authority that are applicable tothe contracted organisation;(c)evaluation, by means of a supplier assessment, of the ability of the contracted organisation(both existing and new contracted organisations) to meet the information security
requirements of the authority;(d)assessment of risks that may be introduced by the contracted organisation.

This agreed risk assessment should also consider the roles and responsibilities of the parties (i.e.
competent authority and contracted organisation) as well as their interfaces.

GM5 IS.AR.220 Contracting of information security management
activities
ED Decision 2023/010/R

AUDIT OF CONTRACTED ORGANISATIONS

The following aspects should be considered by the authority when auditing a supplier contracted toperform information security management activities:—

the scope of the audit as well as the objective should be limited to processes, resources (i.e.
contracted organisation personnel, systems/equipment, networks) and data used for the
execution of Part-IS contracted activities;—

compliance and/or implementation audits should be done at the authority’s discretion;—

findings identified during an audit should be addressed through a remediation plan with a timeframe to be validated by the authority.

IS.AR.225 Personnel requirements
Regulation (EU) 2023/203

The competent authority shall:(a)have a person who has the authority to establish and maintain the organisational structures,
policies, processes, and procedures necessary to implement this Regulation.

Powered by EASA eRules

Page 66 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

This person shall:(1)

have authority to fully access the resources necessary for the competent authority toperform all the tasks required by this Regulation;(2)

possess the delegation of power required to perform the assigned duties;(b)

have a process in place to ensure that they have sufficient personnel on duty to perform theactivities covered by this Annex;(c)have a process in place to ensure that the personnel referred to in point (b) have the necessarycompetence to perform their tasks;(d)have a process in place to ensure that personnel acknowledge the responsibilities associatedwith the assigned roles and tasks;(e)ensure that the identity and trustworthiness of the personnel who have access to information
systems and data subject to the requirements of this Regulation are appropriately established.

GM1 IS.AR.225 Personnel requirements
ED Decision 2023/010/R

The objectives of the requirements contained in point IS.AR.225 are:(a)to ensure that an effective organisational structure is in place in order to comply with therequirements of this Regulation;(b)

to provide trust to other organisations with whom they share risks.

AMC1 IS.AR.225(a) Personnel requirements
ED Decision 2023/010/R

The person referred to in point IS.AR.225(a) is normally intended to be a manager in the authority
who, by virtue of his or her position, has overall responsibility for information security management
and has sufficient authority to plan and allocate the relevant budgetary resources and initiatives inaccordance with the financial control model of the Member State. This person is not necessarily
required to be knowledgeable on technical matters; however, he or she should be aware of theoverarching objectives of this Regulation and its implications for the authority. The authority shouldmake sure that this person has direct access to the highest-ranking executive in the authority and has
the necessary funding allocation for the activities under this Regulation.

GM1 IS.AR.225(a) Personnel requirements
ED Decision 2023/010/R

The person referred to in point IS.AR.225 (a) should be capable of managing the authority’s
information security strategy and its implementation to ensure the achievement of the objectives
described in Article 1. According to the European Cybersecurity Skills Framework (ECSF) published by
ENISA in September 2022, this person may be described for instance as: (Chief) Information Security
Officer, Cybersecurity Programme Director or Information Security Manager. However, it should benoticed that these descriptions and the related skills do not consider the aviation safety perspectivethat is required in Article 1.

Powered by EASA eRules

Page 67 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

AMC1 IS.AR.225(b) Personnel requirements
ED Decision 2023/010/R

SUFFICIENT PERSONNEL

To determine the sufficiency of the personnel, the following elements should be taken into
consideration:(a)the organisational structures, policies, processes and procedures subject to information
security management;(b)the amount of coordination required with other organisations, contractors and suppliers;(c)the level of risk associated with the activities performed by the authority.

GM1 IS.AR.225(b) Personnel requirements
ED Decision 2023/010/R

SUFFICIENT PERSONNEL

For the purpose of this Regulation, personnel refers to the combination of the personnel directly
employed by the authority, as well as the personnel contracted as specified in IS.AR.220.
The activities reported in Appendix II, on the main tasks stemming from the implementation of PartIS, should be considered when establishing the organisational structure necessary to comply with therequirements of this Regulation.

AMC1 IS.AR.225(c) Personnel requirements
ED Decision 2023/010/R

NECESSARY COMPETENCE

(a)

(b)

To determine the competence needed by the personnel performing the activities, the following
elements should be taken into consideration:(1)

work roles and the associated tasks;(2)

required knowledge, skills and abilities.

As part of the process to ensure that personnel maintain the necessary competence, theMember State, or the competent authority on its behalf, should:(1)

assess the personnel qualifications and experience with respect to the requiredcompetence for the assigned work roles to identify gaps;(2)align the personnel qualifications and experience to the expected competence to fulfil
their roles by organising adequate learning programmes for existing members of
personnel, by recruiting new resources, or by a combination thereof;(3)

maintain the personnel competence during the time they are assigned to the work role.

Powered by EASA eRules

Page 68 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.225(c) Personnel requirements
ED Decision 2023/010/R

NECESSARY COMPETENCE AND TRAINING PROGRAMME

A training programme should start from the identification of the competence required by the
personnel for each role, followed by the identification of the gaps between the existing competence
and the required one.
In order to develop the list of competencies, a competent authority may use, as initial guidance, anexisting cybersecurity competence framework such as the NICE (National Initiative for Cybersecurity
Education) based on the NIST Cybersecurity Framework (NIST CSF).
In Appendix II, the main tasks of this Regulation are listed and mapped to the competencies derived
from the NIST CSF. This mapping may be used to establish a baseline to identify the aforementioned
competence gaps. However, it should be noticed that existing cybersecurity/information security
competence frameworks such as the NICE typically focus primarily on the protection of standard
information technologies; therefore, the proposed list of competencies may need to be adapted tothe technologies or integrated with and processes used in the organisation.
The bridging of the identified gaps should be seen as the objective of the training programme, whichshould further include the scope, content, methods of delivery (e.g. classroom training, e-learning,
notifications, on-the-job training) and frequency of training that best meet the authority’s needs
considering the size, scope, required competencies, and complexity of the organisation.
The competent authority may also identify professional certification schemes that cover a number ofnecessary competencies; therefore, it may decide to recognise these certifications as sufficient tocover the establishment of proper qualifications and experience for the certified personnel.
Finally, as information security/cybersecurity evolves due to the rise of new threats, the authority
should periodically review the adequacy of the training programme.

AMC1 IS.AR.225(d) Personnel requirements
ED Decision 2023/010/R

ACKNOWLEDGEMENT OF RESPONSIBILITIESRegarding any assigned role and task, the authority should specify all information security
responsibilities an employee has in a clear and transparent manner.
As part of this, all personnel performing the activities required under this Regulation should
acknowledge, in a traceable and verifiable manner, understanding of the assigned roles and theassociated information security responsibilities.

GM1 IS.AR.225(d) Personnel requirements
ED Decision 2023/010/R

ACKNOWLEDGEMENT OF RESPONSIBILITIESAcknowledgement of receipt such as a valid electronic or wet signature, confirmation email, etc., is a
traceable proof of acceptance.

Powered by EASA eRules

Page 69 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

AMC1 IS.AR.225(e) Personnel requirements
ED Decision 2023/010/R

IDENTITY AND TRUSTWORTHINESSFor the personnel who have access to information systems and data subject to the requirements ofPart-IS, the identity should be determined on the basis of documentary evidence.
To establish the trustworthiness of such personnel, the competent authority should have a
documented process and appropriate criteria to ensure that individuals can be trusted to performtheir role.

GM1 IS.AR.225(e) Personnel requirements
ED Decision 2023/010/R

IDENTITY AND TRUSTWORTHINESS(a)

Trustworthiness may be established, for example, by:
(1)

(2)

prior to employment, a background check carried out in accordance with the applicable
rules of Union and national law. This check may include verification of:(i)

education, previous employment and any gaps in the previous years;(ii)

absence of criminal record;(iii)

any other relevant information or intelligence considered relevant to the suitabilityof a person to work in the expected role;

during employment, monitoring the employee’s commitment and conduct.

Note: The absence of criminal record may be verified by means of a certificate issued by the
responsible authority in the Member State in accordance with Regulation (EU) 2016/1191. In
the case of prospective foreign employees, the above checks may be carried out on the basis ofequivalent certificates issued by the country of origin, such as a ‘certificate of good conduct’.
(b)Furthermore, the process and criteria to establish personnel’s trustworthiness may have toconsider whether:(1)

the information systems and data to be accessed have been associated with a highseverity of the safety consequences with the risk assessment process under IS.AR.205;(2)

controls or mitigating measures for risk treatment identified during the risk analysis rely
on organisational/operational procedures — for instance, correct configuration andadministration of information technologies, database operations, information security
monitoring, etc.

In such cases, the personnel who have administrator rights or unsupervised and unlimitedaccess to the systems and data mentioned above in (a)(1), or the personnel who applies themeasures under above point (b)(2), may be subject to more stringent criteria.
(c)Intelligence and any other relevant information may be gathered by screening and analysing
public sources such as social media and websites, within the limits set by relevant national laws
and regulations.

Powered by EASA eRules

Page 70 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR](d)Competent authorities may also be subject to Regulation (EU) 2015/1998 that requires
successful completion of background checks for personnel in certain roles, as well as amechanism for the ongoing review of these checks. In such cases the organisation may
considered suitable for the establishment of the personnel’s identity and trustworthiness
required under Part-IS, in relation to their role, the process and the relevant criteria defined inRegulation (EU) 2015/1998 for standard and enhanced background checks. However, it should
be noted that compliance with the provisions for the establishment of identity andtrustworthiness under Part-IS does not constitute compliance with the provisions on
background checks as defined in Regulation (EU) 2015/1998.

IS.AR.230 Record-keeping
Regulation (EU) 2023/203(a)

The competent authority shall keep records of its information security management activities
(1)

(b)

The competent authority shall ensure that the following records are archived andtraceable:(i)contracts for activities referred to in point IS.AR.200(a)(5);(ii)

records of the key processes referred to in point IS.AR.200(d);(iii)

records of the risks identified in the risk assessment referred to in point IS.AR.205
along with the associated risk treatment measures referred to in point IS.AR.210;(iv)

records of information security events which may need to be reassessed to reveal
undetected information security incidents or vulnerabilities.

(2)

The records referred to in point (1)(i) shall be retained at least until 5 years after thecontract has been amended or terminated.

(3)

The records referred to in point (1)(ii) and (iii) shall be retained at least for a period of 5
years.

(4)

The records referred to in point (1)(iv) shall be retained until those information security
events have been reassessed in accordance with a periodicity defined in a procedure
established by the competent authority.

The competent authority shall keep records of qualification and experience of its own staff
involved in information security management activities(1)

The personnel’s qualification and experience records shall be retained for as long as the
person works for the competent authority, and for at least 3 years after the person has
left the competent authority.

(2)

Members of the staff shall, upon their request, be given access to their individual records.
In addition, upon their request, the competent authority shall provide them with a copyof their individual records on leaving the competent authority.

(c)

The format of the records shall be specified in the competent authority’s procedures.

(d)

Records shall be stored in a manner that ensures protection from damage, alteration and theft,with information being identified, when required, according to its security classification level.
The competent authority shall ensure that the records are stored using means to ensure
integrity, authenticity and authorised access.

Powered by EASA eRules

Page 71 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

GM1 IS.AR.230 Record-keeping
ED Decision 2023/010/R

Records are required to document results achieved or to provide evidence of activities performed.
Records become factual when recorded and cannot be modified. Therefore, they are not subject toversion control. Even when a new record is produced covering the same issue, the previous record
remains valid.

AMC1 IS.AR.230(a)(1)(iv)&(a)(4) Record-keeping
ED Decision 2023/010/R

When complying with the requirements under points (a)(1)(iv) and (a)(4), the competent authority
should establish a data retention policy defining procedures to:(a)manage relevant information security data files;(b)establish the periodical assessment of their content; and(c)define the criteria to allow deletion of records of information security events when the objectiveof requirement (a)(4) has been met.

GM1 IS.AR.230(a)(1)(iv)&(a)(4) Record-keeping
ED Decision 2023/010/R

The objective of the requirement (a)(1)(iv) is to ensure detection of possible indication of information
security incidents or vulnerabilities which are not obvious by normal operation (e.g. previously
unknown situations), while the objective of the requirement under (a)(4) is to allow the necessary
flexibility to control the volume of the stored information security events.
Records of information security events include those events identified within the scope of thedetection activities under IS.AR.215(a), as well as other information security data produced by assetsthat have been identified under IS.AR.205.
A data retention policy clarifies what information should be stored or archived and for how long. Someguidance about data retention can be found in EUROCAE ED-206, Chapter 2.6.
Once a data set completes its retention period, it can be deleted or moved as permanent historical
data to a secondary or tertiary storage.

AMC1 IS.AR.230(c)&(d) Record-keeping
ED Decision 2023/010/R

When complying with the requirements under points (c) and (d) for all the records required by points
IS.AR.230 (a) and (b), the competent authority should consider the following:(a)

Records should be kept in paper form or in electronic format or a combination of both media.
The records should remain accessible whenever needed within a reasonable time and usable
throughout the required retention period. The retention period starts when the record has beencreated.

(b)

Records data integrity, availability and authenticity should be protected in consistency withprotection of corresponding operational data, and as such, should be within the scope of the
ISMS.

Powered by EASA eRules

Page 72 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR](c)

Storage systems should be protected against unauthorised access (i.e. data leakage attempts
against personal data/modification of records) and thus should have information security
measures implemented in consistency with the level of information security risk associated with
them.

(d)

Once records are not required to be retained anymore, the destruction of records anddecommissioning of assets used for their storage should be implemented appropriately.

GM1 IS.AR.230(c)&(d) Record-keeping
ED Decision 2023/010/R

RECORDS ACCESSIBILITY THROUGHOUT THE RETENTION PERIOD

It is recommended to follow best practices for data retention, for data that may need to be restored,
backup strategies, such as the use of automated backup tools, segregation or geographic separationof backup storage location(s), and to consider offline backups to prevent ransomware risks. These
practices should be considered also when record-keeping is contracted to service providers with
distributed resources.
Special attention should be paid to significant hardware and software changes, ensuring that storeddigital records remain accessible and readable (e.g. file system, application file format, forward
compatible database versions, etc.). Paper-based information needs to be archived in an adequate
environment, in which records are protected against degradation factors (e.g. excessive heat, light or
humidity).
RECORDS DATA INTEGRITY AND PROTECTION FROM UNAUTHORISED ACCESS

A commonly used method to achieve authenticity and integrity protection is the use of digital
signatures at document level. Digital signatures can be added to the document’s file (e.g. PDF) toensure that a record has not been modified by someone other than its author (integrity) and that theauthor is who is expected to be (authenticity).
Moreover, to prevent unauthorised access, records can be protected, for example, by implementing
a role-based access control (RBAC) approach, or certain records can be password protected at the filelevel. Commercial applications feature built-in basic password protection functions for their fileformats. Access protection can also be achieved by protecting the environment where the individual
records are stored (e.g. access protection on databases, file shares, directories, etc.).

IS.AR.235 Continuous improvement
Regulation (EU) 2023/203(a)

The competent authority shall assess, using adequate performance indicators, the effectivenessand maturity of its own ISMS. The assessment shall be performed on a predefined calendar
basis defined by the competent authority or following an information security incident.

(b)

If deficiencies are found following the assessment carried out in accordance with point (a), thecompetent authority shall take the necessary improvement measures to ensure that the ISMS
continues to comply with the applicable requirements and maintains the information security
risks at an acceptable level. In addition, the competent authority shall reassess those elementsof the ISMS affected by the adopted measures.

Powered by EASA eRules

Page 73 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

AMC1 IS.AR.235 Continuous improvement
ED Decision 2023/010/R

The continuous improvement process (CIP), as required by IS.AR.200(b), should aim to continuously
improve the effectiveness, suitability and adequacy of the ISMS. This should be achieved by a proactive
and systematic assessment of the ISMS and all its elements — including its maturity. The assessment
should take into account the outcomes and conclusions of other information security and assurance
processes including audits, management reviews, evaluation of performance, effectiveness andmaturity, as well as the outcomes of the derived corrective actions and corrections.
The steps to be performed should be at least the following:(a)

Identification of improvement opportunities based on the outcomes of the assessment of the
ISMS with respect to its suitability, effectiveness, adequacy and, if deemed necessary,
efficiency, as well as on any other suggestion for improvement. The assessment should consider
performance indicators which reflect its processes and elements and the defined objectives for
effectiveness and maturity.

(b)

Evaluation of the identified opportunities regarding cost benefit, absence or reduction ofundesired effects and achievement of the targeted objectives and intended outcomes.

(c)Proposal on the evaluated improvement opportunities to the management andrecommendation of actions to support their review and decision-making.

(d)According to the decision taken under point (c) above, planning, development andimplementation of actions and changes to the ISMS, its processes or elements to achieve theimprovements.

(e)

Evaluation of the effectiveness of the implemented actions and ISMS changes as well as, asapplicable, verification that the root cause of identified deficiencies has been eliminated.

The management should assess and review the outcomes of the CIP at planned intervals to ensure thecontinuing effectiveness, adequacy and suitability of the ISMS, to decide on the prioritisation of theimplementation of actions and changes, as well as to revise or set new objectives, or targets forcontinuous improvement.

GM1 IS.AR.235 Continuous improvement
ED Decision 2023/010/R

Point IS.AR.235 covers assurance processes for the ISMS in a manner that can be considered
equivalent to the safety assurance in ICAO Doc 9859 ‘Safety Management Manual (SMM)’, which
includes performance monitoring and measurement, management of change and continuous
improvement of the SMS.
In this Regulation:—

IS.AR.235(a) addresses, using adequate performance indicators, the effectiveness and maturity
assessment of the ISMS;—

IS.AR.235(b) addresses the improvement measures, i.e. corrections and corrective actions, forthe deficiencies detected in IS.AR.235(a) and the continuous improvement process.

Similar provisions for continuous improvement are provided for in other information management
systems such as ISO/IEC 27001 (see Appendix II to this document).

Powered by EASA eRules

Page 74 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

The context and risk environment of competent authorities are never static and therefore require adynamic adaptation, evolution and change of the competent authority’s objectives, architectures,organisational structures and processes to maintain the information security risks at an acceptablelevel. Consequently, the ISMS should be considered as an evolving and learning part/element of thecompetent authority which needs to be continuously monitored and improved to ensure alignment
with the competent authority’s safety objectives and effectiveness.
The CIP aims to continuously improve the effectiveness, suitability, adequacy and, if deemednecessary, the efficiency of the ISMS. An competent authority may integrate the Part-IS CIP in someother already operated CIP and may apply methods such as Plan-Do-Check-Act (PDCA) Cycle or DefineMeasure-Analyse-Improve-Control (DMAIC) (see also GM1 IS.AR.200).
The CIP is based on a proactive and systematic assessment of the ISMS and all its elements including
the information security processes and controls driven by the ISMS. The assessment should be carriedout against organisational targets for desired levels of performance, effectiveness, and maturity.
These targets, besides ensuring the achievement of compliance with the requirements under thisRegulation, may also aim to include objectives established by the competent authority’s policy or
standards and by management decisions.
The above-mentioned assessment is based on the outcome of performance evaluations, audits, risk
and incident processes, as well as already applied corrective actions and corrections. Some factorsthat should be considered when performing the assessment are the following:—

Adequacy refers to whether the system establishes the disciplines needed to manage
information security, e.g. by using broadly accepted industry standards, in a sufficient mannerwith regard to compliance with the requirements of this Regulation.

—

Effectiveness of the ISMS and the effective implementation of processes and controls driven
by the ISMS is assessed by analysing whether:——

the information security risks are managed to achieve the safety objectives;—

the intended outcomes of the ISMS are achieved, and the requirements or objectives aremet;—

all types of deficiencies, including failures, are managed to fulfil or correctly implement a
requirement or control.

Efficiency of the ISMS refers to the implementation of streamlined processes; however,efficiency improvements should not adversely impact effectiveness.

Identification of improvement opportunities
Improvement opportunities may be identified from the results of the CIP assessment or may beintroduced as suggestions from other sources. The identification often involves deviations orcorrective actions as well as ineffective processes or controls which are not remediated.
Suggestions for improvements stem from sources including:—

Risk management: the results of regularly conducted risk analyses and the subsequent risktreatment are a primary factor in improving the ISMS, where the risk treatment process involves
monitoring of the implemented security measures and evaluating their effectiveness.

Powered by EASA eRules

Page 75 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]—

Performance & effectiveness evaluation: conclusions from (key) performance indicators, theirmeasurement, analysis and continued monitoring as well as the result of the assessment of theeffectiveness including the outcomes of the subsequently applied corrections and corrective
actions—

Evaluation of maturity including the results of the subsequent corrections and corrective actions—

Lessons learned from information security incident detection, handling and response process
and a potential treatment of a root cause—

Results of (internal) audits may be used to verify whether the ISMS and controls within the audit
scope meet the competent authority’s requirements and to determine where there arepotential areas for improvements.

—

Review and evaluation by management of the current action plan, setting or revision of theobjectives or decision on improvement opportunities and actions—

Competent authority’s suggestion programme (suggestions for improvement), reviews, surveys
or assessments with employees or feedback from suppliers or interfacing parties

Any outcome of this process should be documented. The resulting actions may be integrated into an
overarching action plan which is centrally consolidated and periodically reviewed according to therelevant policies. The resulting action plan may be further divided into a tactical, short-/mid-term
action plan and a strategic, long-term action plan.

AMC1 IS.AR.235(a) Continuous improvement
ED Decision 2023/010/R(a)

ISMS EFFECTIVENESS EVALUATION
When complying with IS.AR.235(a), the competent authority should have a process in place tomonitor, measure, evaluate and review the effectiveness of its ISMS that defines:(1)

who monitors, measures, analyses and evaluates the results and takes accountable
decisions;(2)

when the above steps should be performed;(3)

which methods for monitoring, measurement, analysis and evaluation are applied toensure comparable and reproducible results.

The calendar basis of the assessments should be commensurate with the maximum level of risk
established under IS.AR.205.
The process to monitor, measure, evaluate and review the effectiveness of its ISMS referred tounder AMC1 IS.AR.235(a) should include as a minimum:(1)

the gathering and retention of metrics of the activities, and additional information that
could be useful for monitoring purposes;(2)

the analysis of the metrics in order to identify trends and deviations from predefined
performance targets.

Powered by EASA eRules

Page 76 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR](b)

ISMS MATURITY ASSESSMENT
The competent authority should assess the maturity of its ISMS using a suitable maturity modelin order to identify areas for improvement to the ISMS. To do so, the competent authority
should:(c)(1)

define or adopt a maturity model which represents a set of important and relevant
processes and capabilities that are expected to be implemented and maintained;(2)

for each assessed process or capability, ensure that the model defines criteria against
which specific aspects, characteristics and effectiveness should be assessed andevaluated when determining a maturity level;(3)

define for each assessed process or capability its desired target maturity level.

For each assessed information security process or capability contained in the maturity model,
the competent authority should:(1)

evaluate and justify the current maturity level;(2)

identify any area for improvement it should make to reach the targeted maturity level;(3)collect and record the evidence regarding strengths and weaknesses of the implemented
ISMS and its evaluated maturity.

GM1 IS.AR.235(a) Continuous improvement
ED Decision 2023/010/R

(a)

(b)

As general guidance, the elements of the ISMS that should be monitored, measured andevaluated should be, as a minimum:(1)

the risk assessment and treatment process (including risks at the interfaces with otherentities);(2)

the management of non-conformities and corrective actions;(3)

the incident and vulnerability management;(4)

the personnel competence management.

Existing maturity models for ISMS maturity evaluation
As general guidance, for the definition or the adoption of a maturity model (MM), the following
existing models may be considered:—

Cybersecurity Capability Maturity Model (C2M2), version 1.1: this model was publishedby the US Department of Energy in 2014. It introduces the notion of Maturity Indicator
Levels (MIL) ranging from 0 to 3 and addresses not only performance levels but also
performance practices (under Approach Objectives and approach progression) as well asassurance practices (under Management Objectives and institutionalization progression).

—

Systems Security Engineering – Capability Maturity Model (SSE-CMM): published by ISO
as ISO 21827 in 2008. It focuses on engineering practices, much less on operational
practices that are split in 11 ‘Security Base Practices’, and 11 ‘Project and Organizational
Base Practices’. It introduces the notion of five Capability Levels, from ‘Performed
Informally’ to ‘Continuously Improving’.

Powered by EASA eRules

Page 77 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]—

NIST Cybersecurity Framework (NIST CSF), version 1.1: published by NIST in April 2018.
Although it is not proposed as a MM, the framework defines four ‘Implementation Tiers’,
from ‘Partial’ to ‘Adaptive’, which are a qualitative measure of organisational
cybersecurity risk management practices. It focuses on the functionality and repeatabilityof cybersecurity risk management.

—

ATM Cybersecurity Maturity Model, edition 1: published in February 2019 by the
EUROCONTROL NM for organisations in the ATM domain. Whilst not being designed for
wider application, it can be adapted as necessary. It defines five maturity levels, ranging
from ‘Non-existent’ to ‘Adaptive’ inspired by the ‘Tier’ terminology from the NIST CSF. In
fact, the model is founded on NIST CSF, together with some elements of ISO/IEC 27001.

The following Table 1 maps the MM mentioned above to a hypothetical five-level MM.

Table 1: Mapping matrix of an existing MM to a hypothetical five-level MM
Mapping to a
C2M2
Eurocontrol
ISO 21827
NIST CSF 1.1
five-level MM
NM
InitialMIL 0

Non-Existent

Performed
Informally

DefinedMIL 1 (Initial)

PartialPlanned &TrackedPartial

Implemented

MIL 2(Identified)DefinedWell defined

Risk-Informed

ManagedMIL 3(Managed)

AssuredQuantitatively
Controlled

Repeatable

Adaptive

Continuously
Improving

Adaptive

Improved

No specific maturity level is required. However, if and when compliance is achieved, entities will
determine which requirements of which models have already been met (mandatory) and can opt toreach a level that is beneficial to the competent authority (voluntary). In the longer term, achieving
higher maturity levels may increase the confidence of oversight authorities, which can have an impact
upon the level of oversight activities regarding such competent authority.

AMC1 IS.AR.235(b) Continuous improvement
ED Decision 2023/010/R

When a deficiency is identified, the competent authority should react in a timely manner following adefined process leading to a managed status regarding the deficiency, its associated consequences
and, if needed, the prevention of its future recurrence or occurrence elsewhere.
Based on an evaluation of the impact and extent of the deficiency and the potential consequences on
the ISMS, the process should include as criteria for compliance:

Powered by EASA eRules

Page 78 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR](a)deciding on corrections and their implementation without undue delay in order to limit the
impact of the deficiency and deal with its consequences as well as, as applicable, to control or
eliminate it;(b)deciding on the need for, and the implementation of, corrective actions to eliminate thecause(s) of, and contributing factors to, the deficiency based on a root cause analysis and anevaluation of actions remediating the cause aimed at being proportionate to the consequences
and impact of the deficiency;(c)verifying the implemented actions:(1)

to be effective and to result in acceptable residual risks;(2)

not to have unintended side effects leading to other deficiencies, new risks, or an ISMS
not aligned with the applicable requirements; as well as(3)for corrective actions, to effectively remediate or eliminate the root cause;(d)reporting to and reviewing the identified deficiencies, action plan and results of the action takenwith the person identified in IS.AR.225(a) and, as necessary, with other involved or affectedroles and parties;(e)documenting as evidence the detected deficiencies, the planned and implemented corrections
and/or corrective actions with deadlines and responsible persons, the management feedback,the outcomes of the process step under point (c) above and, if necessary, the change decisions
made for the ISMS itself.

GM1 IS.AR.235(b) Continuous improvement
ED Decision 2023/010/R

The ‘necessary improvement measures’ referred to in IS.AR.235(b) refer to correction or corrective
actions to eliminate deficiencies, or actions aimed at improving the effectiveness as well as thematurity of the ISMS.
A process satisfying the criteria defined in AMC1 IS.AR.235 should include the following aspects:(a)identifying the extent, impact, context and triggers of the deficiency, evaluating it according tosome established criteria, analysing potential consequences for the ISMS including a potential
existence in other areas;(b)deciding on corrections and their implementation to immediately limit the impact and manage
the consequences of the deficiency as well as, as applicable, to control or eliminate it;(c)deciding on corrective actions required to eliminate the (root) cause(s) of the deficiency thatare proportionate to the consequences;(d)reassessing the elements of the ISMS which may be affected by the implemented actions toensure that no further risk is introduced;(e)verifying the implemented actions referred to in AMC1 IS.AR.235(b);(f)

reporting to and reviewing the outcomes of the process steps with the management (see point(d) of AMC1 IS.AR.235(b));(g)

documenting and evidencing the result of the process steps above (see point (e) of AMC1
IS.AR.235(b)).

Powered by EASA eRules

Page 79 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Appendix I — Examples of threat scenarios with a potential harmful
impact on safety
ED Decision 2023/010/R

The following is a non-exhaustive list of examples of information security threat scenarios with apotential harmful impact on safety that may be considered by authorities and organisations.

Example 1: Aircraft to ATC digital communications———

Threat vector assets/domain—

ATC voice and ground automation systems—

ground communications providers—

air-ground/ground-air RF communications service providers—

aircraft and the assets used for voice and datalink communications

Non-exhaustive summary of potential threats—

threat (availability): exceeding system performance, saturation of communication
channel—threat (integrity): man-in-the-middle or injection attacks—

threat (confidentiality): passive listening to communication, spying on hardware device

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption of services prevent ATC communication with a single or multiple aircraft
and/or ATC ground system.

—

Manipulation of data through a man-in-the-middle attack would present false
information to the pilot and/or ATC system with the potential of creating a safety hazard
or injection of data to the aircraft or ground systems to disrupt the service and capability.

—

There are no specific regulatory requirements for encryption of data or voice for datalink
communications; however, for confidentiality purposes, the assets used to provide anddeliver the services should be controlled and limited to only those resources that require
access to ensure that the services cannot be disrupted and manipulated in any way.

Example 2: Tampered air traffic data——

Threat vector assets/domain—

Internet service provider (ISP)—ATM services network(s)—surveillance data—

ATC systems

Non-exhaustive summary of potential threats—

ISP compromise (confidentiality): An attacker gains unauthorised access to the systems
or infrastructure of the ISP providing network services to ATM system.

Powered by EASA eRules

Page 80 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]——

data tampering (integrity): Once the ISP is compromised, an attacker could manipulate
data in transit. This could involve injecting false data or removing/modifying legitimate
data.

—

denial of service (availability): an attacker could also potentially disrupt thecommunication of data entirely, resulting in a denial of service (DoS) to the ATM system.

—

malware injection (integrity/availability): An attacker could potentially use thecompromised ISP as a launching pad to inject malware into the systems, causing further
disruptions or enabling additional attacks.

Summary of threats scenarios and their potential harmful impacts on safety—

ISP compromise: interception and/or manipulation of sensitive data, impacting the safe
management of air traffic.

—

data tampering: incorrect situational awareness, potentially resulting in reduced
separation between aircrafts, and incorrect air traffic control decisions.

—denial of service: reduction of the ATC’s ability to ensure separation leading to theactivation of contingency procedures, including capacity reduction, with the eventual
possibility of large areas of airspace being closed.

Example 3: Aircraft operator, CAMOs’ and aircraft maintenance organisations’ software supply
chain and ground infrastructure, including equipment used to support aircraft management,
operations and maintenance———Threat vector assets/domain—

aircraft operators’, CAMOs’ and maintenance organisations’ supply chain—

aircraft operator or maintenance internal ground infrastructure used to manage aircraftand operations (hardware/software) and other information technology assets—

information technology assets used to update systems on an aircraft (software andhardware) used for maintenance activities

Non-exhaustive summary of potential threats—

threat (availability): hardware/software/system disruption—

threat (integrity): compromised hardware/software/system—threat (confidentiality): compromised hardware/software/system

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption to the dissemination of meteorological information while the aircraft isairborne, may reduce the ability of the flight crew to avoid potentially hazardous
meteorological conditions (e.g. severe storms/fog at night).

—

Manipulation of navigation data/database will have the effect that flight plans andnavigation displays cannot be trusted.

—

Lack of control and access to information such as fleet maintenance programme or flightcrew planning affects the ability of organisations to maintain safe operations.

Powered by EASA eRules

Page 81 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Application of bow-tie analysis to this example
Two coordinated bow-tie analyses of different risk dimensions are combined, as the ultimate interest
lies only in the aviation safety consequence.

Information security bow-tie analysis element
Information security threats1) hardware/software vulnerability exploitation:
disturbed system function2) hardware/software vulnerability exploitation:system integrity compromised3) hardware/software vulnerability exploitation:
confidentiality of information processed by system(s)compromised

Aviation safety bow-tie analysis element

Information security preventive barriers
Information security hazards & top events
1) disturbed system functionality (hazard) →disrupted/unreliable system functionality
2) system integrity compromised (hazard) → system
function unpredictable3) information disclosable (hazard) → undetectable
information exfiltration

Safety threats1) disrupted/unreliable system functionality
2) system function unpredictable3) undetectable information exfiltration

Information security mitigating barriers

Safety preventive barriers
1) Use of access controls for system administration2) etc.
Safety hazards & top events:
1) loss of system function (hazard) →in operational
maintenance system
2) loss of system function integrity (hazard) →systems operate with wrong information
3) loss of information confidentiality (hazard) →confidential maintenance and aircraft internals
information leaks
Safety mitigating barriers
1) use of back-up procedures to prevent faulty
maintenance actions
2) use of procedures to secure aircraft software
integrity

Information security consequences
1) loss of system function (= production system
down)2) loss of system function integrity (= some system
function wrong/inoperative)3) loss of confidentiality of information (= some
information can leak)

Safety consequences
1) faulty maintenance actions2) incorrectly completed maintenance actions3) exfiltration of information allows for identificationof vulnerabilities
4) disruption of aircraft systems, unpredictablesystem function, loss of major aircraft systems (suchas engine control)

Powered by EASA eRules

Page 82 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Example 4: Design and production organisations’ software, supply chain, design and manufacturing
ground infrastructure———

Threat vector assets/domain—

design and production organisations’ supply chain for parts, hardware and software—

design and production organisations’ ground internal infrastructure used to manage
software/hardware used in the manufacturing and development of products that will be
used by aircraft manufacturers, operators or ATM/ANS ground automation systems(hardware/software) information technology assets—

design and production organisations’ information technology assets used by theircustomers to update systems on an aircraft (software/hardware) used for maintenance
operations or ATM/ANS ground automation systems

Non-exhaustive summary of potential threats—

threat (availability): systems used to store, transmit and exchange information are
rendered unavailable for essential operations through DoS attacks—

threat (integrity): systems used to store, transmit and exchange information arecompromised through man-in-the middle attacks—

threat (confidentiality): systems used to store, transmit and exchange information areaccessed by insider or external threats

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption of systems used to store, transmit and exchange information in a manner thatwould prevent the proper management of the aircraft and its systems and adversely
affect the operations of the aircraft—

Systems used to store, transmit and exchange information can no longer be considered
trusted. If they are not maintained at a level to ensure that all information exchange, dataand software can be considered trusted, both ground and aircraft operations are
disrupted.

—

Uncontrolled access to systems used to store, transmit and exchange information(including information that is received and exchanged with the supply chain) can provide
technical details that could be used to craft more sophisticated attacks targeting safetycritical systems.

Example 5: Training system—

Threat vector assets/domain—

supply chain of all software and hardware that will be used in the training systems or
training devices (including flight simulators) used to train pilot or ATM/ANS groundsystems personnel—

internal infrastructure used in of all software and hardware that will be used in thedesign, manufacturing or production of products (hardware or software) that will be usedin aircraft or ATM/ANS ground systems

Powered by EASA eRules

Page 83 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

—

—

—

management of internal operating domains and system of all software and hardware thatwill be used in the design, manufacturing or production of products (hardware orsoftware) that will be used in aircraft or ATM/ANS ground systems

Non-exhaustive summary of potential threats—

threat (availability): training systems or training devices are rendered unavailable bymeans of DoS attacks when they are needed to be used—threat (integrity): training systems or training devices are compromised through man-inthe middle attacks—

threat (confidentiality): functional models, information and data that are embedded intraining systems or training devices are accessed by insider or external threats

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption of training systems (hardware and software) will have an impact on theorganisations’ ability to maintain qualified staff. It would also prevent the aircraft and its
systems from being properly operated and affect maintenance operations for ATM/ANS
ground systems.

—

The training model or the failure modes and associated emergency conditions differ fromthe real aviation system behaviour and therefore induce inappropriate responses. If the
training systems cannot be trusted, this will affect the ability of organisations to maintainsufficiently qualified staff for their operations (pilots, maintenance or ATM/ANS groundpersonnel who have been exposed to improper training should be re-qualified).

—

Lack of control and access to training systems affects the ability of organisations tomaintain a training system that is known to be in a trusted state. In addition, uncontrolled
access to training systems that embed functional models, information and data canprovide technical details that could be used to craft more sophisticated attacks on the
training system itself or on the real-world safety-critical system.

Example 6: Airport’s fuel delivery system and associated infrastructure——

Threat vector assets/domain—

ground fuel storage and distribution infrastructure—

digital systems used to control fuel pumping and metering—

supply chain for fuel delivery, including third-party fuel suppliers—

airport information technology assets used for fuel inventory management andscheduling deliveries

Non-exhaustive summary of potential threats—

threat (availability): disruption of fuel supply or delivery systems—

threat (integrity): tampering with fuel control systems or measurement devices—

threat (confidentiality): unauthorised access to fuel supply and delivery data

Powered by EASA eRules

Page 84 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]—

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption to fuel delivery can lead to flight delays or cancellations, causing operational
disruptions and potential safety issues if fuel reserves become critically low.

—

Tampering with fuel control systems or measurement devices could lead to incorrect fuelloads being delivered to aircraft, impacting aircraft weight and balance calculations, andpotentially causing fuel exhaustion incidents.

—

Unauthorised access to fuel supply data could allow threat actors to manipulate fuelscheduling or inventory data, potentially causing disruptions to airport operations andfuel availability for aircraft.

Example 7: National competent authority’s NOTAM system and associated infrastructure———

Threat vector assets/domain—

National NOTAM system infrastructure and digital interface—

Supply chain for NOTAM system maintenance and updates—

National competent authority’s IT assets used for NOTAM creation, distribution, andstorage

Non-exhaustive summary of potential threats—

threat (availability): disruption of the NOTAM system or its access—threat (integrity): tampering with NOTAM data or unauthorised NOTAM creation—

threat (confidentiality): unauthorised access to NOTAM data

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption to the NOTAM system could prevent the dissemination of critical aeronauticalinformation to pilots and air traffic controllers, potentially leading to safety issues.

—

Tampering with NOTAM data or unauthorised creation of NOTAMs could lead to incorrect
information being disseminated, potentially resulting in pilots making decisions based on
false or misleading data.

—

Unauthorised access to NOTAM data could lead to information leakage, potentiallyrevealing sensitive operational information.

Example 8: Aviation authority’s airworthiness directive (AD) system and associated infrastructure——

Threat vector assets/domain—

EASA AD system infrastructure and digital interface—

supply chain for AD system maintenance and updates—

EASA IT assets used for AD creation, distribution, and storage

Non-exhaustive summary of potential threats—

threat (availability): Disruption of the AD system or its access—threat (integrity): tampering with AD data or unauthorised AD creation

Powered by EASA eRules

Page 85 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]——

threat (confidentiality): unauthorised access to AD data

Summary of threats and their potential harmful impacts on safety—

Disruption to the AD system could prevent the dissemination of critical airworthinessinformation to aircraft operators and maintenance organisations, potentially leading tosafety issues.

—

Tampering with AD data or unauthorised creation of ADs could lead to incorrect
information being disseminated, potentially resulting in aircraft operators andmaintenance organisations making decisions based on false or misleading data.

—

Unauthorised access to AD data could lead to information leakage, potentially revealing
sensitive operational information.

Powered by EASA eRules

Page 86 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Appendix II — Main tasks stemming from the implementation ofPart-IS, including mapping to NIST CSF 1.1 competencies andISO/IEC 27001 clauses and controls
ED Decision 2023/010/R

Activity typePart-IS main task

Reference
NIST CSF Version 1.1

Management,
Operational

Part-ISManagement

IS.AR.200(a)ISO/IEC 27001

Function

Category

Paragraph
ClauseIDENTIFY

ID.RM

4
6.1.1

IDENTIFY

ID.BE-2
ID.BE-4
ID.AM-5

4.3

IDENTIFY

ID.GV-1

5.2

IDENTIFY

ID.GV-4
ID.RA

PROTECT

PR.PT

Management

IS.AR.200(a)(4)
IS.AR.215

DETECT

DE.AE-3
DE.CM-1
DE.CM-2
DE.CM-3

Monitorcompliance withthis Regulation andreport findings to
top management

Operational

IS.AR.200(a)(8)

IDENTIFY

ID.GV-3

Protect
confidentiality of
exchanged
information

Operational

IS.AR.200(a)(9)

PROTECT

PR.DS-1
PR.DS-2

Establish andoperate an
information
security
management
system (ISMS)
Establish the scopeof the ISMS
according to Part-IS
requirements
Implement andmaintain an
information
security policy
Identify and review
information
security risks
Implement security
risk treatment
measures
Implement
measures to detect
information
security events andidentify thoserelated to aviation
safetyManagement

Management

Management

Management

Powered by EASA eRules

IS.AR.205(a)IS.AR.200(a)(1)
IS.AR.200(a)(2)
IS.AR.205
IS.AR.200(a)(3)
IS.AR.210

Annex A Control
:2013
:2022

A5.1

A5.1

6.1.2
8.1
8.2
6.1.3
8.1
8.3
A11.1.2
A12.4.1
A12.4.3
A16.1.7

9.2

A7.2
A8.15
A5.28

A18.2.1
A18.2.2

A5.35
A5.36

A8.2.2
A13.2

A5.13
A5.14

Page 87 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Activity typePart-IS main task

Communicate to
the Agency
changes regarding
capability andresponsibilities
Share information
to assist othercompetent
authorities,
agencies andorganisations

Implement andmaintain acontinuous
improvement
process to measure
the effectivenessand maturity of the
ISMS and strive toimprove it

Document andmaintain all key
processes,
procedures, roles
and responsibilities

Identify all
elements which
could be exposed
to information
security risks
Identify theinterfaces withother organisations
which could result

Management,
Operational

Operational

Operational

Management

Management

Management

Management

Powered by EASA eRules

Reference
NIST CSF Version 1.1
Part-IS
Function

Category

ISO/IEC 27001
Paragraph
ClauseIS.AR.200(a)(10)

IS.AR.200(a)(11)

IS.AR.200(b)IS.AR.235

IDENTIFY

ID.RA-2
ID.BE-2

PROTECT

PR.IP-8

RESPON
D

RS.CO-3
RS.CO-5

IDENTIFY

ID.RA-6
ID.SC-4

PROTECT

PR.IP-7
PR.IP-10

IS.AR.205(a)IS.AR.205(b)A6.1.3

A5.5

A6.1.4

A5.6

4.4
9.1
9.3
10.1
10.2

A5.1.2
A16.1.7
A17.1.3
A18.2.1

A5.1
A5.28
A5.29
A5.35

4.2
5.2
5.3

A5.1
A6.1.1

A5.1
A5.2

A8.1.1

A5.9

DETECT

DE.DP-5

RESPOND

RS.MI-3
RS.IM-2

RECOVER

RC.IM-2

IDENTIFY

ID.AM-6
ID.GV-4
ID.RM-1
ID.SC-1
ID.SC-2

PROTECT

PR.AT-2
PR.AT-4
PR.AT-5
PR.IP-12

DETECTRESPON
D

DE.DP-1
RS.CO-1
RS.AN-5

IDENTIFY

ID.AM-1
ID.AM-2
ID.AM-4
ID.AM-5

4.3

IDENTIFY

ID.BE-1
ID.BE-2
ID.BE-4
ID.BE-5

4.3

IS.AR.200(c)Annex A Control
:2013
:2022

Page 88 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Activity typePart-IS main task

Management,
Operational

Reference
NIST CSF Version 1.1
Part-IS

ISO/IEC 27001

Function

Category

Paragraph
Clause6.1.2

Annex A Control
:2013
:2022

in exposure to
information
security risks
Identify
information
security risks andassign a risk level
Review and update
the risk assessment
based on certain
criteria
Develop andimplement
measures toaddress risks andverify theireffectivenessCommunicate theoutcome of the risk
assessment tomanagement,
other personnel
and other
organisations
sharing aninterface

Implement
measures to detectin processes andoperations
information
security events
which may have apotential impact onaviation safety
Implement
measures to
respond to
information
security events thatManagement

IS.AR.205(c)IDENTIFY

ID.RA-1
ID.RA-2
ID.RA-3
ID.RA-4
ID.RA-5

Operational

IS.AR.205(d)IDENTIFY

ID.RM

8.2

Operational

IS.AR.210(a)PROTECT

PR.IP
PR.PT

6.1.3
8.3

IDENTIFY

ID.AM-3
ID.BE-1
ID.BE-2
ID.BE-4
ID.RM-3
ID.SC-3

PROTECT

PR.IP-7

DETECT

DE.AE-2
DE.AE-3DE.AE-5

DETECT

DE.AE
DE.CM
DE.DP

PROTECT

PR.PT-1

RESPON
D

RS.RP
RS.AN
RS.MI

Operational

Operational

Operational

Powered by EASA eRules

IS.AR.210(b)IS.AR.215(a)IS.AR.215(b)

A5.7

8.1

A11.1.2
A12.4.1
A12.6.1
A16.1.1
A16.1.2
A16.1.3
A16.1.4
A16.1.5

A7.2
A8.8
A8.15
A8.16
A5.24
A5.25
A5.26
A6.8

A16.1.
5

A5.26

Page 89 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Activity typePart-IS main task

Management,
Operational

Reference
NIST CSF Version 1.1
Part-IS

ISO/IEC 27001
Paragraph
ClauseAnnex A Control
:2013
:2022

Function

Category

RECOVERRC.RP-1
RC.IM-1

A16.1.
5
A16.1.6

A5.26
A5.27

A15.1
A15.2

A5.19
A5.20
A5.21
A5.22

may cause asecurity incident

Implement
measures torecover frominformation
security incidents
Manage risks
associated with
contracted
activities withregard to the
management of
information
security
Define a personwith the authority
to establish andmaintain theorganisational
structures, policies,
processes, andprocedures
necessary to
implement thisRegulation
Create andmaintain a process
to ensure that
there is sufficientpersonnel toperform allactivities regarding
information
security
management
Create andmaintain a process
to ensure that thepersonnel have thenecessarycompetence foractivities regarding

Operational

IS.AR.215(c)Management

IS.AR.220

IDENTIFY

ID.SC-1
ID.SC-2

Management

IS.AR.225(a)IDENTIFY

ID.AM-6

7.1

A6.1.1

A5.2

Management

IS.AR.225(b)IDENTIFY

ID.AM-5
ID.AM-6
ID.GV-2

7.1

A6.1.1

A5.2

IDENTIFY

ID.AM-5
ID.AM-6
7.2

A7.2.2

A6.3

Management

Powered by EASA eRules

IS.AR.225(c)PROTECT

PR.AT-1

Page 90 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Activity typePart-IS main task

information
security
management
Create andmaintain a process
to ensure that thepersonnel
acknowledge theresponsibilities
associated with theassigned roles andtasks
Verify the identity
andtrustworthiness of
personnel who
have access to
information
systems

Archive, protect
and retain records
traceability for a
specified time

Reference
NIST CSF Version 1.1

Management,
Operational

Part-ISManagement

Management

Operational

ISO/IEC 27001

Function

Category

Paragraph
ClauseAnnex A Control
:2013
:2022

IS.AR.225(d)IDENTIFY

ID.GV-2
ID.GV-3

7.3
7.4

A7.1.2

A6.2

IS.AR.225(e)PROTECT

PR.AC-6
PR.IP-11

7.1

A7.1.1

A6.1

IDENTIFY

ID.RA-4

PROTECT

PR.AC-2
PR.AC-3
PR.AC-4
PR.DS-1
PR.DS-4
PR.DS-5
PR.DS-6
PR.IP-4
PR.IP-6
PR.PT-1

7.5

A8.2.2A8.2.3
A11.1.3
A11.1.4
A12.1.3
A12.3.1
A12.4.1
A12.4.2
A12.4.3

A5.10
A5.13
A7.3
A7.5
A8.6
A8.10
A8.13
A8.15

IS.AR.230

RESPON
D

RS.CO-2
RS.CO-3
RS.CO-4
RS.CO-5

RECOVER

RC.CO-3

Regularly assess
the effectivenessand maturity of the
ISMS

Operational

IS.AR.235(a)9A5.1.2
A12.7.1
A16.1.6

A5.1
A5.27
A8.34

Take actions toimprove the ISMS if
required. Reassess

Operational

IS.AR.235(b)10A5.1.2

A5.1

Powered by EASA eRules

Page 91 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Activity typePart-IS main task

Management,
Operational

Reference
NIST CSF Version 1.1
Part-IS
Function

Category

ISO/IEC 27001
Paragraph
ClauseAnnex A Control
:2013
:2022

the implemented
measures of the
ISMS elements.

Powered by EASA eRules

Page 92 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX I — INFORMATIONSECURITY — AUTHORITY
REQUIREMENTS [PART-IS.AR]

Appendix III — Examples of aviation services
ED Decision 2023/010/R

The following is a non-exhaustive and non-complete list of aviation services that can be used as a basis
to identify the scope of risk assessment for the organisation.

aerodrome ATM-MET services provider
aeronautical digital map service
AIM (external)
airportAPP ACC
ATC (external)
ATC superiorATM
ATM-MET services provider
civil AU operations centre
communication infrastructure
ER ACCFIS/TIS data integrator
national AIM
navigation infrastructure — ground-basednavigation Infrastructure — satellite-based
non-ATM-MET services provider
non-aviation users (external)
regional AIM
regional ASM
regional ATFCM
state AU operations centre
static aeronautical data service
sub-regional DCB common service provision
sub-regional/local ATFCM
sub-regional/national ASM
surveillance infrastructure airport
surveillance infrastructure en-routesurveillance infrastructure TMA
time reference (external)
tower (TWR)

Powered by EASA eRules

Page 93 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

ANNEX II — INFORMATION SECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]
IS.I.OR.100 Scope
Regulation (EU) 2023/203

This Part establishes the requirements to be met by the organisations referred to in Article 2(1) of thisRegulation.

IS.I.OR.200 Information security management system (ISMS)
Regulation (EU) 2023/203(a)In order to achieve the objectives set out in Article 1, the organisation shall set up, implement
and maintain an information security management system (ISMS) which ensures that theorganisation:(1)

establishes a policy on information security setting out the overall principles of theorganisation with regard to the potential impact of information security risks on aviation
safety;(2)

identifies and reviews information security risks in accordance with point IS.I.OR.205;(3)

defines and implements information security risk treatment measures in accordance withpoint IS.I.OR.210;(4)implements an information security internal reporting scheme in accordance with point
IS.I.OR.215;(5)

defines and implements, in accordance with point IS.I.OR.220, the measures required todetect information security events, identifies those events which are considered
incidents with a potential impact on aviation safety except as permitted by point
IS.I.OR.205(e), and responds to, and recovers from, those information security incidents;(6)

implements the measures that have been notified by the competent authority as an
immediate reaction to an information security incident or vulnerability with an impact onaviation safety;(7)

takes appropriate action, in accordance with point IS.I.OR.225, to address findings
notified by the competent authority;(8)

implements an external reporting scheme in accordance with point IS.I.OR.230 in orderto enable the competent authority to take appropriate actions;(9)complies with the requirements contained in point IS.I.OR.235 when contracting any partof the activities referred to in point IS.I.OR.200 to other organisations;(10) complies with the personnel requirements laid down in point IS.I.OR.240;(11) complies with the record-keeping requirements laid down in point IS.I.OR.245;(12) monitors compliance of the organisation with the requirements of this Regulation andprovides feedback on findings to the accountable manager to ensure effective
implementation of corrective actions;Powered by EASA eRules

Page 94 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](13) protects, without prejudice to applicable incident reporting requirements, theconfidentiality of any information that the organisation may have received from otherorganisations, according to its level of sensitivity.
(b)

In order to continuously meet the requirements referred to in Article 1, the organisation shall
implement a continuous improvement process in accordance with point IS.I.OR.260.

(c)

The organisation shall document, in accordance with point IS.I.OR.250, all key processes,
procedures, roles and responsibilities required to comply with point IS.I.OR.200(a), and shallestablish a process for amending that documentation. Changes to those processes, procedures,roles and responsibilities shall be managed in accordance with point IS.I.OR.255.

(d)

The processes, procedures, roles and responsibilities established by the organisation in order
to comply with point IS.I.OR.200(a) shall correspond to the nature and complexity of its
activities, based on an assessment of the information security risks inherent to those activities,
and may be integrated within other existing management systems already implemented by theorganisation.

(e)Without prejudice to the obligation to comply with the reporting requirements laid down inRegulation (EU) No 376/2014(1) and the requirements laid down in point IS.I.OR.200(a)(13), theorganisation may be approved by the competent authority not to implement the requirements
referred to in points (a) to (d) and the related requirements contained in points IS.I.OR.205
through IS.I.OR.260, if it demonstrates to the satisfaction of that authority that its activities,
facilities and resources, as well as the services it operates, provides, receives and maintains, do
not pose any information security risks with a potential impact on aviation safety neither toitself nor to other organisations. The approval shall be based on a documented information
security risk assessment carried out by the organisation or a third party in accordance with point
IS.I.OR.205 and reviewed and approved by its competent authority.
The continued validity of that approval will be reviewed by the competent authority following
the applicable oversight audit cycle and whenever changes are implemented in the scope ofwork of the organisation.

GM1 IS.I.OR.200 Information security management system (ISMS)ED Decision 2023/009/R

An information security management system (ISMS) is a systematic approach to establish,
implement, operate, monitor, review, maintain and continuously improve the state of information
security of an organisation. Its objective is to protect the information assets, such that the operationaland safety objectives of an organisation can be reached in a risk-aware, effective and efficient manner.
Generally speaking, an ISMS establishes an information security risk management process, based upon
the results of information security impact analyses, which basically determine its scope. If information
security breaches may cause or contribute to aviation safety consequences, information security
requirements need to limit their impact on levels of aviation safety, which are deemed acceptable.
Hence, all roles, processes, or information systems, which may cause or contribute to aviation safety
consequences, are within the scope of Regulation (EU) 2023/203. The ISMS provides for means to
decide on needed information security controls for all architectural layers (governance, business,

Powered by EASA eRules

Page 95 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

application, technology, data) and domains (organisational, human, physical, technical). It further
allows to manage the selection, implementation, and operation of information security controls.
Finally, it allows to manage the governance, risk management and compliance (GRC) within the ISMS
scope.
The risk management process is thus based on aviation safety risk assessments and derived
information security risk acceptance levels, which are designed to effectively treat and manage
information security risks with a potential impact on aviation safety caused by threats exploiting
vulnerabilities of information assets in aeronautical systems. Interacting bow-ties allow for a higherlevel and non-exhaustive illustration of how different disciplines of risk assessment may need tocollaborate to establish a common risk perspective, as depicted in Figure 1.

Figure 1: Bow-tie representation of management of aviation safety risks posed by information
security threats
The ISMS in this Regulation should bring together the information security and aviation safetycompetencies in most of the processes, including, for instance, identifying critical systems or threats,
and assessing potential impacts on and risks to aviation safety.
ISMS implementation and maintenance
An ISMS, as defined in this Regulation, employs the perspectives of governance, risk and compliance,
and an approach that combines the safety risk and performance dimensions to determine theinformation security controls that are appropriate to and compliant with the specific context and caneffectively provide the level of protection required to achieve the aviation safety objectives by:—

Governance perspective refers to providing management direction and leadership aimed toachieve the entity’s own overarching objectives:—

leadership and commitment of the senior management defining and ensuring the close
involvement of the management and a ‘top-down’ ISMS implementation—

information security and safety objectives aligned and consistent with the entity’sbusiness objectives and monitored by, e.g., management reviews—

information security policies stating the principles and objectives to be achieved

Powered by EASA eRules

Page 96 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]—

roles, responsibilities, competencies and resources required for an effective ISMS—

effective, target-group-oriented communication to internal and external stakeholders—

Risk perspective refers to a key aspect of an ISMS in an aviation safety context according to thisRegulation, and serves as a basis for transparent decision-making and prioritisation of controls
and risk treatment options. It further refers to the assessment, treatment and monitoring of
information security risks in support of the management of aviation safety risks for the key
processes and information assets upon which they depend. This includes protection
requirements, risk exposure, attitude towards risks and risk acceptance criteria, methods andindustry standards.

—

Compliance perspective refers to the compliance with regulatory, legal and contractual
requirements. This includes:—

this Regulation,—

the entity’s own policies and standards and may further include international or industry
standards adopted by the entity from ISO, EUROCAE, etc.

This perspective comprises the definition, implementation and maintenance of the required
information security provisions whose effectiveness and compliance should be regularly
monitored and assured by, e.g., (internal) audits.
Based on these perspectives, we may identify the following processes or subject areas that have beenshown to be relevant for the establishment of an effective ISMS. These ISMS processes and subject
areas can be summarised as follows:(a)context establishment defining the scope, interfaces, dependencies and requirements ofinterested parties;(b)leadership and commitment of the senior management;(c)information security and safety objectives;(d)information security policies;(e)roles, responsibilities, competencies and resources required for an effective ISMS;(f)communication to internal and external stakeholders to achieve a sufficient level of information
security awareness and training of all involved parties;(g)

information security risk management including risk assessment and treatment;(h)information security incident management establishing processes for the handling of
information security incidents and vulnerabilities;(i)

performance & effectiveness monitoring, measurement and evaluation;(j)internal audits and management reviews;(k)corrections and corrective actions;(l)continuous improvement;(m)relationship with suppliers;(n)documentation, record-keeping, and evidence collection.

Powered by EASA eRules

Page 97 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Additional critical success factors for the implementation and operation of an ISMS include thefollowing:—

The ISMS should be integrated with the entity’s processes and overall management structure
or even — at least partially, with safeguards for their respective integrity, and as reasonably
applicable — with an overarching management system comprising information security,
aviation safety and quality management.

—

Information security has to be considered at an early stage in the overall design of processes
and procedures, of systems and of information security controls, to be seamlessly integrated,
for maximum effectiveness, minimal functional interference and optimised cost. None of thesebenefits can be achieved by integrating it on later.

—

The risk management process determines appropriate characteristics of preventive controls toreach and maintain acceptable risk levels.

—

The incident management process ensures that the organisation detects, reacts and responds
to information security incidents in a timely manner. This is achieved by defining
responsibilities, procedures, scenarios and response plans in advance to ensure a coordinated,targeted and efficient response.

—

Continuous monitoring and reassessment are undertaken and improvements are made in
response.

The above-mentioned core components are related to the requirements in this Regulation, for which
Figure 2 provides a high-level depiction of the aspects that are more prominent in the implementation
phase and those that characterise the operational phase, as well as the review and possible
improvement, if the functions do not perform as planned.

Figure 2: Representation of the Part-IS requirements from an ISMS’s life cycle perspective

Powered by EASA eRules

Page 98 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Plan-Do-Check-Act approach
The Plan-Do-Check-Act (PDCA) refers to a process approach that is often used to establish, implement,
operate, monitor, review and improve management systems. Figure 3 depicts the PDCA applied to an
ISMS.

Figure 3: Plan-Do-Check-Act approach applied to an ISMS

Benefits of an ISMS
The benefits of a management system operating in a dynamic, uncertain or unpredictable risk
environment are realised in the long term only when the organisation improves existing controls,
processes and solutions based on the assessments of risks, performance and maturity as well as on
the learnings from incidents, audits, non-conformities and their root causes. A successful adoption
and deployment of an ISMS allows an entity to:—achieve greater assurance to the management and interested parties that its information assets
are adequately protected against threats on a continual basis;—increase its trustworthiness and credibility providing confidence to interested parties that
information security risks with an impact on aviation safety are adequately managed;—

increase the resilience of the entity’s key processes against unauthorised electronic interactions
and maintains the entity’s ability to decide and act;—

support the timely detection of control gaps, vulnerabilities or deficiencies aimed to prevent
information security incidents or at least to minimise their impact;

Powered by EASA eRules

Page 99 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]—

detect and timely react to changes in the entity’s environment including system architecture
and threat landscape or the adoption of new technologies;—

provide a foundation for effective and efficient implementation of a comprehensive
information security strategy in times of digital transformation, increasing interconnectivity ofsystems, emerging information security threats and new technologies.

Relation to ISO/IEC 27001
The international standard ISO/IEC 27001 is a widely adopted standard for ISMS which specifies
generic requirements for establishing, implementing, maintaining and continually improving an ISMS.
It also includes requirements for the assessment and treatment of information security risks. The
requirements are applicable to all entities, regardless of type, size or nature. The conformity of an
ISMS with the ISO/IEC 27001 standard can be certified by an accredited certification body. ISO/IEC
27001 is compatible with other management system standards (quality, safety, etc.) that have also
adopted the structure and terms defined in Annex SL to ISO/IEC Directives, Part 1, Consolidated ISO
Supplement. This compatibility allows an entity to operate a single management system that meetsthe requirements of multiple management system standards.
ISO/IEC 27001 allows entities to define their own scope of audit and their own organisational risk
appetite. This, in turn, leads to information security requirements that provide the ISMS with criteria
for the acceptability of information security risks in line with the entity’s risk appetite (see Figure4).

Figure 4: Relation between the entity’s risk appetite and the information security objectives
The requirements for an ISMS specified by this Regulation are in most parts consistent and alignedwith ISO/IEC 27001; however, this Regulation introduces provisions specific to the context of aviation
safety. If an ISO/IEC 27001-based ISMS is already operated by an entity for a different scope andcontext, it can be adapted and extended to the scope and context of this Regulation in astraightforward manner based on an analysis of the scope and the gaps. In order to take credit from
ISO/IEC 27001 certifications to achieve compliance with Part-IS, aviation safety needs to be includedin the organisational risk management, with the relevant risk acceptance level determined by theapplicable regulation (see Figure 5). Therefore, careful determination of the scope of the ISMS related
to aviation safety risks is needed, as it might differ from the one related to the other organisationalrisks. To allow demonstration of compliance with Regulation (EU) 2023/203, careful delineation
Powered by EASA eRules

Page 100 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

between aspects of the ISMS related to aviation safety risks and other organisational risks may berequired. This could have an influence upon the decision to integrate ISMSs.

Figure 5: Introduction of aviation safety aspects in the entity’s risk appetite

PART-IS versus ISO/IEC 27001 cross reference table
For a mapping between the main tasks required under Part-IS and the clauses and associated controls
in ISO/IEC 27001, refer to Appendix II.

AMC1 IS.I.OR.200(a)(1) Information security management system(ISMS)ED Decision 2023/009/R

The organisation should define and document the scope of the ISMS, by determining activities,
processes, supporting systems, and identifying those which may have an impact on aviation safety.
The information security policy should be endorsed by the accountable manager and reviewed atplanned intervals or if significant changes occur. Moreover, the policy should cover at least thefollowing aspects with a potential impact on aviation safety by:(a)committing to comply with applicable legislation, consider relevant standards and bestpractices;(b)

setting objectives and performance measures for managing information security;(c)defining general principles, activities, processes for the organisation to appropriately secure
information and communication technology systems and data;(d)committing to apply ISMS requirements into the processes of the organisation;(e)committing to continually improve towards higher levels of information security process
maturity as per IS.I.OR.260;

Powered by EASA eRules

Page 101 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](f)

committing to satisfy applicable requirements regarding information security and its proactive
and systematic management and to the provision of appropriate resources for its
implementation and operation;(g)

assigning information security as one of the essential responsibilities for all managers;(h)committing to promote the information security policy through training or awareness sessions
within the organisation to all personnel on a regular basis or upon modifications;(i)encouraging the implementation of a ‘just-culture’ and the reporting of vulnerabilities,
suspicious/anomalous events and/or information security incidents;(j)committing to communicate the information security policy to all relevant parties, as
appropriate.

Note: A significant change is a notable alteration or modification that has a meaningful impact on theorganisation’s operations, such as a structural change within the organisation due to reorganisations,a change in the business processes (e.g. working from home, use of personal devices), a technologicalevolution (e.g. distributed computing resources, artificial intelligence/machine learning) or an
evolution in the threat landscape.

GM1 IS.I.OR.200(a)(1) Information security management system(ISMS)ED Decision 2023/009/R

INFORMATION SECURITY POLICY AND OBJECTIVES

The information security policy should suit the organisation’s purpose and direct its own information
security activities. Such policy should contain the needs for information security in the organisation’scontext, a high-level statement of direction and intent of the information security activities, theprinciples and most important strategic and tactical objectives to be achieved by the ISMS, as well as
the general information security objectives or a specification of a framework (who, how) for setting
information security objectives. The information security policy should also contain a description of
the established ISMS, including roles, responsibilities and references to topic-specific policies andstandards.
The information security objectives should be:—consistent and aligned with the information security policy and consider the applicable
information security requirements, derived from the overarching organisation’s objectives, andthe results from the risk assessment and treatment (which, in turn, supports theimplementation of the organisation’s strategic goals and information security policy);—

regularly reviewed to ensure that they are up to date and still appropriate;—measurable if practicable (to be able to determine whether the objective has been met), aimed
to be SMART (specific, measurable, attainable, realistic, timely) and aligned with all affected
responsible persons.

When defining information security objectives, e.g., based on the overarching organisation’s
objectives, the information security requirements or the results of risk assessments, it should bedetermined how these objectives will be achieved. The degree to which information security
objectives are achieved must be measurable. If possible, it should be measured by key performanceindicators (KPIs) which have been defined in advance (refer to resources such as COBIT 5 forPowered by EASA eRules

Page 102 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Information Security). It is recommended to start with the definition of a limited number of
information security objectives which are relevant for the organisation, more of a long-term natureand measurable with a reasonable effort relative to the delivered benefits.

AMC1 IS.I.OR.200(a)(12) Information security management system(ISMS)ED Decision 2023/009/R

COMPLIANCE MONITORING

When establishing compliance with the provisions under point IS.I.OR.200(a)(12), the organisation
should implement a function to periodically monitor compliance of the management system with therelevant requirements and adequacy of the procedures including the establishment of an internal
audit process and an information security risk management process. When the organisation has
already established a compliance monitoring function under the implementing regulation for its
domain, such function should include the monitoring of the management system with the relevant
requirements within the scope of its activities. Compliance monitoring should include a feedback
mechanism of audit findings to the accountable manager or delegated person(s) to ensure
implementation of corrective actions as necessary.

GM1 IS.I.OR.200(a)(12) Information security management system(ISMS)ED Decision 2023/009/R

COMPLIANCE MONITORING

For the purpose of compliance monitoring, internal audits should be conducted at planned intervals
to provide assurance on the status of the ISMS to the management and to provide information on thefollowing:—

conformity of the ISMS to the requirements of this Regulation and the organisation’s own
requirements either stated in the information security policy, procedures and contracts orderived from information security objectives or outcomes of the risk treatment process;—effective implementation and maintenance of the ISMS.

Internal audits should follow an independent approach and a decision-making process based onevidence. Moreover, when setting up an audit programme, the importance of the processes
concerned, and definitions of the audit criteria and scope should be considered. Documented
information should be retained evidencing the audit results, their reporting to the relevant
management and the audit programme.

Powered by EASA eRules

Page 103 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

AMC1 IS.I.OR.200(a)(13) Information security management system(ISMS)ED Decision 2023/009/R

When establishing compliance with the provisions under points IS.I.OR.200(a)(13), the organisation
should implement and maintain information security controls that are sufficiently robust and effective
to protect information and ensure the need-to-know principle (i.e. limiting access to information to
only those who need it to perform their duties). It should protect the source of information inaccordance with the relevant provisions established in Regulation (EU) 2018/1139. It should also
comply with Regulation (EU) No 376/2014.

AMC1 IS.I.OR.200(c) Information security management system(ISMS)ED Decision 2023/009/R

When establishing compliance with the provisions under point IS.I.OR.200(c), the organisation should:(a)provide an outline of the structure of the specific information security personnel (internal andexternal), including their roles and responsibilities. This outline of the structure will be used to
manage and maintain the elements included within the scope of the ISMS and will be approvedby the accountable manager. The organisation should review the outline of the structure atplanned intervals or if significant changes occur (see the Note in AMC1 IS.I.OR.200(a)(1));(b)

identify and categorise all relevant contracted organisations used to implement the ISMS. The
organisation should define and document procedures for the management of interfaces andcoordination between the organisation and other organisations, including contractedorganisations;(c)identify and define all key processes and procedures, and internal and external reporting
schemes, that will be used to maintain compliance with the objectives of this Regulation overthe life cycle of the ISMS. The organisation may adjust existing processes or procedures forcompliance;(d)identify and document any other information that will be used to maintain compliance with theobjectives of this Regulation;(e)when creating and updating documented information, ensure appropriate identification anddescription (e.g. a title, date, author, or reference number) as well as a review and an approval
for suitability and adequacy;(f)control the documented information required by the ISMS to ensure that it is:(1)

available and suitable for use, where and when it is needed;(2)adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

Powered by EASA eRules

Page 104 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.200(c) Information security management system(ISMS)ED Decision 2023/009/R

The amount of information that should be documented to maintain compliance with the objectives ofthis Regulation may vary between organisations due to various factors, such as size and complexity,or the need for harmonisation with other management processes already in place. As generalguidance, taking into account the documents required to comply with point IS.I.OR.200(a), the recordkeeping requirements referred to in IS.I.OR.245 and the information security management manual
requirements referred to in IS.I.OR.250, the following is a non-exhaustive list of information thatshould be documented:(a)information security policy that should include the organisation’s information security
objectives — see IS.I.OR.200(a)(1);(b)

responsibilities and accountabilities for roles relevant to information security — see
IS.I.OR.250(a)(2), (3), (6) and (7) and the personnel requirements referred to in points
IS.I.OR.240(a), (b), (c), (d) and (f) and the related AMC and GM;(c)scope of the ISMS and the interfaces with, and dependencies on, other parties — see
IS.I.OR.200(a)(2) and the information security requirements referred to in points IS.I.OR.205(a)and (b);(d)

information security risk management process — see the information security requirements
referred to in points IS.I.OR.205 and IS.I.OR.210;(e)archive of the risks identified in the information security risk assessment along with theassociated risk treatment measures (often referred to as ‘risk register’ or ‘risk ledger’) — see
IS.I.OR.245;(f)evidence of the competencies necessary for the personnel performing the activities required
under this Regulation — see IS.I.OR.240(g) and the related AMC and GM;(g)evidence of the current competencies of the personnel performing the activities required under
this Regulation — see IS.I.OR.245(b)(1);(h)(key) performance indicators derived from evidence of the monitoring and measurement of the
ISMS processes.

GM1 IS.I.OR.200(d) Information security management system(ISMS)ED Decision 2023/009/R

PROPORTIONALITY IN ISMS IMPLEMENTATION

When implementing the processes and procedures, as well as establishing the roles andresponsibilities required under point IS.I.OR.200(d), the organisation should primarily consider therisks that it may be posing to other organisations, as well as its own risk exposure. Other aspects that
may be relevant include the organisation’s needs and objectives, information security requirements,
its own processes and the size, complexity and structure of the organisation, all of which may changeover time.

Powered by EASA eRules

Page 105 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

SUPPORTED IMPLEMENTATION OF THE ISMS

In the context of Part-IS, all organisations initiate the implementation of an ISMS with determining its
scope, which in turn is based upon at least an assessment of aviation safety impacts for which
information security incidents are a cause or a contributing factor. Organisations, irrespective of theirsize, may not have yet sufficient knowledge about their information security risks, and may consider
seeking support by a service provider that can also provide additional personnel and expertise during
this implementation phase of the ISMS. The same may apply to later phases of the ISMS
implementation, and to this end organisations may want to consider the provision of IS.I.OR.235 andrelated AMC. Outsourcing specific ISMS functions, such as information security monitoring or incident
response to service providers, may help ensure that the organisation has access to experienced
personnel and expertise. Similarly, organisations may want to be supported by a service provider inperforming risk assessments.
Regarding the establishment of the appropriate personnel to implement and comply with theprovisions of this Regulation, organisations should always refer to AMC1 IS.I.OR.240(f) and
GM1 IS.I.OR.240(f), by considering that multiple responsibilities may be assigned to one person, while
always ensuring the independence of the compliance monitoring.
As an introduction to the nature of information security risks and their management, organisations
may use, as initial guidance, the NIST Interagency Report (NISTIR 7621 Rev.1) ‘Small BusinessInformation Security: The Fundamentals’.
INTEGRATION OF ISMS UNDER THIS REGULATION WITH EXISTING MANAGEMENT SYSTEMS

An organisation may take advantage of existing management systems when implementing an ISMS byintegrating it with those existing systems.
By integrating the ISMS with existing management systems, the organisation may reduce the effort
and costs required to implement and maintain the ISMS, while also ensuring consistency andalignment with the organisation’s overall management approach. Below is a non-exhaustive list of
potential synergies that can be exploited when integrating the ISMS with an existing management
system:—Leverage existing policies and procedures: an organisation may use its existing policies andprocedures as a foundation for its ISMS. This may help to ensure consistency and minimise theneed for additional documentation.

—

Align the ISMS with other management systems: an organisation may align the ISMS with othermanagement systems, such as safety management systems (SMSs), to ensure that the ISMS isconsistent with the organisation’s overall management approach.

—

Use existing risk management processes: an organisation may use their existing risk
management processes to identify and assess the information security risks potentially leading
to aviation safety risks.

—

Reuse existing controls: an organisation may reuse existing controls, such as access controls or
incident management process, to implement the information security controls required by the
ISMS.

—

Continuous improvement process: an organisation may use the continuous improvement
process of existing management systems to improve the ISMS over time.

Powered by EASA eRules

Page 106 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

AMC1 IS.I.OR.200(e) Information security management system(ISMS)ED Decision 2023/009/R

DEROGATION

Organisations should follow the directions provided in AMC1 IS.I.OR.205(a) and AMC1 IS.I.OR.205(b)to perform a documented information security risk assessment to seek the approval by the competentauthority of a derogation under point IS.I.OR.200(e). In order to justify the grounds for a derogation,
the risk assessment is expected to provide explanations for the exclusion of all elements from thescope of the ISMS. It is up to the authority to determine whether this assessment is deemedsatisfactory for a derogation to be granted.
Organisations that would like to have the risk assessment performed by a third party should consider
the requirements of IS.I.OR.235 and the related AMC.

GM1 IS.I.OR.200(e) Information security management system(ISMS)ED Decision 2023/009/R

Any organisation that believes that it does not pose any information security risk with a potential
impact on aviation safety, either to itself or to other organisations, may consider requesting anapproval for a derogation by the competent authority following the procedure outlined in
AMC1 IS.I.OR.200(e).
Some examples of organisations that may consider asking for a derogation might include:—An air operator that performs non-high-risk commercial specialised operations (SPO) with noncomplex aircraft, if the nature of the operations justifies the grounds for a derogation.

—

An air operator that operates ELA2 aircraft as defined in Article 1(2)(j) of Regulation (EU) No
748/2012 with the exception of one aircraft that is operated in predefined operational
conditions or under certain operational limitations.

—

A maintenance organisation approved under Part-145 dealing only with maintenance ofcomponents or maintenance activities that do not contribute to ensuring the structural integrityof the aircraft nor any major safety-related functionalities — for instance, undertaking activities
such as washing, removing coatings, painting, etc.

The aforementioned examples are not exhaustive and are only indicative of potential scenarios thatmight provide an initial basis for the preparation of an information security risk assessment thatjustifies the exclusion of all elements of an organisation from the scope of the ISMS.

Powered by EASA eRules

Page 107 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

IS.I.OR.205 Information security risk assessment
Regulation (EU) 2023/203(a)

The organisation shall identify all its elements which could be exposed to information security
risks. That shall include:(1)

the organisation’s activities, facilities and resources, as well as the services theorganisation operates, provides, receives or maintains;(2)

the equipment, systems, data and information that contribute to the functioning of theelements listed in point (1).

(b)

The organisation shall identify the interfaces that it has with other organisations, and which
could result in the mutual exposure to information security risks.

(c)With regard to the elements and interfaces referred to in points (a) and (b), the organisation
shall identify the information security risks which may have a potential impact on aviation
safety. For each identified risk, the organisation shall:(1)

assign a risk level according to a predefined classification established by the organisation;(2)

associate each risk and its level with the corresponding element or interface identified inaccordance with points (a) and (b).

The predefined classification referred to in point (1) shall take into account the potential of
occurrence of the threat scenario and the severity of its safety consequences. Based on thatclassification, and taking into account whether the organisation has a structured and repeatablerisk management process for operations, the organisation shall be able to establish whether therisk is acceptable or needs to be treated in accordance with point IS.I.OR.210.
In order to facilitate the mutual comparability of risks assessments, the assignment of the risk
level pursuant to point (1) shall take into account relevant information acquired in coordination
with the organisations referred to in point (b).
(d)

(e)

The organisation shall review and update the risk assessment carried out in accordance withpoints (a), (b) and, as applicable, points (c) or (e), in any of the following situations:(1)

there is a change in the elements subject to information security risks;(2)

there is a change in the interfaces between the organisation and other organisations, orin the risks communicated by the other organisations;(3)

there is a change in the information or knowledge used for the identification, analysis andclassification of risks;(4)

there are lessons learnt from the analysis of information security incidents.

By derogation from point (c), organisations required to comply with Subpart C of Annex III (PartATM/ANS.OR) to Regulation (EU) 2017/373 shall replace the analysis of the impact on aviation
safety by an analysis of the impact on their services as per the safety support assessment
required by point ATM/ANS.OR.C.005. This safety support assessment shall be made available
to the air traffic service providers to whom they provide services and those air traffic service
providers shall be responsible for evaluating the impact on aviation safety.

Powered by EASA eRules

Page 108 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.205 Information security risk assessment
ED Decision 2023/009/R

Part-IS does not require the use of any specific information security framework, such as ISO, NIST orothers to develop the risk assessment or in general to implement risk management. Each frameworkoffers different benefits and none of these frameworks is perfect for an individual organisation, andshould be customised and tailored to meet the overall needs of an organisation as well as the specificneed to consider aviation safety aspects.
Organisations whose information security frameworks have achieved industry certifications canprovide this information as supporting artefacts; however, these organisations should show theapplicability of the industry certification to the scope of this Regulation (see GM1 IS.I.OR.200).
General guidance on risk management, including risk assessment, can be found in ISO/IEC 27005 andISO/IEC 31000 as well as NIST SP 800-30. Aviation organisations may also wish to consider aviationspecific guidance as defined in the risk management chapter of the latest version of EUROCAE ED201A and, as appropriate to the specific operating environment, in the chapters of EUROCAE ED-204A,
EUROCAE ED-205A and EUROCAE ED-206 covering risk management.

AMC1 IS.I.OR.205(a) Information security risk assessment
ED Decision 2023/009/R

When conducting an information security risk assessment, the organisation should ensure that all
relevant aviation safety elements are identified and included in the ISMS scope as per IS.I.OR.200 and
related AMC.
A means to comply with the requirement in point IS.I.OR.205(a) is to perform a preliminary high-levelrisk assessment or impact assessment, carried out in accordance with a documented methodology
and following precise criteria for the inclusion in and exclusion from the ISMS scope of the elements
listed in IS.I.OR.205(a).

GM1 IS.I.OR.205(a) Information security risk assessment
ED Decision 2023/009/R

SCOPE AND BOUNDARIES IDENTIFICATIONThe organisation should develop clear and comprehensive understanding of its aviation activities andservices, the related processes and associated information systems, and the relevant data flows andinformation exchanges that define the scope of the ISMS and the boundaries for risk assessment.
Therefore, the organisation should develop corresponding documentation on resources anddependencies related to computing, networking and contracted services which have the potential toaffect the information security and safety of the functions, services or capabilities within the scope ofthe risk assessment.
The following non-exhaustive list provides examples of items that may be considered for theidentification of the aforementioned scope and boundaries. The level of detail of the analysis can be
an iterative process, with the effort commensurate with the expected level of risk. As stated above,
the purpose is to establish understanding of all relevant assets, resources and dependencies that are
directly a part of the functions, services and capabilities through the following activities:(a)

Identification of operational inputs and outputs relevant to the functions, services andcapabilities of the organisation; these can be related to:Powered by EASA eRules

Page 109 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]—

internal or external sources;—internal or external leased or managed services, or other dependencies;(b)

Identification of all relevant assets (i.e. hardware, software, network and computing resources)used to create, process, transmit, store or receive the aforementioned operational inputs andoutputs;(c)

Identification of the operating environments (e.g. office, public access area, access-controlled
room, etc.) and locations for all relevant assets;(d)

For each asset included in the scope, identification of the specific methods, processes andresources that will be used to manage, operate and maintain each asset throughout its life cycle,
including:—internal or contracted resources;—

contracted companies remotely managing the assets (i.e. provider of managed services).

AMC1 IS.I.OR.205(b) Information security risk assessment
ED Decision 2023/009/R

The organisation should, as part of the information security risk assessment, identify the interfaces it
has with other parties such as service providers, supply chains and other third parties, based on theexchange of data and information and the assets used for that exchange, which could lead to asituation where information security risks, as a result of mutual exposure, may either:—increase aviation safety risks faced by other parties; and/or—

increase aviation safety risks faced by the organisation.

GM1 IS.I.OR.205(b) Information security risk assessment
ED Decision 2023/009/R

RISK INFORMATION SHARINGInterfacing organisations should share information with each other about the potential exposure to
information security risks by following, for instance, the approach detailed in EUROCAE ED-201A,
Appendix B — B.1, B.2 and B.3. The purpose of this exchange of information is to enable organisations
to establish a matching mapping for the services identified under IS.I.OR.205(a), including all
information and data flows, in order to:(a)illustrate (e.g. through a functional diagram) the relationships of logical and physical paths
connecting the different parts involved;(b)

clearly identify all assets (i.e. hardware, software, network and computing resources) that will
be used in the exchange;(c)identify all functions, activities and processes, including their respective information and data,
which will be created, transmitted, processed, received and stored, and associate those withthe responsible party which provides or performs those functions, activities and processes;(d)determine for these paths, constituting the so-called functional chains, the role of theinterfacing party as a producer, processor, dispatcher or consumer of the information or data
involved;

Powered by EASA eRules

Page 110 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](e)determine whether one interfacing party acts as an originator or receiver of a flow across suchpath.

TWO CATEGORIES OF INTERFACING ORGANISATIONSThere are two categories of interfacing organisations: those that are subject to Regulation (EU)2023/203 or Regulation (EU) 2022/1645, and those that are not.
Where the organisation has interfaces with an organisation that is subject to Regulation (EU) 2023/203
or Regulation (EU) 2022/1645, each entity:—

is responsible for the identification of the interfaces that its own organisation has with otherorganisations, and which could result in the mutual exposure to information security risks. The
entity may benefit from the sharing of risk information as this exchange allows for a moreaccurate assessment of those risks;—remains accountable for the proper management of the information security risks within thescope of its own ISMS.

In all other cases, the organisation is accountable for the proper management of the information
security risks that may arise from its exposure to the interfacing entity. Where these risks need to betreated, the organisation always has the option of implementing mitigating measures and controls
within its own boundaries. In the specific case where the interfacing entity is a supplier, theorganisation may decide to manage the risks through contractual arrangements and require thesupplier to implement mitigating measures and controls within its own organisation.

GM2 IS.I.OR.205(b) Information security risk assessment
ED Decision 2023/009/R

EXAMPLES OF AVIATION SERVICES

Examples of aviation services that may be considered when determining the ISMS scope and interfaces
are provided in Appendix III.

AMC1 IS.I.OR.205(c) Information security risk assessment
ED Decision 2023/009/R

The organisation should use a risk management framework that includes a methodology for assigningrisks with a risk level and establishing criteria for determining risk acceptance or further treatment.
The organisation should provide documented evidence of assessment of risks which have a potential
impact on aviation safety including the level of risks. The organisation should associate each risk withthe relevant elements and interfaces identified under IS.I.OR.205 (a) and (b), and document whether
the risk is acceptable or requires further treatment.
The organisation should provide the assurance that the risk assessment process is carried out with thenecessary rigour and discipline by documenting the process and its robustness. By doing so, theorganisation should consider:(a)reproducibility of the assessment’s results for similar inputs;(b)repeatability of the assessment over time in a way that the results of the different priorassessments can be compared to determine the changes;

Powered by EASA eRules

Page 111 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

(c)

(d)

the gathering of inputs that are relevant and valid, in particular:(1)

the information that allows the determination of the safety consequences;(2)

the information that allows the determination of the potential of occurrence of the threat
scenario;

iterative refinement over time allowing for more fine-grained threat scenarios as inputs tobecome available, with the aim of reducing uncertainty regarding threats, vulnerabilities,
effectiveness of existing controls, and dependencies on external entities, in particular by:(1)

refining initial high-level threat scenarios with greater detail and specificity as more data
is gathered;(2)

refining data on known vulnerabilities by continuously updating information about their
exploitability and the associated consequences;(3)

reviewing the effectiveness of existing controls, and consider newly available controls;(4)

refining the understanding of the dependencies on external entities and theirimplications for the organisation’s risk profile.

GM1 IS.I.OR.205(c) Information security risk assessment
ED Decision 2023/009/R

RISK ASSESSMENT

The risk classification levels for the potential of occurrence of the threat scenario and severity of thesafety consequences listed below may be applied; however, this does not prevent the organisationfrom developing additional intermediate categories if it deems this necessary for risk assessments.
The organisation should specify and document the applied, organisation-specific classification levels
with an accurate qualitative or quantitative definition in terms of a range or interval of numericalvalues in order to enable a sufficiently calibrated, consistent estimation, evaluation andcommunication within the organisation or with the interfacing entities. The potential of occurrence ofthe threat scenario may be expressed as an interval of likelihoods including the duration of theobservation. Supporting documentation and methods can be found in EUROCAE ED-203A, Chapter 3.6
which references the evaluation of the potential of occurrence of the threat scenario in the Security
Risk Assessment of EUROCAE ED-202A.
Note 1: The phrase ‘duration of the observation’ refers to the time period during which a threat
scenario is observed or monitored. It is essential in determining the likelihood of the threat scenario
occurring, since the probability of occurrence may vary depending on the length of the observation
period.
Note 2: EUROCAE ED-202A and EUROCAE ED-203A were originally developed for aircraft information
security risk assessment, but the generic principles developed in those documents can be adapted toother frameworks when deemed useful by the organisation.
In order to facilitate the mutual comparability of risk assessment methodologies between interfacingorganisations, the organisation may associate the assessment of the potential of occurrence of thethreat scenario with one of the following categories:—

High potential of occurrence: the threat scenario is likely to occur. The attack related to thethreat scenario is feasible and similar threat scenarios have occurred many times in the past.

Powered by EASA eRules

Page 112 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]—

Medium potential of occurrence: the threat scenario is unlikely to occur. The attack related tothe threat scenario is possible and a similar threat scenario may have occurred in the past.

—

Low potential of occurrence: the threat scenario is very unlikely to occur. The materialisation of
the threat scenario is theoretically possible; however, it is not known to have occurred.

The evaluation of the potential of occurrence of the threat scenario may be based on the following
aspects:
Protection (as defined in EUROCAE ED-203A)—

Security measures and architecture that deny access to assets: the degree to which an asset isopen to access from compromised systems—

Access to security measures: the degree to which a security measure prevents access/attack toitself from compromised systems—

Failure of mechanism: the degree to which the known implementation of a security measure
will fail to prevent an attack—

Detection methods or procedures to recognise the attack and appropriately respond to reduce
the potential of occurrence of the threat scenario

Exposure reduction (as defined in EUROCAE ED-203A)—

Conditions under which an external access connection can be used by a user or attacker—

Limits on the functionality of an external access connection—

Organisational policies that control the time-to-feasibility for developing attack tools specific to
the product—

Vulnerability management including intelligence, scanning, treatment and retesting aimed to
discover, detect and treat reported or detected vulnerabilities in a fast, risk-prioritised mannerwith high assurance in order to reduce the attack surface—

Reduction of the severity of a successful attack (i.e. through a redundant system that canmaintain the continuity of service in case of a denial of service of a system critical for aviation
safety)Attack attempt (as defined in EUROCAE ED-203A)—

The capability of the attackers which is determined by the resources and expertise required fortheir attack
The capability of the attackers can be assessed through several ways, for instance:—

information from computer emergency response teams (CERTs) / computer security
incident response teams (CSIRTs), information sharing and analysis centres (ISACs);—

analyses of past activities, techniques and procedures (TTPs) and success rate of attacks.

For the same reason the organisation may associate the outcome of the evaluation of theseverity of the safety consequences with one of the following categories:—

High severity: those immediate or delayed scenarios that can cause or contribute to an
unsafe condition where an unsafe condition means an occurrence associated with theoperation of an aircraft in which:—a person is fatally or seriously injured;Powered by EASA eRules

Page 113 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]—

the aircraft sustains damage or structural failure;—

the aircraft is either missing or completely inaccessible;—

Moderate severity: those immediate or delayed scenarios that can cause or contribute tosafety incidents where an incident means any occurrence other than an accident,
associated with the operation of an aircraft, which affects or could affect the safety ofoperations;—

Low severity: those immediate or delayed scenarios that can cause or contribute tonegligible safety consequences.

Examples for high, moderate, and low severity can be found in EUROCAE ED-201A, Appendix B for
products, ATM systems and airspace.
If the organisation cannot determine the safety effect, the assessment should identify assumptions
from the risk-sharing information at interfaces with other organisations along the functional chain,leading up to the safety effect.
Some of those assumptions can be granted with the certification of products: where assets are subject
to product certification from other aviation regulations addressing product information security, theorganisation performing the risk assessment may consider the perimeter of the product certificationas already covered. This should be acceptable under the condition that this certification is valid andthat the instructions provided by the OEM to maintain the certification validity are implemented by
the organisation.
Additional information can also be found in Regulation (EU) 2015/1018 on mandatory reporting ofoccurrences in civil aviation. Further examples of impact severity classifications for aviation domains
can be found in EUROCAE ED-201A, Appendix B — Tables B-5, B-6 and B-7.
Risk acceptance criteria
Risk acceptance criteria are critical and should be developed, specified and documented. The criteria
may define multiple thresholds, with a desired target risk level, but allowing also for the accountable
manager or delegated person(s) to accept risks above this level under defined circumstances andconditions.
In order to facilitate the mutual comparability of risk assessments between interfacing entities, theorganisation should classify the risks in the following categories:—

unacceptable risk;—

conditionally acceptable risk;—

acceptable risk.

For what concerns the conditional acceptance of risks, the criteria for acceptance should take into
account how long a risk is expected to exist (temporary or short-term activity or exposure), or may
include requirements for the commitment of future treatments to reduce the risk at an acceptablelevel within a defined time duration and show how the risk will be managed over time through theorganisation’s risk governance processes.
Moreover, risks should be conditionally accepted only under the condition that the organisation
demonstrates the presence of a comprehensive risk management structure that includes risk
assessment, risk treatment and risk monitoring processes for operations. The risk management should
consider the variability and consistency of threat likelihood, vulnerability, existing controls, external
dependencies and safety impact. This is typically achieved when the organisation reaches a higher
Powered by EASA eRules

Page 114 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

level of maturity that is representative of functionality and repeatability of information security risk
management — see GM1 IS.I.OR.260(a).
The following Figure 1 depicts a risk acceptance matrix based on the aforementioned categories thatcan be used by interfacing organisations for mutual comparability.

ICAO Annex 13 >Negligible effectIncident

Accident

Threat scenario —Lowsafety Moderate
safety Highpotentialofconsequences
consequences
consequences
occurrenceHigh

Conditionallyacceptable

Not acceptable

Not acceptable

Medium

Acceptable

Conditionallyacceptable

Not acceptable

Low

Acceptable

Acceptable

Conditionallyacceptable*

safetyFigure 1: Example of a risk acceptance matrix for comparison purposes* The potential of occurrence of the threat scenario is reassessed in a timely manner (refer to
IS.I.OR.205(d)) and monitored to ensure that it remains low and that if the risk materialises, it is early
detected and dealt with.

A comprehensive risk management structure typically entails the following aspects and processes:—

a repeatable and reproduceable risk assessment. If the risk factors are considered fairly
uncertain and within some wide value range or not sufficiently precise, further iterations of therisk assessment are performed involving additionally gathered or detailed information and amore in-depth assessment in order to reduce uncertainty and increase precision;—a thorough review of those risks proposed to be conditionally acceptable that is performed by
the accountable manager or delegated person(s) who may impose additional conditions for therisk retention, including risk treatment measure and the timeline for its implementation;—

strict monitoring of the key risk indicators that includes a defined, reliable detection of thepotentially evolving risk materialisation;—

an incident response scheme is in place with reactive measures that are triggered by detection
mechanisms in order to immediately contain the consequences, in particular, for risk scenarios
involving a high severity level.

Note: As detailed in NIST SP-800 Rev.1, repeatability refers to the ability to repeat the assessment in
the future, in a manner that is consistent with and hence comparable to prior assessments — enabling
the organisation to identify trends. Therefore, a risk assessment process can be classified as‘repeatable’ when under similar conditions an entity or a person delivers consistent results.
As detailed in NIST SP-800 Rev.1, reproducibility refers to the ability of different experts to produce
the same results from the same data. Therefore, a risk assessment process can be classified as

Powered by EASA eRules

Page 115 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]‘reproducible’ when another entity or person, given the same inputs, assumptions, information
security context and threat environment can replicate the same steps and reach the same conclusions.
Threat scenario identification
A threat scenario is one of the possible ways a threat could materialise. Typically, a threat scenario
describes a potential attack targeting one or more vulnerabilities of assets, as well as processes.
The purpose of the threat scenario identification under this Regulation is to develop a list of scenariosthat may lead to an information security threat having an impact on aviation safety.
A threat scenario, in general, is characterised by the following:—a threat source of the information security attack;—an attack vector and a path through the organisation up to the asset;—

the information security controls that would mitigate the attack;—the consequence of the attack including the affected safety aspects.

Threat scenario identification guidance can be found in EUROCAE ED-202A, Chapter 3.4. This is not
the only source where guidance can be found, and the organisation may refer to different guidance
more appropriate for their application.
Additional methods to identify relevant threat scenarios
When conducting this analysis, both information security and safety aspects should be coordinatedthroughout the process to ensure mutual understanding of the threat preventive measures andmitigating measures being applied. In the following Figure 2 the interactions between information
security and aviation safety are depicted through a ‘bow-tie’ diagram that highlights the links between
risk controls and the underlying management system.

Figure 2: Interactions between information security and aviation safety risk management areas

Note: A preventive barrier or measure is a proactive action or control implemented to reduce thelikelihood of a risk, hazard, or threat materialising, while a mitigating measure is an action or control
designed to reduce the severity or impact of an undesired event, would it occur.

Powered by EASA eRules

Page 116 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Examples of threat scenarios
Threat catalogues may provide guidance and elements for the elaboration of threat scenarios that are
relevant for the organisation. References can be found in ARINC 811 – Att. 3 – Tables 3-7 and 3-8 forthe threat catalogues examples and other threat catalogue examples as they are provided by EU
institutions — for example, the ENISA threat taxonomy. However, this is not an exhaustive list of
examples, and the identification of threat scenarios should therefore not be limited to those examples
only. In addition, other relevant resources containing information on information security threats andthe information security threat landscape should be consulted to support the risk assessment processwith relevant inputs.
A set of examples of threat scenarios can be found in Appendix I.

AMC1 IS.I.OR.205(d) Information security risk assessment
ED Decision 2023/009/R

The organisation should take into account the following criteria when establishing compliance withthe objectives contained in point IS.I.OR.205(d):(a)

The risk assessment performed under points IS.I.OR.205 (a), (b) and (c) should be reviewed atregular intervals to identify and account for relevant changes. The periodicity at which potentialchanges have to be evaluated should be determined by the organisation performing theassessment considering the criticality of the assets within the scope of the risk assessment,
levels of residual risk of the assets within the scope of the risk assessment and any contractualor regulatory requirements. A higher criticality or level of risk will require more frequent review.

(b)

The periodicity of risk assessment reviews should be documented by the organisation andinclude the justification, date of approval and information about the risk owner.

GM1 IS.I.OR.205(d) Information security risk assessment
ED Decision 2023/009/R

The criteria to consider for the frequency of the risk assessment review may be the risk level as wellas the criticality and complexity of the assets concerned. The objective of a risk assessment review isto trigger the revaluation of risks, their likelihood and impact in case of relevant changes. One possible
way is to have a tiered approach to risk assessment, with a higher-level risk assessment being used forthe identification of changes. The higher-level risk assessment could allow the identification of thedetailed risks that should be reviewed in a next step. Risk assessments should be subject to regularreviews to:(a)allow for continuous improvement of the quality of risk assessment;(b)ensure efficiency and effectiveness of risk controls and mitigating measures in both their designand operation;(c)review plans and actions for risk treatment;(d)identify any organisational change which may require a review of the priorities as well as of thetreatment of risks;(e)maintain an overview of the complete risk picture; and(f)identify any emerging risks.

Powered by EASA eRules

Page 117 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Risk assessment reviews should involve the risk owners, project teams and other stakeholders asapplicable. Evidence of risk assessment review should be documented and should include:—

evidence of approval of the review by the designated risk owner; and—the rationale behind or basis for the risk owner’s approval of the review.

Such evidence may comprise, but is not limited to:—reports which constitute a form of documentation to track information security risks potentially
impacting an organisation;—

the documentation of the information security risk assessment;—

exerts from a business or security risk register.

The periodicity of risk assessment reviews should also be documented by the organisation in
information security manuals, processes or procedures and should align with wider change
management activities and management reviews of information security. Further guidance on criteria
and frequency of risk assessment review can be found in EUROCAE ED-201A, Chapter 4, as well as in
EUROCAE ED-205A, Chapter 3.2 (for ATMS/ANS).

GM2 IS.I.OR.205(d) Information security risk assessment
ED Decision 2023/009/R

The following are examples of changes that should be identified during the risk assessment review asthey may trigger an update of the risk assessments:
(a)

(b)

there is a change in the elements subject to information security risks as identified in
IS.I.OR.205(a); a change in the elements will include:—

additions to, or removals from, the scope of the risk assessment of individual elements;—changes to design or configuration of elements within the scope of the risk assessmentthat have the potential to alter the risk assessment outcomes; or—changes to values, which would potentially trigger changes to impact levels, of elements
within the scope of the risk assessment;

there is a change in the interfaces between the organisation and other organisations with which
the organisation shares information security risks or relies upon to mitigate information security
risks (e.g. supply chains, service providers, cloud providers and customers), as identified in
IS.I.OR.205(b), or between the system within the scope of the risk assessment and any otherinterconnected systems, or in the risks notified to the organisation by other organisations, as
identified in IS.I.OR.205(b), or owners or managers of the other systems including:—establishment of new interfaces;—

removal of existing interfaces;—changes to existing interfaces that would have the potential to alter the risk assessment
outcomes.

Note: Some organisational or system interconnections may be with organisations that are notwithin the scope of this Regulation as defined in Article 2 and therefore are not subject to therequirements of Part-IS. Where this is the case, these organisations should be informed of their
responsibility to report such changes as listed above through contractual arrangements andPowered by EASA eRules

Page 118 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

reporting requirements between the affected organisations on a case-by-case basis and whereapplicable;
(c)

(d)

there is a change in the information or knowledge used for the identification, analysis andclassification of risks including:—changes to threats and their values or addition of new threats that have not previously
been assessed;—changes to vulnerabilities or addition of new vulnerabilities that have not previously beenassessed;—changes in impacts or consequences of assessed threats or vulnerabilities;—changes in aggregation of risks that may result in unacceptable levels of risks;—changes or improvements in the risk management process, risk assessment approach andrelated activities;—changes or improvements in the treatments of risks;—changes in the criteria used to determine acceptance and treatments of risks;

there are lessons learned from the analysis of information security incidents including:—understanding why and how incidents have occurred; and—reviewing all types of incidents including those due to external factors, technical reasons,human errors (inadvertent behaviour). For human intentional acts, a distinction can bemade between malign and benign actions.

AMC1 IS.I.OR.205(e) Information security risk assessment
ED Decision 2023/009/R

SAFETY SUPPORT ASSESSMENT

Non-ATS providers should conduct a safety support assessment as it is described in Regulation (EU)2017/373 to assess the information security risk on their assets in regard to the service specification,e.g. integrity and availability, and to identify the residual risk.
The non-ATS provider should share with the ATS provider, in an appropriate form, information on theresidual risk and the impact on the services it provides to that ATS provider .
The residual risk should be used to assess the potential impact on services and products that a nonATS provider offers to an ATS provider.
The ATS provider can use this as an input for its security risk assessment and, more importantly, toevaluate the potential impacts of these residual risks on safety.

GM1 IS.I.OR.205(e) Information security risk assessment
ED Decision 2023/009/R

SAFETY SUPPORT ASSESSMENT

Table 1 below shows the non-ATS providers which shall comply with Subpart C of Annex III toRegulation (EU) 2017/373. These are the organisations having to conduct the safety support
assessment in order to provide the required information to ATS providers.
Powered by EASA eRules

Page 119 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

The information on the impact on products and services could be shared between non-ATS providers
and ATS providers through agreed means, e.g. service level agreement, external agreement (in linewith EUROCAE ED-201A), etc.
Shared information should enable ATS providers to perform an accurate assessment of the residual
risk for their services. For instance, if the non-ATS providers identified a risk which could affect theavailability of data provided to an ATS provider, the impact on the availability should be described ina way that allows the ATS provider to assess whether the resulting latency or delay in datatransmissions could have a safety impact. This is relevant because only the ATS provider through its
assessment can either accept or decline a residual risk.
Table 1: Non-ATS providers which shall comply with Subpart C of Annex III to Regulation (EU)2017/373

IS.I.OR.210 Information security risk treatment
Regulation (EU) 2023/203(a)

The organisation shall develop measures to address unacceptable risks identified in accordancewith point IS.I.OR.205, implement them in a timely manner and check their continued
effectiveness. Those measures shall enable the organisation to:(1)

control the circumstances that contribute to the effective occurrence of the threat
scenario;(2)

reduce the consequences on aviation safety associated with the materialisation of thethreat scenario;(3)

avoid the risks.

Those measures shall not introduce any new potential unacceptable risks to aviation safety.

Powered by EASA eRules

Page 120 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](b)

The person referred to in point IS.I.OR.240(a) and (b) and other affected personnel of theorganisation shall be informed of the outcome of the risk assessment carried out in accordancewith point IS.I.OR.205, the corresponding threat scenarios and the measures to be
implemented.
The organisation shall also inform organisations with which it has an interface in accordancewith point IS.I.OR.205(b) of any risk shared between both organisations.

GM1 IS.I.OR.210 Information security risk treatment
ED Decision 2023/009/R

Unacceptable risks identified in accordance with point IS.I.OR.205 require a risk treatment processthat may lead to the introduction of information security measures, often referred to as information
security controls.
For each identified risk, the organisation should define the specific risk treatment measures, methods
or resources that will be used over the life cycle of each asset to:—

manage risk reduction;—

monitor and maintain each asset;—

update and fulfil activities for configuration management;—

manage supply chain;—manage contracted services or service provider.

The review of risk treatment measures should include life cycle considerations which are introducedby equipment, procedures and personnel.
A risk treatment plan as an outcome of the risk management process should include a prioritisationof risks, the corresponding information on the objectives and means for risk treatment to reach an
acceptable level of risk, as well as agreed timelines specifying when responsible personnel should have
implemented the risk treatment measures. The timelines for the implementation of a risk treatment
measure should be agreed by the personnel responsible for the implementation and should becommunicated to and accepted by the accountable manager of the organisation or delegatedperson(s).
Any subsequent implementation delay, together with its cause, reason, rationale or necessity, should
be documented in the risk treatment plan, for risks that may lead to an unsafe condition. The updated
risk treatment should be communicated to the competent authority in case the materialisation of risk
would lead to an unsafe condition. The delay is also subject to the acceptance by the accountable
manager of the organisation or delegated person(s). This person may condition such acceptance on
the implementation or availability of compensating controls or reactive measures to monitor, early
detect and timely respond to the materialisation of the risk in treatment. In order to timely respond,
the incident response team may be informed to trigger their preparedness.
The risk treatment plan can act as a means of communication with the competent authority todemonstrate effective treatment of unacceptable risks. Similarly, this plan can be utilised tocommunicate to interfacing organisations how shared risks are controlled.
In accordance with IS.I.OR.205(d), a regular or conditional review of the risk assessment is necessary,and this includes the review of the risk treatment measures developed under IS.I.OR.210(a) to identify
whether they are still effective or they require adaptations.
Powered by EASA eRules

Page 121 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

In addition, the organisation should also consider the potential impact on the effectiveness of risktreatment measures where a shared information security risk may arise as a result of the interaction
between interfacing entities (see IS.I.OR.235 and related AMC).

AMC1 IS.I.OR.210(a) Information security risk treatment
ED Decision 2023/009/R(a)

The risk treatment process should reach at least one of the objectives listed under
IS.I.OR.210(a).

(b)

When establishing compliance with the objectives under points IS.I.OR.210(a)(1) and
IS.I.OR.210(a)(2), the organisation should take into account that:

(c)

(1)

the measures developed under these points should be implemented according to a risktreatment plan with defined, risk-based priorities, objectives and agreed timelines andowners;(2)

life cycle considerations should be identified and associated to ensure continuous
effectiveness of the information security measures including exchange of data with otherentities;(3)

it should review and update the risk assessment, according to IS.I.OR.205(d), to evaluate
whether the measures developed under these points introduce new unacceptable risks
or modify existing risks in a way that they become unacceptable.

Risk treatment should be documented and recorded, for example, in a risk registry, even if therisk has been avoided.

IS.I.OR.215 Information security internal reporting scheme
Regulation (EU) 2023/203(a)

The organisation shall establish an internal reporting scheme to enable the collection andevaluation of information security events, including those to be reported pursuant to point
IS.I.OR.230.

(b)That scheme and the process referred to in point IS.I.OR.220 shall enable the organisation to:

(c)

(1)

identify which of the events reported pursuant to point (a) are considered information
security incidents or vulnerabilities with a potential impact on aviation safety;(2)

identify the causes of, and contributing factors to, the information security incidents andvulnerabilities identified in accordance with point (1), and address them as part of theinformation security risk management process in accordance with points IS.I.OR.205 andIS.I.OR.220;(3)

ensure an evaluation of all known, relevant information relating to the information
security incidents and vulnerabilities identified in accordance with point (1);(4)

ensure the implementation of a method to distribute internally the information asnecessary.

Any contracted organisation which may expose the organisation to information security risks
with a potential impact on aviation safety shall be required to report information security
events to the organisation. Those reports shall be submitted using the procedures establishedin the specific contractual arrangements and shall be evaluated in accordance with point (b).

Powered by EASA eRules

Page 122 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](d)

The organisation shall cooperate on investigations with any other organisation that has asignificant contribution to the information security of its own activities.

(e)

The organisation may integrate that reporting scheme with other reporting schemes it has
already implemented.

AMC1 IS.I.OR.215(a)&(b) Information security internal reporting
schemeED Decision 2023/009/R

Organisations should use as a source the incidents detected during activities performed to showcompliance with IS.I.OR.220(a). Organisations should have a mechanism to collect notifications ofevents by personnel and by sources outside the company including suppliers, partners, customers,
open-source software, and information security researchers. The mechanism for collecting
information by personnel and external sources should be easily accessible and communicated.
The organisation should collect all events gathered through the detection means for internal analysis.
Each event should be analysed to identify whether it is reportable and if so, what potential or actual
impact on aviation safety has occurred. Information security events should be considered in
combination with other events to provide correlation to identify incidents or vulnerabilities with apotential impact on aviation safety.
The organisation should consider the outcome of the risk assessment and the exploitability of newvulnerabilities discovered during the detection activities conducted according to the measuresrequired in IS.I.OR.220(a).
The organisation should identify all internal stakeholders that require notification of a specific incident
or vulnerability and ensure that these stakeholders receive all necessary information on the incident
or vulnerability in order to act effectively and in a timely manner to support the required detection
and response periods.

GM1 IS.I.OR.215(a)&(b) Information security internal reporting
schemeED Decision 2023/009/R

RELATIONSHIP BETWEEN INTERNAL AND EXTERNAL REPORTING

Organisations should collect and report internally incidents and vulnerabilities aiming at covering all
items within the scope of this Regulation. Both internal and external reporting are necessary for acomplete and effective reporting system. Internal reports should be assessed in a timely manner andwhere the potential impact on safety is an unsafe condition, organisations should initiate reporting ofthese internal reports according to IS.I.OR.230.

GM2 IS.I.OR.215(a)&(b) Information security internal reporting
schemeED Decision 2023/009/R

ORGANISATION OF COLLECTION AND EVALUATION OF INFORMATION SECURITY EVENTS

It is a common practice in large organisations to centralise information security operations in a security
operations centre (SOC) and make use of an information security information and event management
Powered by EASA eRules

Page 123 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](SIEM) system. A SIEM system collects all events from sources such as log files in a common databaseand allows the analysts and responders in a joint SOC to review and act on these events. Organisations
may choose to use a SOC for events relevant to Part-IS in isolation or in combination with events not
subject to Part-IS but of interest to the organisation, such as events relating to business interests.
Events can be automatically aggregated, correlated and analysed in order to detect abnormal
behaviour leading to information security incidents.
Organisations that do not have a SOC capability and do not use a SIEM system need to consider how
to establish processes to meet the required collection and evaluation capabilities as well as detection
and response times.

GM3 IS.I.OR.215(a)&(b) Information security internal reporting
schemeED Decision 2023/009/R

RELEVANT INFORMATION FOR INCIDENTS AND VULNERABILITIESUnderstanding the causes of, and contributing factors to, information security incidents andvulnerabilities relevant to Part-IS allows lessons learned to be gained and to introduce corrections toprocesses and asset design. However, understanding causes and contributing factors may not always
be possible or may not aid in continuous improvement of aviation safety. Where vulnerabilities arise
from assets developed solely or primarily for aviation, it is expected to be possible to perform thenecessary investigation on the root causes. These root causes will inform the affected organisation(s)to improve processes and asset design to remediate vulnerability and to ensure that such
vulnerabilities are not introduced in other assets. Understanding the root causes of vulnerabilities also
allows the aviation community to learn and thus avoid similar vulnerabilities in the future.

GM1 IS.I.OR.215(c) Information security internal reporting scheme
ED Decision 2023/009/R

If contracted organisations are also subject to this Regulation, the exchange of information andreporting should be covered under the management of shared risks and through the establishment ofan external agreement between the organisations. Guidance regarding the development of external
agreements can be found in EUROCAE ED-201A, Chapter 4.4 External agreements.
More in general, and in all other cases, any service contract should include standard clauses
concerning obligations for the contracted organisation to:—report within an agreed time information security incidents that may have an impact on thecontracting organisation. Incidents and vulnerabilities which could lead to unsafe conditions
should be reported as soon as possible and in such a manner that the external reporting
obligation under IS.I.OR.230 can be ensured;—designate a point of contact for the incident management and possible crisis management.

In some cases contracted organisations, such as service providers with distributed resources, may not
be able to offer any ad hoc reporting. In these cases the internal reporting requirement may be fulfilled
through other means that satisfy the objective of this provision. For instance, the contractedorganisations may provide an up-to-date list of vulnerabilities affecting the systems within the scopeof the contracted services. This list should be monitored by the contracting organisation as part of theinternal reporting of information security events.
Powered by EASA eRules

Page 124 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.215(d) Information security internal reporting scheme
ED Decision 2023/009/R

The cooperation under point IS.I.OR.215(d) can be substantiated by sharing elements from incident
records that can support other organisations’ information security activities. In case the organisations
are bound by contractual obligations, this contract may also include commitment to cooperate.
Organisations may consider developing formal agreements (e.g. a memorandum of understanding)outlining roles and responsibilities for information security collaboration such as governancemeetings, joint development activities, and real-time indicators of compromise (IoC) sharing.
Moreover, commitment to cooperate may also be achieved through the active participation of theorganisation in information security sharing initiatives; for instance, ISAC(s). Additionally, for their own
awareness, organisations may also subscribe to receive vulnerability and threat alerts, like those
distributed by CERTs.

IS.I.OR.220 Information security incidents — detection, response
and recovery
Regulation (EU) 2023/203

(a)

(b)

(c)

Based on the outcome of the risk assessment carried out in accordance with point IS.I.OR.205
and the outcome of the risk treatment performed in accordance with point IS.I.OR.210, theorganisation shall implement measures to detect incidents and vulnerabilities that indicate thepotential materialisation of unacceptable risks and which may have a potential impact onaviation safety. Those detection measures shall enable the organisation to:(1)

identify deviations from predetermined functional performance baselines;(2)

trigger warnings to activate proper response measures, in case of any deviation.

The organisation shall implement measures to respond to any event conditions identified inaccordance with point (a) that may develop or have developed into an information security
incident. Those response measures shall enable the organisation to:(1)

initiate the reaction to the warnings referred to in point (a)(2) by activating predefinedresources and course of actions;(2)contain the spread of an attack and avoid the full materialisation of a threat scenario;(3)

control the failure mode of the affected elements defined in point IS.I.OR.205(a).

The organisation shall implement measures aimed at recovering from information security
incidents, including emergency measures, if needed. Those recovery measures shall enable theorganisation to:(1)

remove the condition that caused the incident, or constrain it to a tolerable level;(2)

reach a safe state of the affected elements defined in point IS.I.OR.205(a) within arecovery time previously defined by the organisation.

Powered by EASA eRules

Page 125 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.220 Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

Without prejudice to the definition of ‘information security event’ in Article 3 of Regulation (EU)2023/203, those events that indicate the potential materialisation of unacceptable risks include both
occurrences (i.e. anything that causes harm or have the potential to cause harm) and discovery ofvulnerabilities. In fact, information security risks are associated with the potential that threats will
exploit vulnerabilities, therefore the discovery of an exploitable vulnerability is an information security
event.
In light of this, in the context of this Regulation:—

detection activities required under IS.I.OR.220(a) include vulnerability discovery;—

response activities under IS.I.OR.220(b) include vulnerability management.

AMC1 IS.I.OR.220(a) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

DETECTION

When complying with the requirement in IS.I.OR.220(a), the organisation should define andimplement a strategy to detect information security incidents which may have a potential impact onsafety.
This should be done in a way to ensure that at least the detection strategy is able to cover all known
information security threats to their assets that may materialise in a safety hazard having
unacceptable consequences.
DETECTION STRATEGY

In order to determine the scope of the event detection, the organisation should:(a)identify a list of threat scenarios from the risks identified under IS.I.OR.205;(b)

identify, as a minimum, those assets that, if compromised, contribute to the scenario(s) that
may materialise in an unsafe condition. For this identification of the assets, the measures
introduced under IS.I.OR.210 should also be considered.

Note: The contribution of an asset to the threat scenario and the materialisation of an unsafe
condition should be assessed by considering also the whole functional chain. In some cases, the asset
may be at the end of a functional chain and if it is compromised, the effect on safety is direct and may
be immediate; conversely, if the asset is far from the end of a functional chain and it is compromised,the effect should propagate and may be delayed.

Powered by EASA eRules

Page 126 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.220(a) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

DETECTION STRATEGY

When developing the detection strategy, for those items within the scope of event detection, theorganisation should define the conditions that trigger a process that, for example, would require
personnel intervention and further analysis. These conditions on the items may be defined using
elements from the:(a)expected functional baseline: engage in the identification of deviations from the expectedfunctional operation of the system (excluding information security functions/controls);(b)expected information security baseline: engage in the identification of deviations from theexpected information security operation of information security controls.

These conditions should consider both abnormal behaviour and substantial deviations from thebaselines and relevant correlation of multiple independent events.
Further guidance on the objectives for the establishment of a detection strategy can be found in
EUROCAE ED-206, Chapter 4.

AMC1 IS.I.OR.220(b) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R(a)

INCIDENTS
The organisation should take into account the following aspects when establishing compliancewith the objectives contained in point IS.I.OR.220(b) relative to incidents:(1)

Preparation of procedures and delineation of roles and responsibilities to respond in atimely, effective and orderly manner to any relevant information security incidents.

(2)

The response procedure should:

(3)

(i)

consider the warnings, unitary or combined, from IS.I.OR.220(a)(2), and incollaboration with appropriate personnel assess their potential impact onaviationsafety;(ii)

establish, in accordance with IS.I.OR.220(b)(2), a containment strategy for each
asset category considering the potential worst-case effect and the mission
constraints, and provide criteria indicating when the incident is contained;(iii)

define, in accordance with IS.I.OR.220(b)(3), the acceptable impact on safety andinformation security of each asset within the scope when they fail due to thematerialisation of a threat scenario.

The response time should be commensurate with the impact level assessed in (2)(iii).

Powered by EASA eRules

Page 127 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

(4)

(5)

(b)

The response measures implemented under IS.I.OR.220(b) should be based on the
response procedure referred to in the point (a)(2) and they should, in particular, consider
the following:(i)the maximum acceptable safety level degradation of the assets within the scope ofincident;(ii)

the actions, such as resistance, containment, deception and control of the possible
ways systems can fail, which will contribute to achieving the acceptable safety level
degradation identified in point (i) while minimising the impact on operations;(iii)

the resources required to implement the actions specified in point (ii).

The response time and the measures should take into account the potential immediate
negative impact on safety if the measure is taken before it has been fully verified that it
would not cause additional immediate safety impacts.

VULNERABILITIESThe organisation should take into account the following aspects when establishing compliancewith the objectives contained in point IS.I.OR.220(b) relative to vulnerabilities:(1)

Establishment of a vulnerability management strategy defining procedures, roles andresponsibilities to respond in a timely, effective and orderly manner to any detected
relevant vulnerabilities.

(2)

The response measures implemented under point IS.I.OR.220(b) should be based on the
maximum acceptable risk of the items within the scope of the vulnerability, considering
the worst-case scenario of the vulnerability being exploited.

(3)

The response time should be commensurate with the pre-triage done on the warnings
and the assessment of the potential impact of the vulnerability, if it is exploited.

GM1 IS.I.OR.220(b) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

An attack is considered contained (i.e. it is not spreading any further) when the boundaries of theincident have been identified and the threat does not propagate beyond these boundaries. Further
guidance can be found in EUROCAE ED-206, Chapter 5.
The term ‘warning’ as used in IS.I.OR.220 should be understood as an alert that would require timely
awareness and response from the information security events management team.
In the context of information security response, ‘deception’ refers to a range of techniques that aim
to mislead potential attackers or malicious users, thereby protecting the system and its data.
Deception techniques, such as honeypots or breadcrumb trails, are designed to confuse, slow down
or divert attackers, increasing their cost and risk while providing defenders with valuable time andintelligence.
Guidance regarding the vulnerability management strategy can be found in EUROCAE ED-206, Chapter
3.4 — Vulnerability management considerations. This is not the only source where guidance can befound, and the organisation may refer to different guidance more appropriate for their application.

Powered by EASA eRules

Page 128 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

AMC1 IS.I.OR.220(c) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

When complying with the requirement in IS.I.OR.220(c), the organisation should develop an incident
recovery procedure including at least the following:(a)a list of those assets that enable safe operations, as well as the dependencies among them,constituting the scope of the recovery;(b)a description of the process with the necessary priority actions to be executed for a return to asafe and secure state for the assets within the scope of the recovery;(c)

the resources required to execute the actions defined in point (b) to ensure that these resources
are readily available after an incident has occurred;(d)the objectives for recovery time that should be set in relation to the safety criticality of theassets within the scope of the recovery.

GM1 IS.I.OR.220(b)&(c) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

RECOVERY OBJECTIVES AND TIMING

Point IS.I.OR.220(b) addresses event conditions which may develop or have developed into
information security incidents, that may have a potential impact on aviation safety, and require
response and recovery measures to be in place to ensure that operational safety remains above aminimum acceptable level.
The level of operations and safety may be interrelated, so in some cases when the level of operations
is compromised by an information security incident and drops, the level of safety does the same. Thisis, for instance, the case of air traffic control; if air traffic services are reduced or become unreliable,
the safety of flights is reduced too.
However, in other cases the relation between the level of operations and safety may be the inverse,or they may be decoupled, so when an incident occurs and the level of operations drops, the level ofsafety is preserved. One example is the compromise of the software loading process on board theaircraft. In this case, a detected incident followed by the decision to interrupt the software loading
operations would preserve the existing level of safety.
The following Figure 1 depicts a conceptual framework that may be considered for the definition of
the response and recovery objectives, including the recovery time. It represents, in the worst-casescenario, how the expected level of operational safety (safety level) for a process or an activity mayvary over time when an information security incident occurs. In this scenario, the safety level is first
reduced by the incident and then it degrades as long as the time passes. The figure also shows the
expected effect that mitigating measures and controls should have, respectively: in containing theoperational safety drop as soon as an incident occurs, and in improving the recovery, i.e. the returnto the expected safety level.

Powered by EASA eRules

Page 129 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Figure 1: Conceptual framework for the definition of the response and recovery objectives

As mentioned, there might be different relations between the level of operations and safety thatwould lead to a different representation of the above figure. In certain cases, an incident may have adelayed effect on the safety level (e.g. a compromised development environment) as depicted in
Figure 2, or it may have no impact if properly controlled, as in the case of the compromised software
loading process mentioned before, which is depicted in Figure 3.

Moreover, it should be noticed that there might be different ways the same incident can be dealt with,since there are several factors that may affect safety.

Powered by EASA eRules

Page 130 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

In practical terms, the objectives for recovery time referred to in AMC1 IS.I.OR.220(c) may be
expressed as a list of resources and services to be restored by order of priority, within the scope ofthe recovery. Guidance about objectives for recovery time can be found in EUROCAE ED-206, Chapter
7.3.5.

GM1 IS.I.OR.220(c) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

A recovery procedure or recovery plan should describe incident recovery actions and the internal orexternal resources that are involved (e.g. staff, IT, buildings, providers). Guidance about incident
recovery plan can be found in EUROCAE ED-206, Chapter 7 – Recover.
The resources required to apply the recovery measures should be available in order to implement therecovery actions in a timely manner after an incident has occurred. Those resources may be internallyavailable or provided by contracted organisations as provided for in IS.I.OR.235. The contracting ofrecovery activities should be established before an incident occurs (proactive), and the contract
should include provisions for the contracted party to react in a timely manner.
The return to a safe and secure state may initially require emergency measures, which are actions thatare initiated based on the best information available at the time, before complete understanding of
the situation is achieved and these measures can potentially degrade the level of service orfunctionalities. The return to a safe and secure state should be evaluated against the initial risk
assessment and may only temporarily differ from the normal operational conditions. However, any
increase of the residual risk and the duration of this risk increase, i.e. due to the implementation of
emergency measures, should be documented and accepted at the right level of accountability.
The recovery activities mentioned here may also be the outcome of the response to incidents forwhich the organisation has received information that requires the implementation of adequate
measures in order to react to information security incidents or vulnerabilities with a potential impact
on aviation safety.
In such context the organisation may not have a process or a recovery plan covering the specificoccurrence. Therefore, the definition from the organisation of a specific recovery plan and its approvalby the competent authority is usually required.

IS.I.OR.225 Response to findings notified by the competentauthority
Regulation (EU) 2023/203

(a)

(b)

After receipt of the notification of findings submitted by the competent authority, theorganisation shall:(1)

identify the root cause or causes of, and contributing factors to, the non-compliance;(2)

define a corrective action plan;(3)

demonstrate the correction of the non-compliance to the satisfaction of the competentauthority.

The actions referred to in point (a) shall be carried out within the period agreed with thecompetent authority.

Powered by EASA eRules

Page 131 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

AMC1 IS.I.OR.225 Response to findings notified by the competentauthority
ED Decision 2023/009/R

The compliance with IS.I.OR.225 should be managed as required for each organisation in thecorresponding implementing regulation for the domain as identified in point Article 2(1) of Regulation(EU) 2023/203 concerning the response to findings notified by the competent authority. The domain
regulation may require the organisation to respond to the findings in accordance with theircategorisation.

GM1 IS.I.OR.225 Response to findings notified by the competentauthority
ED Decision 2023/009/R

The requirement for the categorisation of findings and the period within which the actions in
IS.I.OR.225(a) should be performed can be found in the corresponding implementing regulation forthe domain, under the authority requirements. For the opening of findings related to this Regulation,
the competent authority will follow the above-mentioned requirement.

IS.I.OR.230 Information security external reporting scheme
Regulation (EU) 2023/203(a)

The organisation shall implement an information security reporting system that complies withthe requirements laid down in Regulation (EU) No 376/2014 and its delegated andimplementing acts if that Regulation is applicable to the organisation.

(b)Without prejudice to the obligations of Regulation (EU) 376/2014, the organisation shall ensurethat any information security incident or vulnerability, which may represent a significant risk toaviation safety, is reported to their competent authority. Furthermore:

(c)

(1)

Where such an incident or vulnerability affects an aircraft or associated system orcomponent, the organisation shall also report it to the design approval holder;(2)

Where such an incident or vulnerability affects a system or constituent used by theorganisation, the organisation shall report it to the organisation responsible for thedesign of the system or constituent.

The organisation shall report the conditions referred to in point (b) as follows:(1)

a notification shall be submitted to the competent authority and, if applicable, to thedesign approval holder or to the organisation responsible for the design of the system orconstituent, as soon as the condition has been known to the organisation;(2)

a report shall be submitted to the competent authority and, if applicable, to the design
approval holder or to the organisation responsible for the design of the system orconstituent, as soon as possible, but not exceeding 72 hours from the time the condition
has been known to the organisation, unless exceptional circumstances prevent this.
The report shall be made in the form defined by the competent authority and shallcontain all relevant information about the condition known to the organisation;(3)

a follow-up report shall be submitted to the competent authority and, if applicable, tothe design approval holder or to the organisation responsible for the design of the system

Powered by EASA eRules

Page 132 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

or constituent, providing details of the actions the organisation has taken or intends totake to recover from the incident and the actions it intends to take to prevent similar
information security incidents in the future.
The follow-up report shall be submitted as soon as those actions have been identified,and shall be produced in the form defined by the competent authority.

GM1 IS.I.OR.230 Information security external reporting scheme
ED Decision 2023/009/R

Organisations are required to report occurrences to their competent authority.
EXAMPLES

Design organisations approved by EASA: EASA is the competent authority.
Air operators certified by the competent authority of a Member State: the competent authority of theMember State is the competent authority.
SPECIAL CASES

In a situation where an organisation has two air operator certificates (AOCs) under two different EU
Member States (State A and B), the occurrences involving aircraft operating under the State A AOC
have to be reported to the State A competent authority; instead, the occurrences involving aircraft
operating under the State B AOC have to be reported to the State B competent authority.
For organisations holding multiple approvals, the reporting will be done to the competent authorityof the approved part of the organisation where the incident has occurred, or the vulnerability has
been discovered. In case the incident/vulnerability affects multiple approvals, the reporting will bedone to all the competent authorities.
For organisations holding an approval but operating outside the EU (e.g. Part-145), EASA is thecompetent authority and they have to report to the Agency.
Dual-use aircraft — a vulnerability may need to be reported through both the military and civil
reporting systems if it affects a dual-use function/system. Information reported through the civil
reporting system should be sanitised (i.e. all sensitive information should be properly removed).

AMC1 IS.I.OR.230(a)&(b) Information security external reporting
schemeED Decision 2023/009/R

In order to comply with the provisions under IS.I.OR.230 (a) and (b), the organisation should report:(a)any occurrence covered by Regulation (EU) No 376/2014 that originated from intentional
unauthorised electronic interactions;(b)information security incidents having a potential significant risk to aviation safety not covered
under Regulation (EU) No 376/2014;(c)vulnerabilities that pose a significant risk to aviation safety and are not yet adequately mitigatedin accordance with an approved vulnerability management strategy (see AMC1 IS.I.OR.220(b)).

Powered by EASA eRules

Page 133 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

From the aforementioned reports, it is the responsibility of the competent authorities under Part-IS
to ensure compliance with Article 7 of this Regulation and to submit any relevant information thatneeds to be shared with the information security competent authorities designated under Article 8 of
Directive (EU) 2016/1148.

GM1 IS.I.OR.230(a)&(b) Information security external reporting
schemeED Decision 2023/009/R

RELATION BETWEEN IS.I.OR.230(b) AND REGULATION (EU) No 376/2014

Regulation (EU) No 376/2014 of the European Parliament and of the Council lays down requirementson the reporting, analysis and follow-up of occurrences in civil aviation. Compliance with point
IS.I.OR.230(b) does not exempt organisations from compliance with Regulation (EU) No 376/2014.
For each category of reporter, Regulation (EU) 2015/1018 defines the nature of items to be
mandatorily reported. Regulation (EU) No 376/2014 also considers voluntary reporting of other items
that are perceived by the reporter as a threat to aviation safety.
Furthermore, compliance with Regulation (EU) No 376/2014 does not exempt organisations fromcompliance with point IS.I.OR.230(b). However, this should not give rise to two parallel reporting
systems, and point IS.I.OR.230(b) and Regulation (EU) No 376/2014 should be seen as complementaryin that respect.
In practice, this means that reporting obligations under point IS.I.OR.230(b) on the one hand andreporting obligations under Regulation (EU) No 376/2014 on the other hand are compatible. These
reporting obligations may be discharged using one reporting channel. In addition, any natural or legal
person that has more than one role subject to the obligation to report may discharge all thoseobligations through a single report. Organisations are encouraged to properly describe this in theirorganisation manual, to address cases in which the responsibilities are discharged on behalf of theorganisation.
FOLLOW-UP ANALYSIS

When the analysis of an occurrence reported under Regulation (EU) No 376/2014 later identifies thatthe root cause of, or the contributing factor to, the occurrence was an intentional unauthorised
electronic interaction, the organisation should update its notification to the competent authority.
SIGNIFICANT RISK TO AVIATION SAFETY

In line with the definition of occurrence under Article 2(7) of Regulation (EU) No 376/2014, any
information security incident or vulnerability, which may represent a significant risk to aviation safety,
should be considered a reportable occurrence. Significant risk to aviation means unsafe condition, i.e.
one that can result in an accident or a serious incident (as defined in ICAO Annex 13).
Note: When assessing the possibility that the effects of an information security incident could lead toan unsafe condition, the organisation should consider the combination of effects if the incident
involves multiple systems; indeed, some assumptions about system independence that may be valid
for fortuitous occurrences may be violated by deliberate acts.

Powered by EASA eRules

Page 134 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

RELATION BETWEEN IS.I.OR.230(b)(1) AND OTHER REPORTING REQUIREMENTS OF INFORMATION SECURITY
OCCURRENCES RELATED TO AVIATION PRODUCTS OR PARTS

For organisations subject to reporting requirements of information security occurrences related toaviation products or parts, compliance with the specific provisions in the implementing regulation for
their domain is considered sufficient to achieve compliance with the requirement in point
IS.I.OR.230(b)(1). For example, for organisations subject to Regulation (EU) No 748/2012, thereporting can be done in accordance with point 21.A.3A of Annex I (Part 21) to that Regulation.

AMC1 IS.I.OR.230(c) Information security external reporting
schemeED Decision 2023/009/R

Within the overall limit of 72 hours the degree of urgency for submission of a report should bedetermined by the level of the safety impact judged to have resulted from the information security
incident or discovered vulnerability. Where an occurrence is judged by the person identifying thepossible unsafe condition to have resulted in an immediate and particularly significant hazard, thecompetent authority expects to be advised immediately and by the fastest possible means (telephone,
fax, email, telex, etc.) of whatever details are available at that time.

GM1 IS.I.OR.230(c) Information security external reporting scheme
ED Decision 2023/009/R

Guidance regarding the reporting of information security incidents and vulnerabilities can be found in
EUROCAE ED-206, Chapter 6.4.2.2 — Reporting timeline and Chapter 6.4.5 — Reporting information
content. This is not the only source where guidance can be found, and the organisation may refer todifferent guidance more appropriate for their application.
Note: The person reporting an occurrence under Regulation (EU) No 376/2014 may not have thecapability to determine the nature of the occurrence. This is particularly true for information security
and the result can come from forensic analysis that determines the information security nature of theoccurrence. The evaluation will be done as part of the initial internal reporting process (see IS.I.OR.215
and related AMC). The evaluation of the occurrence can demonstrate the possibility that it
materialises into an unsafe condition taking into account the likelihood of realisation.

IS.I.OR.235 Contracting of information security management
activities
Regulation (EU) 2023/203(a)

The organisation shall ensure that when contracting any part of the activities referred to in point
IS.I.OR.200 to other organisations, the contracted activities comply with the requirements ofthis Regulation and the contracted organisation works under its oversight. The organisation
shall ensure that the risks associated with the contracted activities are appropriately managed.

(b)

The organisation shall ensure that the competent authority can have access upon request to
the contracted organisation to determine continued compliance with the applicablerequirements laid down in this Regulation.

Powered by EASA eRules

Page 135 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.235 Contracting of information security management
activities
ED Decision 2023/009/R

Organisations may decide to outsource certain activities to suppliers, both for their own operational
needs and for the purpose of complying with this Regulation (information security management
activities). Activities contracted for operational needs may fall within the scope of Part-IS and
therefore the relevant information security risks have to be managed in accordance with therequirements in points IS.I.OR.205 and IS.I.OR.210. Instead, information security management
activities are subject to the specific provisions of IS.OR.235 because matters relating to these activities
can have a major impact on the organisation.
Therefore the objectives of point IS.I.OR.235 are:(a)to protect critical and sensitive information and assets when being handled by organisations
contracted for the provision of information security management activities (includingorganisations in the supply chain) at either their facilities or the organisation facilities, or whenbeing transmitted between the organisation and contracted organisations, or being remotely
accessed by contracted organisations;(b)to prevent information security risks from being introduced through products and services
developed or provided by the contracted organisations to the organisation, in the frame of theprovision of information security management activities;(c)to ensure that information security risks are managed throughout all the stages of the relation
with the contracted organisations.

GM2 IS.I.OR.235 Contracting of information security management
activities
ED Decision 2023/009/R(a)

The contracting of information security management activities is a means to allocate tasks fromthe contracting organisation to third parties (contracted organisations). The contracting
organisation remains responsible for the oversight of the contracted organisation(s) andaccountable for compliance with this Regulation.

(b)

A contract could take the form of a written agreement, letter of agreement, service letter
agreement, memorandum of understanding, etc. as appropriate for the contracted activities.

Powered by EASA eRules

Page 136 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM3 IS.I.OR.235 Contracting of information security management
activities
ED Decision 2023/009/R

EXAMPLES
The following Table 1 provides some examples of information security management activities that
may be contracted in relation to the provisions referred to as in IS.I.OR.200.

Table 1: Examples of information security management activities that may be contracted
IS.I.OR.200 points related to activities

Example of contracted activity(a)(1): establishes a policy on information security
setting out the overall principles of the organisation
with regard to the potential impact of information
security risks on aviation safety;(a)(2): identifies and reviews information security
risks in accordance with point IS.I.OR.205;

Information security policy drafting and consultancy(a)(3): defines and implements information security
risk treatment measures in accordance with point
IS.I.OR.210;(a)(4): implements an information security internalreporting scheme in accordance with point
IS.I.OR.215;(a)(5): defines and implements, in accordance withpoint IS.I.OR.220, the measures required to detect
information security events, identifies those events
which are considered incidents with a potential
impact on aviation safety except as permitted bypoint IS.I.OR.205(e), and responds to, and recovers
from, those information security incidents;(a)(6): implements the measures that have been
notified by the competent authority as an
immediate reaction to an information security
incident or vulnerability with an impact on aviation
safety;(a)(7): takes appropriate action, in accordance withpoint IS.I.OR.225, to address findings notified by thecompetent authority;

Powered by EASA eRules

Identify activities, facilities and resources.
Identify interfaces with other organisations which
could be exposed to information security risks.
Perform risk analysis or part of it, e.g. identify andclassify information security risks.
Define, develop and implement measures.
Verify the initial and the continued effectiveness of
the implemented measures (e.g. red-team/blueteam exercises, penetration testing, vulnerability
scanning, etc.).
Communicate to the involved stakeholders theoutcome of the risk assessment and their
responsibilities as part of the risk treatment process.
Define, develop and implement an internal reporting
scheme to enable the collection and evaluation of
information security events and vulnerabilities ofequipment, processes and services.
Define, develop and implement measures to detect
events.
Define, develop and implement measures to
respond to any event conditions.
Define, develop and implement measures aimed atrecovering from information security incidents.
Implement immediate reaction measures to an
information security incident or vulnerability as
notified by the competent authority.

Identify root cause.
Define corrective action plan.
Provide evidence of the corrective actions
implemented to close the finding.

Page 137 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

IS.I.OR.200 points related to activities

Example of contracted activity(a)(8): implements an external reporting scheme inaccordance with point IS.I.OR.230 in order to enable
the competent authority to take appropriate actions;Define, develop and implement an externalreporting scheme to enable the communication of
the information security incidents and vulnerabilities
of equipment, processes and services to thecompetent authority and when required to thedesign approval holder or the organisation
responsible for the design.
Not applicable(a)(9): complies with the requirements contained inpoint IS.I.OR.235 when contracting any part of theactivities described in point IS.I.OR.200 to otherorganisations;(a)(10): complies with the personnel requirements
laid down in point IS.I.OR.240;(a)(11): complies with the record-keeping
requirements contained in point IS.I.OR.245;(a)(12): monitors compliance of the organisation
with the requirements of this Regulation andprovides feedback on findings to the accountable
manager to ensure effective implementation ofcorrective actions;(a)(13): protects, without prejudice to applicableincident reporting requirements, the confidentialityof any information that the organisation may havereceived from other organisations, according to its
level of sensitivity.
(b): In order to continuously meet the requirements
referred to in Article 1, the organisation shall
implement a continuous improvement process inaccordance with point IS.I.OR.260.
(c): The organisation shall document, in accordancewith point IS.I.OR.250, all key processes, procedures,roles and responsibilities required to comply withpoint IS.I.OR.200 (a, and) shall establish a process foramending this documentation. Changes to those
processes, procedures, roles and responsibilities
shall be managed in accordance with point
IS.I.OR.255.

Powered by EASA eRules

Activities of the accountable manager in the frameof the provisions for a ‘common responsible person’
as referred to in IS.I.OR.240
Compliance monitoring as foreseen by IS.I.OR.240
Contracted organisation to ensure that sufficientpersonnel is on duty to perform the activities related
to this Regulation
Define, develop and deliver adequate training toachieve the competencies required by the staff.
Perform pre-employment checks.
Define, develop and implement secured archiving.
Provision of secure data centre (as a service)
Provision of records updates
Compliance monitoring (as foreseen by IS.I.OR.240)
including the execution of independent audits

Define, develop and implement solutions to protect
the confidentiality of any information.

Execute independent effectiveness and maturity
assessments.
Define, develop and implement the necessary
improvement measures.
Production of documentation to detail all key
processes, procedures, roles and responsibilities
required to comply with point IS.I.OR.200(a) (e.g.
information security policies, general description of
the staff, procedures to specify compliance).
Define, develop and implement processes forapproving amendments and changes.

Page 138 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

AMC1 IS.I.OR.235(a) Contracting of information security
management activities
ED Decision 2023/009/R(a)

OVERSIGHT OF THE CONTRACTED ORGANISATION

In order to exercise oversight of the contracted organisation, the organisation under Part-IS should
have:
(1)

a process to ensure compliance with the provisions regarding contracted activities contained inthis Regulation;(2)

a structured process to follow the expected execution of the contract that includes:(i)

definition and agreement of the scope of the activities;(ii)

definition of the roles and responsibilities of the parties (i.e. contracting and contractedorganisation);(iii)

definition and review of KPIs;(iv)

reaction to deviation from contractual obligations;(v)performance of compliance audits, according to the predefined scope and objectives,with the aim of evaluating operational and associated assurance activities;(vi)

provision of feedback on the result of the compliance audits both within the organisationand to the contracted organisation, and response to findings. The feedback on theoutcome of the compliance audits within the contracting organisation should reach theaccountable manager or delegated person(s) to ensure proper monitoring of the
response to findings (i.e. implementation of corrective actions) or, if deemed necessary,
termination of the contract.

Note: The right of the organisation to conduct compliance audits of the contracted organisation should
be included in the contract between the parties.
(b)

MANAGEMENT OF THE RISKS ASSOCIATED WITH THE CONTRACTED ACTIVITIESIn order to properly manage the risks associated with the contracted activities, the organisation shouldmeet the following criteria:(1)

A prior assessment of the suppliers is conducted before outsourcing any information security
management activities. The assessment should evaluate suppliers’ competencies, sustainability
as well as qualifications in relation to the activities to be contracted.

(2)

There is an assessment of the risks associated with the provision of the contracted activities
that has been agreed between the organisation under Part-IS and the contracted organisation.

(3)

The organisation establishes and maintains appropriate information security communication
channels with the contracted organisation.

Powered by EASA eRules

Page 139 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.235(a) Contracting of information security
management activities
ED Decision 2023/009/R

PRIOR ASSESSMENT

The purpose of the prior assessment is to evaluate suppliers’ competencies, sustainability as well as
qualifications in relation to the information security activities to be contracted. This prior assessment
may need to be carried out taking into account other legal requirements or procurement proceduresthat apply to the organisation, and may therefore be carried out in different ways, such as:(a)in case of public bids, inclusion of eligibility requirements in the procurement documents forthe potential suppliers;(b)review of the information security certifications granted by external and impartial auditors to
the potential suppliers;(c)review of self-assessment questionnaires compiled by the potential suppliers.

RISK ASSESSMENT ASSOCIATED WITH THE PROVISION OF THE CONTRACTED ACTIVITIESThe risk assessment should take into account the maturity level of the contracted organisation, andshould consider the following:(a)identification and assessment of critical and sensitive information and assets that may beshared with, or provided by, external suppliers;(b)

identification of the information security requirements of the organisation that are applicableto the contracted organisation;(c)evaluation, by means of a supplier assessment, of the ability of the contracted organisation(both existing and new contracted organisations) to meet the information security
requirements of the contracting organisation;(d)assessment of risks that may be introduced by the contracted organisation.

This agreed risk assessment should also consider the roles and responsibilities of the contracting andcontracted organisation as well as their interfaces.

GM2 IS.I.OR.235(a) Contracting of information security
management activities
ED Decision 2023/009/R

AUDIT OF CONTRACTED ORGANISATIONS

The following aspects should be considered by the organisation when auditing a supplier contracted
to perform information security management activities:—

the scope of the audit as well as the objective should be limited to processes, resources (i.e.
contracted organisation personnel, systems/equipment, networks) and data used for the
execution of Part-IS contracted activities;—

compliance and/or implementation audits should be done at the contracting organisation’s
discretion;—

findings identified during an audit should be addressed through a remediation plan within atime frame to be validated by the contracting organisation.

Powered by EASA eRules

Page 140 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

AMC1 IS.I.OR.235(b) Contracting of information security
management activities
ED Decision 2023/009/R

In order to ensure access by the competent authority to the contracted organisation upon request,
the organisation under Part-IS should ensure that such a requirement or clause is included in thecontractual documentation.
The competent authority’s access to the contracted organisations should be at least equivalent to that
granted to the contracting organisation and, in any case, sufficient to ensure the assessment ofcontinued compliance of the contracted activities with the applicable requirements.

GM1 IS.I.OR.235(b) Contracting of information security
management activities
ED Decision 2023/009/R

Access to the contracted organisation means to have visibility of evidence for compliance of thecontracted activities (such as artefacts, documents, independent certifications).
Evidence of compliance could be achieved either by transfer of documents and/or access to
information at the premises in accordance with the ‘audit scope’ as defined in the contract.
In those cases where the organisation would use commercial off-the-shelf services with standard
contractual clauses as part of the contracted information security management activities, theorganisation should consider whether these clauses provide sufficient access to the required
information.
The opportunity to visit the premises should be evaluated considering different aspects such as thesensitivity of the related information or the practical accessibility to the contracted organisation (e.g.
the contracted organisation is a service provider with distributed resources).

IS.I.OR.240 Personnel requirements
Regulation (EU) 2023/203(a)

The accountable manager of the organisation designated in accordance with the Regulation(EU) No 1321/2014, Regulation (EU) No 965/2012, Regulation (EU) No 1178/2011, Regulation(EU) 2015/340, Regulation (EU) 2017/373 or Regulation (EU) 2021/664 as applicable referred toin Article 2(1) of this Regulation shall have corporate authority to ensure that all activities
required by this Regulation can be financed and carried out. That person shall:(1)

ensure that all necessary resources are available to comply with the requirements of thisRegulation;(2)

establish and promote the information security policy referred to in point
IS.I.OR.200(a)(1);(3)

demonstrate a basic understanding of this Regulation.

Powered by EASA eRules

Page 141 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](b)

The accountable manager shall appoint a person or group of persons to ensure that theorganisation complies with the requirements of this Regulation, and shall define the extent of
their authority. That person or group of persons shall report directly to the accountable
manager, and shall have the appropriate knowledge, background and experience to discharge
their responsibilities. It shall be determined in the procedures who deputises for a particularperson in the case of lengthy absence of that person.

(c)

The accountable manager shall appoint a person or group of persons with the responsibility to
manage the compliance monitoring function referred to in point IS.I.OR.200(a)(12).

(d)

Where the organisation shares information security organisational structures, policies,
processes and procedures with other organisations or with areas of their own organisation
which are not part of the approval or declaration, the accountable manager may delegate its
activities to a common responsible person.
In such a case, coordination measures shall be established between the accountable managerof the organisation and the common responsible person to ensure adequate integration of theinformation security management within the organisation.

(e)

The accountable manager or the common responsible person referred to in (d) shall have
corporate authority to establish and maintain the organisational structures, policies, processes
and procedures necessary to implement point IS.I.OR.200.

(f)

The organisation shall have a process in place to ensure that they have sufficient personnel on
duty to carry out the activities covered by this Annex.

(g)

The organisation shall have a process in place to ensure that the personnel referred to in point(f) have the necessary competence to perform their tasks.

(h)The organisation shall have a process in place to ensure that personnel acknowledge theresponsibilities associated with the assigned roles and tasks.

(i)

The organisation shall ensure that the identity and trustworthiness of the personnel who haveaccess to information systems and data subject to the requirements of this Regulation areappropriately established.

GM1 IS.I.OR.240 Personnel requirements
ED Decision 2023/009/R

The objectives of the requirements contained in points (a) through (e) are:(a)to ensure that an effective organisational structure is in place in order to comply with therequirements of this Regulation;(b)

to provide trust to other organisations with whom they share risks.

AMC1 IS.I.OR.240(a)(2) Personnel requirements
ED Decision 2023/009/R

PROMOTION OF INFORMATION SECURITY POLICY

The accountable manager of the organisation should make sure that the information security policy is
known and easily accessible for staff members as appropriate to their duties.

Powered by EASA eRules

Page 142 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

AMC1 IS.I.OR.240(a)(3) Personnel requirements
ED Decision 2023/009/R

BASIC UNDERSTANDING OF THE REGULATION

In order to demonstrate a basic understanding of this Regulation, the accountable manager of theorganisation should have the ability to explain the overarching objectives of the Regulation and its
implications for the organisation.

GM1 IS.I.OR.240(a)(3) Personnel requirements
ED Decision 2023/009/R

BASIC UNDERSTANDING OF THE REGULATIONIn the event that the accountable manager has no previous experience in the areas of activity
pertinent to Part-IS, he or she may gain the necessary understanding by attending a training covering
the content the Regulation and the technical basis for compliance. In particular, the training material
should cover the overarching objectives of Part-IS, and the assessment should evaluate theunderstanding of these regulatory objectives.

AMC1 IS.I.OR.240(b) Personnel requirements
ED Decision 2023/009/R

APPOINTMENT OF A PERSON OR GROUP OF PERSONSThe person or group of persons appointed under point IS.I.OR.240(b) with the responsibility to ensurecompliance with the requirements of this Regulation should represent the management structure of
the organisation.
The person or group of persons has direct access to the accountable manager (or the common
responsible person, if appointed) to provide guidance, direction and support for the planning,
implementation and operation of the process and standards to comply with the Regulation. They
should have direct access to keep the accountable manager (or the common responsible person)
properly informed on compliance and information security matters (for instance, through meetingsorganised on a regular basis).
Appointments should take into account the possibility that a person may not be able to carry out theorganisational tasks assigned to them for a period of time, and thus also identify the necessary
deputies.
These appointed persons should demonstrate a complete understanding of the requirements of thisRegulation, to be able to ensure that the organisation’s processes and standards accurately reflect theapplicable requirements. It is their role to ensure that compliance is proactively managed, and thatany early warning signs of non-compliance are documented and acted upon.
A description of the functions and the responsibilities of the appointed persons and deputies,
including their names, should be contained in the ISMM (see point IS.I.OR.250(a)(2)).

Powered by EASA eRules

Page 143 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.240(b) Personnel requirements
ED Decision 2023/009/R

A condition of a lengthy absence of an appointed person occurs when that person is unable to performthe assigned organisational duties. For example, if an information security management activity isrequired to be carried out by appointed persons at a specified interval, an absence is consideredlengthy when it exceeds this interval and therefore a vulnerability in the management activity may
arise.

GM1 IS.I.OR.240(b)&(c) Personnel requirements
ED Decision 2023/009/R

Appointments may be made by email, organisational chart, roles & responsibilities table, etc. usuallyin use by the organisation. The organisation may adopt any titles for the foregoing information security
management positions, but it should identify to the competent authority the titles and the persons
chosen to carry out these functions.

GM1 IS.I.OR.240(c) Personnel requirements
ED Decision 2023/009/R

COMPLIANCE MONITORING FUNCTION

The person appointed under point IS.I.OR.240(c) with the responsibility to manage the compliancemonitoring function required under point IS.I.OR.200(a)(12) may be the same person as, or report to,
the person responsible for the compliance monitoring function required under the implementing
regulation for the domain.

AMC1 IS.I.OR.240(d) Personnel requirements
ED Decision 2023/009/R

COORDINATIONThe criteria to establish coordination that ensures adequate integration of the information security
management within the organisation are the following:(a)the scope and boundaries of the organisations have been established and communicated to thecommon responsible person;(b)

the requirements of this Regulation have been communicated to and shared with the common
responsible person;(c)

the common responsible person has direct access to the accountable manager;(d)issues are proactively managed and any early warning signs of non-compliance are documented
and acted upon.

Powered by EASA eRules

Page 144 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.240(e) Personnel requirements
ED Decision 2023/009/R

COMMON RESPONSIBLE PERSON

If a common responsible person (CRP) is delegated by the accountable manager for the activities
under this Regulation, this person should also be given the appropriate delegation that is necessary
to implement the provisions of IS.I.OR.200, including the authority and the financial means to mobilise
and control the resources across the organisations, or parts of the organisation involved. Thisdelegation may also include the appointment of the person or group of persons referred to in
IS.I.OR.240(b) and (c) and, in general, the CRP may be assisted in the performance of his or her duties
by additional personnel.
The possibility of delegating a CRP applies to an organisation that shares information security
organisational structures, policies, processes and procedures with other organisations or with parts of
its own organisation that are not part of the authorisation or declaration, and therefore this CRP is
expected to have information security responsibilities and competencies. In particular, the CRP should
be capable of managing the organisation’s information security strategy and its implementation toensure the achievement of the objectives described in Article 1. According to the European
Cybersecurity Skills Framework (ECSF) published by ENISA in September 2022, this person may bedescribed, for instance, as (Chief) Information Security Officer, Cybersecurity Programme Director or
Information Security Manager. However, it should be noticed that these descriptions and the related
skills do not consider the aviation safety perspective that is required in Article 1.
Where an entity holds multiple authorisations or declarations, the relevant accountable managers
may delegate to the same CRP, who will therefore be responsible for implementing the provisions of
IS.I.OR.200 for a functional cluster sharing information security structures, policies, processes andprocedures.

AMC1 IS.I.OR.240(f) Personnel requirements
ED Decision 2023/009/R

SUFFICIENT PERSONNEL

To determine the sufficiency of the personnel, the following elements should be taken into
consideration:(a)the organisational structures, policies, processes and procedures subject to information
security management;(b)the amount of coordination required with other organisations, contractors and suppliers;(c)the level of risk associated with the activities performed by the organisation.

Powered by EASA eRules

Page 145 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.240(f) Personnel requirements
ED Decision 2023/009/R

SUFFICIENT PERSONNEL

For the purpose of this Regulation, personnel refers to the combination of the personnel directly
employed by the organisation, as well as the personnel contracted as specified in IS.I.OR.235.
The activities reported in Appendix II, on the main tasks stemming from the implementation of PartIS, should be considered when establishing the organisational structure necessary to comply with therequirements of this Regulation.

AMC1 IS.I.OR.240(g) Personnel requirements
ED Decision 2023/009/R

NECESSARY COMPETENCE

(a)

(b)

To determine the competence needed by the personnel performing the activities, the following
elements should be taken into consideration:(1)

work roles and the associated tasks;(2)

required knowledge, skills and abilities.

As part of the process to ensure that personnel maintain the necessary competence, theorganisation should:(1)

assess the personnel qualifications and experience with respect to the competence
required for the assigned work roles to identify gaps;(2)align the personnel qualifications and experience with the competence expected to fulfil
their roles by organising adequate learning programmes for existing members of
personnel, by recruiting new resources, or by a combination thereof;(3)

maintain the personnel competence during the time they are assigned to the work role.

GM1 IS.I.OR.240(g) Personnel requirements
ED Decision 2023/009/R

NECESSARY COMPETENCE AND TRAINING PROGRAMME

A training programme should start with the identification of the competence required by the
personnel for each role, followed by the identification of the gaps between the existing competence
and the required one.
In order to develop the list of competencies, an organisation may use, as initial guidance, an existing
cybersecurity competence framework such as the NICE (National Initiative for Cybersecurity
Education) based on the NIST Cybersecurity Framework (NIST CSF).
In Appendix II, the main tasks of this Regulation are listed and mapped to the competencies derived
from the NIST CSF. This mapping may be used to establish a baseline to identify the aforementioned
competence gaps. However, it should be noticed that existing cybersecurity/information security
competence frameworks such as the NICE typically focus primarily on the protection of standard
information technologies; therefore, the proposed list of competencies may need to be adapted tothe technologies or integrated with processes used in the organisation.

Powered by EASA eRules

Page 146 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

The bridging of the identified gaps should be seen as the objective of the training programme, whichshould further include the scope, content, methods of delivery (e.g. classroom training, e-learning,
notifications, on-the-job training) and frequency of training that best meet the organisation’s needs
considering the size, scope, required competencies, and complexity of the organisation.
Finally, as information security/cybersecurity evolves due to the rise of new threats, the organisation
should periodically review the adequacy of the training programme.

AMC1 IS.I.OR.240(h) Personnel requirements
ED Decision 2023/009/R

ACKNOWLEDGEMENT OF RESPONSIBILITIESRegarding any assigned role and task, the organisation should specify all information security
responsibilities an employee has in a clear and transparent manner.
As part of this, all personnel performing the activities required under this Regulation should
acknowledge, in a traceable and verifiable manner, understanding of the assigned roles and theassociated information security responsibilities.

GM1 IS.I.OR.240(h) Personnel requirements
ED Decision 2023/009/R

ACKNOWLEDGEMENT OF RESPONSIBILITIESAcknowledgement of receipt such as a valid electronic or wet signature, confirmation email, etc., is a
traceable proof of acknowledgement.

AMC1 IS.I.OR.240(i) Personnel requirements
ED Decision 2023/009/R

IDENTITY AND TRUSTWORTHINESSFor the personnel who have access to information systems and data subject to the requirements ofPart-IS, the identity should be determined on the basis of documentary evidence.
To establish the trustworthiness of such personnel, the organisation should have a documented
process and appropriate criteria to ensure that individuals can be trusted to perform their role.

GM1 IS.I.OR.240(i) Personnel requirements
ED Decision 2023/009/R

IDENTITY AND TRUSTWORTHINESS(a)

Trustworthiness may be established, for example, by:(1)prior to employment, a background check carried out in accordance with the applicable
rules of Union and national law. This check may include verification of:(i)

education, previous employment and any gaps in the previous years;(ii)

absence of criminal record;(iii)

any other relevant information or intelligence considered relevant to the suitabilityof a person to work in the expected role;

Powered by EASA eRules

Page 147 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](2)

during employment, monitoring the employee’s commitment and conduct.

Note: The absence of criminal record may be verified by means of a certificate issued by the
responsible authority in the Member State in accordance with Regulation (EU) 2016/1191. In
the case of prospective foreign employees, the above checks may be carried out on the basis ofequivalent certificates issued by the country of origin, such as a ‘certificate of good conduct’.
(b)Furthermore, the process and criteria to establish personnel’s trustworthiness may have toconsider whether:(1)

the information systems and data to be accessed have been associated with a highseverity of the safety consequences with the risk assessment process under IS.I.OR.205;(2)

controls or mitigating measures for risk treatment identified during the risk analysis rely
on organisational/operational procedures — for instance, correct configuration andadministration of information technologies, database operations, information security
monitoring, etc.

In such cases, the personnel who have administrator rights or unsupervised and unlimitedaccess to the systems and data mentioned in (a)(1), or the personnel who applies the measures
under above point (b)(2), may be subject to more stringent criteria.
(c)Intelligence and any other relevant information may be gathered by screening and analysing
public sources such as social media and websites, within the limits set by relevant national laws
and regulations.

(d)Some organisations subject to Part-IS may also be subject to Regulation (EU) 2015/1998 that
requires successful completion of background checks for personnel in certain roles, as well as amechanism for the ongoing review of these checks. In such cases the organisation may consider
suitable for the establishment of the personnel’s identity and trustworthiness required under
Part-IS, in relation to their role, the process and the relevant criteria defined in Regulation (EU)2015/1998 for standard and enhanced background checks. However, it should be noted thatcompliance with the provisions for the establishment of identity and trustworthiness under
Part-IS does not constitute compliance with the provisions on background checks as defined inRegulation (EU) 2015/1998.

IS.I.OR.245 Record-keeping
Regulation (EU) 2023/203(a)

The organisation shall keep records of its information security management activities(1)

The organisation shall ensure that the following records are archived and traceable:(i)any approval received and any associated information security risk assessment inaccordance with point IS.I.OR.200(e;)(ii)

contracts for activities referred to in point IS.I.OR.200(a)(9);(iii)

records of the key processes referred to in point IS.I.OR.200(d);(iv)

records of the risks identified in the risk assessment referred to in point IS.I.OR.205
along with the associated risk treatment measures referred to in point IS.I.OR.210;

Powered by EASA eRules

Page 148 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

(b)

(v)

records of information security incidents and vulnerabilities reported inaccordance with the reporting schemes referred to in points IS.I.OR.215 andIS.I.OR.230;(vi)

records of those information security events which may need to be reassessed toreveal undetected information security incidents or vulnerabilities.

(2)

The records referred to in point (1)(i) shall be retained at least until 5 years after theapproval has lost its validity.

(3)

The records referred to in point (1)(ii) shall be retained at least until 5 years after thecontract has been amended or terminated.

(4)

The records referred to point (1)(iii), (iv) and (v) shall be retained at least for a period of
5 years.

(5)

The records referred to in point (1)(vi) shall be retained until those information security
events have been reassessed in accordance with a periodicity defined in a procedure
established by the organisation.

The organisation shall keep records of qualification and experience of its own staff involved in
information security management activities(1)

The personnel’s qualification and experience records shall be retained for as long as the
person works for the organisation, and for at least 3 years after the person has left theorganisation.

(2)

Members of the staff shall, upon their request, be given access to their individual records.
In addition, upon their request, the organisation shall provide them with a copy of theirindividual records on leaving the organisation.

(c)

The format of the records shall be specified in the organisation’s procedures.

(d)

Records shall be stored in a manner that ensures protection from damage, alteration and theft,with information being identified, when required, according to its security classification level.
The organisation shall ensure that the records are stored using means to ensure integrity,
authenticity and authorised access.

GM1 IS.I.OR.245 Record-keeping
ED Decision 2023/009/R

Records are required to document results achieved or to provide evidence of activities performed.
Records become factual when recorded and cannot be modified. Therefore, they are not subject toversion control. Even when a new record is produced covering the same issue, the previous record
remains valid.
The ‘approval received’ referred to in point (a)(1)(i) includes any ‘certificate’ received by theorganisation when it is provided for by the implementing rule for its domain.

Powered by EASA eRules

Page 149 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

AMC1 IS.I.OR.245(a)(1)(vi)&(a)(5) Record-keeping
ED Decision 2023/009/R

When complying with the requirements under points (a)(1)(vi) and (a)(5), the organisation should
establish a data retention policy defining procedures to:(a)manage relevant security data files;(b)establish the periodical assessment of their content; and(c)define the criteria to allow deletion of records of information security events when the objectiveof the requirement under (a)(5) has been met.

GM1 IS.I.OR.245(a)(1)(vi)&(a)(5) Record-keeping
ED Decision 2023/009/R

The objective of the requirement under (a)(1)(vi) is to ensure detection of possible indication of
information security incidents or vulnerabilities which are not obvious by normal operation (e.g.
previously unknown situations), while the objective of the requirement under (a)(5) is to allow thenecessary flexibility to control the volume of the stored information security events.
Records of information security events include those events identified to be within the scope of thedetection activities under IS.I.OR.220(a), as well as other information security data produced by assetsthat have been identified under IS.I.OR.205.
A data retention policy clarifies what information should be stored or archived and for how long. Someguidance about data retention can be found in EUROCAE ED-206, Chapter 2.6.
Once a data set completes its retention period, it can be deleted or moved as permanent historical
data to a secondary or tertiary storage.

AMC1 IS.I.OR.245(c)&(d) Record-keeping
ED Decision 2023/009/R

When complying with the requirements under points (c) and (d) for all the records required by points
IS.I.OR.245 (a) and (b), the organisation should consider the following:(a)

Records should be kept in paper form or in electronic format or a combination of both media.
The records should remain accessible whenever needed within a reasonable time and usable
throughout the required retention period. The retention period starts when the record has beencreated.

(b)

Records data integrity, availability and authenticity should be protected in consistency withprotection of corresponding operational data, and as such, should be within the scope of the
ISMS.

(c)

Storage systems should be protected against unauthorised access (i.e. data leakage attempts
against personal data/modification of records) and thus should have information security
measures implemented in consistency with the level of information security risk associated with
them.

(d)

Once records are not required to be retained anymore, the destruction of records anddecommissioning of assets used for their storage should be implemented appropriately.

Powered by EASA eRules

Page 150 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.245(c)&(d) Record-keeping
ED Decision 2023/009/R

RECORDS ACCESSIBILITY THROUGHOUT THE RETENTION PERIOD

It is recommended to follow best practices for data retention and, for data that may need to berestored, backup strategies, such as the use of automated backup tools, segregation or geographic
separation of backup storage location(s), and to consider offline backups to prevent ransomware risks.
These practices should be considered also when record-keeping is contracted to service providers with
distributed resources.
Special attention should be paid to significant hardware and software changes, ensuring that storeddigital records remain accessible and readable (e.g. file system, application file format, forward
compatible database versions, etc.). Paper-based information needs to be archived in an adequate
environment, in which records are protected against degradation factors (e.g. excessive heat, light or
humidity).
RECORDS DATA INTEGRITY AND PROTECTION FROM UNAUTHORISED ACCESS

A commonly used method to achieve authenticity and integrity protection is the use of digital
signatures at document level. Digital signatures can be added to the document’s file (e.g. PDF) toensure that a record has not been modified by someone other than its author (integrity) and that theauthor is who is expected to be (authenticity).
Moreover, to prevent unauthorised access, records can be protected, for example, by implementing
a role-based access control (RBAC) approach, or certain records can be password protected at the filelevel. Commercial applications feature built-in basic password protection functions for their fileformats. Access protection can also be achieved by protecting the environment where the individual
records are stored (e.g. access protection on databases, file shares, directories, etc.).

IS.I.OR.250 Information security management manual (ISMM)
Regulation (EU) 2023/203(a)

The organisation shall make available to the competent authority an information security
management manual (ISMM) and, where applicable, any referenced associated manuals andprocedures, containing:(1)a statement signed by the accountable manager confirming that the organisation will at
all times work in accordance with this Annex and with the ISMM. If the accountable
manager is not the chief executive officer (CEO) of the organisation, then the CEO shallcountersign the statement;(2)

the title(s), name(s), duties, accountabilities, responsibilities and authorities of theperson or persons defined in point IS.I.OR.240(b) and (c);(3)

the title, name, duties, accountabilities, responsibilities and authority of the common
responsible person defined in point IS.I.OR.240(d), if applicable;(4)

the information security policy of the organisation as referred to in point
IS.I.OR.200(a)(1);(5)

a general description of the number and categories of staff and of the system in place toplan the availability of staff as required by point IS.I.OR.240;

Powered by EASA eRules

Page 151 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](6)

the title(s), name(s), duties, accountabilities, responsibilities and authorities of the key
persons responsible for the implementation of point IS.I.OR.200, including the person or
persons responsible for the compliance monitoring function referred to in point
IS.I.OR.200(a)(12);(7)

an organisation chart showing the associated chains of accountability and responsibility
for the persons referred to in points (2) and (6);(8)

the description of the internal reporting scheme referred to in point IS.I.OR.215;(9)the procedures that specify how the organisation ensures compliance with this Part, andin particular:(i)the documentation referred to in point IS.I.OR.200(c;)(ii)

the procedures that define how the organisation controls any contracted activities
as referred to in point IS.I.OR.200(a)(9);(iii)

the ISMM amendment procedure referred to in in point (c);(10) the details of currently approved alternative means of compliance.
(b)

The initial issue of the ISMM shall be approved and a copy shall be retained by the competentauthority. The ISMM shall be amended as necessary to remain an up-to-date description of the
ISMS of the organisation. A copy of any amendments to the ISMM shall be provided to thecompetent authority.

(c)

Amendments to the ISMM shall be managed in a procedure established by the organisation.
Any amendments that are not included within the scope of this procedure and any amendments
related to the changes referred to in point IS.I.OR.255(b) shall be approved by the competentauthority.

(d)

The organisation may integrate the ISMM with other management expositions or manuals it
holds, provided there is a clear cross reference that indicates which portions of the
management exposition or manual correspond to the different requirements contained in thisAnnex.

GM1 IS.I.OR.250(a) Information security management manual(ISMM)ED Decision 2023/009/R

The organisation may choose to document some of the information required under point
IS.I.OR.250(a) in separate documents (e.g. procedures). In this case, it should ensure that the manualcontains adequate references to any document kept separately. Any such documents are then to beconsidered an integral part of the organisation’s information security management system manual.
In the event where an entity holds multiple authorisations or declarations, the ISMM may apply to
one or more organisations at a time based on a common ISMS. This ISMM should include at least an
approval document of each organisation and should formally be approved by each organisation’s
accountable manager or responsible person. A common responsible person may be appointed as per
IS.I.OR.240(d) and the guidelines of GM1 IS.I.OR.240(e).

Powered by EASA eRules

Page 152 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

To ensure that all parties involved can fulfil their responsibilities, all manuals, procedures, andcommunication between them are advised to be, at least, in one common language, e.g. English.
Those parties involved include the competent authorities with which that common language shouldbe agreed upon.

IS.I.OR.255 Changes to the information security management
systemRegulation (EU) 2023/203(a)Changes to the ISMS may be managed and notified to the competent authority in a proceduredeveloped by the organisation. This procedure shall be approved by the competent authority.

(b)With regard to changes to the ISMS not covered by the procedure referred to in point (a), theorganisation shall apply for and obtain an approval issued by the competent authority.
With regard to those changes:(1)

the application shall be submitted before any such change takes place, in order to enable
the competent authority to determine continued compliance with this Regulation and toamend, if necessary, the organisation certificate and related terms of approval attached
to it;(2)the organisation shall make available to the competent authority any information it
requests to evaluate the change;(3)

the change shall be implemented only upon receipt of a formal approval by thecompetent authority;(4)

the organisation shall operate under the conditions prescribed by the competentauthority during the implementation of such changes.

AMC1 IS.I.OR.255 Changes to the information security management
systemED Decision 2023/009/R

Without prejudice to the communication of changes as required for each organisation in thecorresponding implementing regulation for the domain as listed in point Article 2(1) of Regulation (EU)2023/203, the procedure referred to in IS.I.OR.255(a)(1) should take into account the criticality of thechanges when proposing how they will be managed. In particular, those changes that could have an
impact on the achievement or maintenance of compliance with the provisions under Part-IS, or which
could lead to an unacceptable level of risk (e.g. as per the guidance provided in GM1 IS.I.OR.205(c)),
should be subjected to scrutiny. Upon establishment of this procedure, any further changes to it
should be subject to approval by the competent authority.
Where prior approval is sought from the competent authority for a change not covered by anapproved procedure, or where no such approved procedure exists, the organisation should provide atleast the following information:—

the nature and purpose of the change;—

the implementation plan of the change;—

the verification plan of the change;

Powered by EASA eRules

Page 153 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]—

the potential impact on aviation safety introduced by the change.

A significant deviation from the original implementation plan during the change process is an eventthat should be reported to the competent authority as this deviation may require reconsidering thechange impact.

GM1 IS.I.OR.255 Changes to the information security management
systemED Decision 2023/009/R

Point IS.I.OR.255 is structured as follows:
Point (a) introduces the possibility for the organisation to agree with the competent authority thatchanges to the ISMS can be implemented without prior approval as long as these changes are covered
in a change procedure.
Point (b) introduces an obligation of prior approval (by the competent authority) for changes notcovered by the procedure mentioned above, and indicates how those changes should be handled.
The organisation should consider the establishment of a procedure in order to manage and notify
changes to the competent authority as provided for under IS.I.OR.255(a). In case of lack of any
approved procedure, the organisation will have, for any change, to apply for and obtain an approval
as required under IS.I.OR.255(b). In any case, all changes should be notified to the competentauthority upon implementation.

GM2 IS.I.OR.255 Changes to the information security management
systemED Decision 2023/009/R

RELATION BETWEEN CHANGES TO THE ISMS AND CONTINUOUS IMPROVEMENT

Changes stemming from the continuous improvement process established by the organisation (seeIS.I.OR.260) should be handled as any other change according to the guidelines in AMC1 IS.I.OR.255
and GM1 IS.I.OR.255.
EXAMPLE OF CHANGES THAT MAY HAVE AN IMPACT ON THE ISMS

Below are some examples of changes that may have an impact on the ISMS, or which could lead to an
unacceptable level of risk and therefore should be subject to scrutiny by the competent authority
according to the provisions established under IS.I.OR.255:(a)Changes to the scope of the ISMS, interfaces or related policies:—

The organisation expands its business functions, and integrates another company within
its organisational structure.

—

The organisation has identified non-conformities indicating an incorrect scope.

—

The organisation amends its information security policy and/or information security
objectives with a potential impact on aviation safety.

—

Changes to the interfaces of the organisation resulting e.g. from modification in theinsourced or outsourced activities.

Powered by EASA eRules

Page 154 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

(b)

(c)

(d)

Changes in responsibilities and accountability as well as in the organisational structure involving
the implementation and continuing monitoring of compliance with this Regulation:—

The accountable manager has delegated certain responsibilities under Part-IS to a person
or a group of persons.

—

The organisation contracts information security management activities as per
IS.I.OR.235.

Changes to the methodology used for risk management:—

The organisation changes the classification for likelihood or impact in their risk
management methodology e.g. to obtain more granularity.

—

The organisation implements changes to their risk treatment methodology.

—

The organisation integrates its information security risk management into existing
management systems.

Changes to the security event management process:—The organisation decides to contract security event management activities.

—

The organisation changes the process to notify security events and the criteria to escalate
to higher management for a quicker resolution.

—

The organisation changes its policy for mitigating vulnerabilities.

—

The organisation changes its incident recovery procedure.

EXAMPLE OF CHANGES THAT DO NOT HAVE AN IMPACT ON THE ISMS

Not all operational changes related to information security have an impact on the ISMS, therefore not
all changes are required to be reported to the competent authority, following the provisions
established under IS.I.OR.255. The following scenarios may be representative of such changes:—

After a successfully detected security event which could have easily evolved to an incident, theorganisation decides to roll out an extensive cyber security awareness campaign for all
employees.

—

Update in the staff training programme and/or training content as a result of the continuous
improvement processes established within the organisation.

—

The organisation replaces the software tool that it uses for encrypting sensitive files withanother software solution.

—

The organisation has decided to make an internal restructuring for business reasons, changing
the names of departments or sections, without making any changes in the responsibilities andaccountability (e.g. accountable manager) involving the ISMS of the organisation.

—

The organisation decides to update an existing preventive control e.g. configuring a new firewall
in its internal network.

Powered by EASA eRules

Page 155 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

IS.I.OR.260 Continuous improvement
Regulation (EU) 2023/203(a)

The organisation shall assess, using adequate performance indicators, the effectiveness andmaturity of the ISMS. That assessment shall be carried out on a calendar basis predefined by
the organisation or following an information security incident.

(b)

If deficiencies are found following the assessment carried out in accordance with point (a), theorganisation shall take the necessary improvement measures to ensure that the ISMS continues
to comply with the applicable requirements and maintains the information security risks at an
acceptable level. In addition, the organisation shall reassess those elements of the ISMS
affected by the adopted measures.

AMC1 IS.I.OR.260 Continuous improvement
ED Decision 2023/009/R

The continuous improvement process (CIP), as required by IS.I.OR.200(b), should aim to continuously
improve the effectiveness, suitability and adequacy of the ISMS. This should be achieved by a proactive
and systematic assessment of the ISMS and all its elements — including its maturity. The assessment
should take into account the outcomes and conclusions of other information security and assurance
processes including audits, management reviews, evaluation of performance, effectiveness andmaturity, as well as the outcomes of the derived corrective actions and corrections.
The steps to be performed should be at least the following:(a)

Identification of improvement opportunities based on the outcomes of the assessment of the
ISMS with respect to its suitability, effectiveness, adequacy and, if deemed necessary,
efficiency, as well as on any other suggestion for improvement. The assessment should consider
performance indicators which reflect its processes and elements and the defined objectives for
effectiveness and maturity.

(b)

Evaluation of the identified opportunities regarding cost benefit, absence or reduction ofundesired effects and achievement of the targeted objectives and intended outcomes.

(c)Proposal on the evaluated improvement opportunities to the management, andrecommendation of actions to support their review and decision-making.

(d)According to the decision taken under point (c), planning, development and implementation ofactions and changes to the ISMS, its processes or elements to achieve the improvements.

(e)

Evaluation the effectiveness of the implemented actions and ISMS changes, and, as applicable,
verification that the root cause of identified deficiencies has been eliminated.

The management should assess and review the outcomes of the CIP at planned intervals to ensure thecontinuing effectiveness, adequacy and suitability of the ISMS, to decide on the prioritisation of theimplementation of actions and changes, as well as to revise or set new objectives or targets forcontinuous improvement.

Powered by EASA eRules

Page 156 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

GM1 IS.I.OR.260 Continuous improvement
ED Decision 2023/009/R

Point IS.I.OR.260 covers assurance processes for the ISMS in a manner that can be considered
equivalent to the safety assurance in ICAO Doc 9859 ‘Safety Management Manual (SMM)’, which
includes performance monitoring and measurement, management of change and continuous
improvement of the SMS.
In this Regulation:—

IS.I.OR.260(a) addresses, using adequate performance indicators, the effectiveness andmaturity assessment of the ISMS;—

IS.I.OR.260(b) addresses the improvement measures, i.e. corrections and corrective actions, forthe deficiencies detected in IS.I.OR.260(a) and the continuous improvement process.

Similar provisions for continuous improvement are provided for in other information management
systems such as ISO/IEC 27001 (see Appendix II to this document).
The context and risk environment of organisations are never static and therefore require a dynamic
adaptation, evolution and change of the organisation’s objectives, architectures, organisational
structures and processes to maintain the information security risks at an acceptable level.
Consequently, the ISMS should be considered as an evolving and learning part/element of theorganisation which needs to be continuously monitored and improved to ensure alignment with theorganisation’s safety objectives and effectiveness.
The CIP aims to continuously improve the effectiveness, suitability, adequacy and, if deemednecessary, the efficiency of the ISMS. An organisation may integrate the Part-IS CIP in some otheralready operated CIP and may apply methods such as Plan-Do-Check-Act (PDCA) Cycle or DefineMeasure-Analyse-Improve-Control (DMAIC) (see also GM1 IS.I.OR.200).
The CIP is based on a proactive and systematic assessment of the ISMS and all its elements including
the information security processes and controls driven by the ISMS. The assessment should be carriedout against organisational targets for desired levels of performance, effectiveness and maturity. Thesetargets, besides ensuring the achievement of compliance with the requirements under this Regulation,
may also aim to include objectives established by the organisation’s policy or standards and by
management decisions.
The above-mentioned assessment is based on the outcome of performance evaluations, audits, risk
and incident processes, as well as already applied corrections and corrective actions. Some factorsthat should be considered when performing the assessment are the following:—

Adequacy refers to whether the system establishes the disciplines needed to manage
information security, e.g. by using broadly accepted industry standards, in a sufficient mannerwith regard to compliance with the requirements of this Regulation.

—

Effectiveness of the ISMS and the effective implementation of processes and controls driven
by the ISMS is assessed by analysing whether:—

the information security risks are managed to achieve the safety objectives;—

the intended outcomes of the ISMS are achieved, and the requirements or objectives aremet;—

all types of deficiencies are managed including failures to fulfil or correctly implement a
requirement or control.

Powered by EASA eRules

Page 157 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]—

Efficiency of the ISMS refers to the implementation of streamlined processes; however,efficiency improvements should not adversely impact effectiveness.

Identification of improvement opportunities
Improvement opportunities may be identified from the results of the CIP assessment or may beintroduced as suggestions from other sources. The identification often involves deviations orcorrective actions as well as ineffective processes or controls which are not remediated.
Suggestions for improvements stem from sources including:—

Risk management: the results of regular risk analysis and subsequent risk treatment are a
primary factor in improving the ISMS, where the risk treatment process involves monitoring of
the implemented security measures and evaluating their effectiveness.

—

Performance & effectiveness evaluation: conclusions from (key) performance indicators, theirmeasurement, analysis and continued monitoring as well as the result of the assessment of theeffectiveness including the outcomes of the subsequently applied corrections and corrective
actions—

Evaluation of maturity including the results of the subsequent corrections and corrective actions—

Lessons learned from the security incident detection, handling and response process and froma potential treatment of a root cause—

Results of (internal) audits may be used to verify whether the ISMS and controls within the audit
scope meet the organisation’s requirements, and to determine where there are potential areas
for improvement.

—

Review and evaluation by management of the current action plan, setting or revision of theobjectives or decision on improvement opportunities and actions—

Organisation’s suggestion programme (suggestions for improvement), reviews, surveys orassessments with employees or feedback from suppliers or interfacing parties

Any outcome of this process should be documented. The resulting actions may be integrated into an
overarching action plan which is centrally consolidated and periodically reviewed according to therelevant policies. The resulting action plan may be further divided into a tactical, short-/mid-term
action plan and a strategic, long-term action plan.

AMC1 IS.I.OR.260(a) Continuous improvement
ED Decision 2023/009/R(a)

ISMS EFFECTIVENESS EVALUATION
When complying with IS.I.OR.260(a), the organisation should have a process in place to monitor,
measure, evaluate and review the effectiveness of its ISMS that defines:(1)

who monitors, measures, analyses and evaluates the results and takes accountable
decisions;(2)

when the above steps should be performed;

Powered by EASA eRules

Page 158 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](3)

which methods for monitoring, measurement, analysis and evaluation are applied toensure comparable and reproducible results.

The calendar basis of the assessments should be commensurate with the maximum level of risk
established under IS.I.OR.205.
The process to monitor, measure, evaluate and review the effectiveness of the organisation’s
ISMS referred to under AMC1 IS.I.OR.260(a) should include as a minimum:

(b)

(1)

the gathering and retention of metrics of the activities, and additional information that
could be useful for monitoring purposes;(2)

the analysis of the metrics in order to identify trends and deviations from predefined
performance targets.

ISMS MATURITY ASSESSMENT
The organisation should assess the maturity of its ISMS using a suitable maturity model in order
to identify areas for improvement to the ISMS. To do so, the organisation should:

(c)

(1)

define or adopt a maturity model which represents a set of important and relevant
processes and capabilities that are expected to be implemented and maintained;(2)

for each assessed process or capability, ensure that the model defines criteria against
which specific aspects, characteristics and effectiveness should be assessed andevaluated when determining a maturity level;(3)

define for each assessed process or capability its desired target maturity level.

For each assessed information security process or capability contained in the maturity model,
the organisation should:(1)

evaluate and justify the current maturity level;(2)

identify any area for improvement it should make to reach the targeted maturity level;(3)collect and record the evidence regarding strengths and weaknesses of the implemented
ISMS and its evaluated maturity.

GM1 IS.I.OR.260(a) Continuous improvement
ED Decision 2023/009/R(a)As general guidance, the elements of the ISMS that should be monitored, measured andevaluated should be, as a minimum:(1)

the risk assessment and treatment process (including risks at the interfaces with otherorganisations);(2)

the management of non-conformities and corrective actions;(3)

the incident and vulnerability management;(4)

the personnel competence management.

Powered by EASA eRules

Page 159 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](b)

Existing maturity models for ISMS maturity evaluation
As general guidance, for the definition or the adoption of a maturity model (MM), the following
existing models may be considered:—

Cybersecurity Capability Maturity Model (C2M2), version 1.1: this model was publishedby the US Department of Energy in 2014. It introduces the notion of Maturity Indicator
Levels (MIL) ranging from 0 to 3 and addresses not only performance levels but also
performance practices (under Approach Objectives and approach progression) as well asassurance practices (under Management Objectives and institutionalization progression).

—

Systems Security Engineering – Capability Maturity Model (SSE-CMM): published by ISO
as ISO 21827 in 2008. It focuses on engineering practices, much less on operational
practices that are split in 11 ‘Security Base Practices’, and 11 ‘Project and Organizational
Base Practices’. It introduces the notion of five Capability Levels, from ‘Performed
Informally’ to ‘Continuously Improving’.

—

NIST Cybersecurity Framework (NIST CSF), version 1.1: published by NIST in April 2018.
Although it is not proposed as a MM, the framework defines four ‘Implementation Tiers’,
from ‘Partial’ to ‘Adaptive’, which are a qualitative measure of organisational
cybersecurity risk management practices. It focuses on the functionality and repeatabilityof cybersecurity risk management.

—

ATM Cybersecurity Maturity Model, edition 1: published in February 2019 by the
EUROCONTROL NM for organisations in the ATM domain. Whilst not being designed for
wider application, it can be adapted as necessary. It defines five maturity levels, ranging
from ‘Non-existent’ to ‘Adaptive’ inspired by the ‘Tier’ terminology from the NIST CSF. In
fact, the model is founded on NIST CSF, together with some elements of ISO/IEC 27001.

The following Table 1 maps the MM mentioned above to a hypothetical five-level MM.
Table 1: Mapping matrix of an existing MM to a hypothetical five-level MM
Mapping to a
five-level
MM

C2M2

Eurocontrol NM

ISO 21827

InitialMIL 0

Non-Existent

Performed
Informally

DefinedMIL 1 (Initial)

PartialPlanned & Tracked

Partial

Implemented

MIL 2 (Identified)DefinedWell defined

Risk-Informed

ManagedMIL 3 (Managed)

AssuredQuantitatively
Controlled

Repeatable

Adaptive

Continuously
Improving

Adaptive

Improved

Powered by EASA eRules

NIST CSF 1.1

Page 160 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

No specific maturity level is required. However, if and when compliance is achieved, organisations will
determine which requirements of which models have already been met (mandatory) and can opt toreach a level that is beneficial to the organisation (voluntary). In the longer term, achieving higher
maturity levels may increase the confidence of oversight authorities, which can have an impact upon
the level of oversight activities regarding such organisation.

AMC1 IS.I.OR.260(b) Continuous improvement
ED Decision 2023/009/R

When a deficiency is identified, the organisation should react in a timely manner following a definedprocess leading to a managed status regarding the deficiency, its associated consequences and, if
needed, the prevention of its future recurrence or occurrence elsewhere.
Based on an evaluation of the impact and extent of the deficiency and the potential consequences for
the ISMS, the process should include as criteria for compliance:(a)deciding on corrections and their implementation without undue delay in order to limit the
impact of the deficiency and deal with its consequences as well as, as applicable, to control or
eliminate it;(b)deciding on the need for, and the implementation of, corrective actions to eliminate thecause(s) of, and contributing factors to, the deficiency based on a root cause analysis and anevaluation of actions remediating the cause aimed at being proportionate to the consequences
and impact of the deficiency;(c)verifying the implemented actions:(1)

to be effective and to result in acceptable residual risks,(2)

not to have unintended side effects leading to other deficiencies, new risks, or an ISMS
not aligned with the applicable requirements, as well as(3)for corrective actions, to effectively remediate or eliminate the root cause;(d)reporting to and reviewing the identified deficiencies, action plan and results of the action takenwith the accountable manager of the organisation or delegated person(s) and, as necessary,with other involved or affected roles and parties;(e)documenting as evidence the detected deficiencies, the planned and implemented corrections
and/or corrective actions with deadlines and responsible persons, the management feedback,the outcomes of the process step under point (c) above and, if necessary, the change decisions
made for the ISMS itself.

GM1 IS.I.OR.260(b) Continuous improvement
ED Decision 2023/009/R

The ‘necessary improvement measures’ referred to in IS.I.OR.260(b) refer to correction or corrective
actions to eliminate deficiencies or actions aimed at improving the effectiveness as well as thematurity of the ISMS.
A process satisfying the criteria defined in AMC1 IS.I.OR.260 should include the following aspects:(a)identifying the extent, impact, context and triggers of the deficiency, evaluating it according tosome established criteria, analysing potential consequences for the ISMS including a potential
existence in other areas;

Powered by EASA eRules

Page 161 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR](b)

deciding on corrections and their implementation to immediately limit the impact and manage
the consequences of the deficiency as well as, as applicable, to control or eliminate it;(c)deciding on corrective actions required to eliminate the (root) cause(s) of the deficiency thatare proportionate to the consequences;(d)reassessing the elements of the ISMS which may be affected by the implemented actions toensure that no further risk is introduced;(e)verifying the implemented actions referred to in point (c) of AMC1 IS.I.OR.260(b);(f)

reporting to and reviewing the outcomes of the process steps with the management (see point(d) of AMC1 IS.I.OR.260(b));(g)

documenting and evidencing the result of the process steps above (see point (e) of AMC1
IS.I.OR.260(b)).

Powered by EASA eRules

Page 162 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Appendix I — Examples of threat scenarios with a potential harmful
impact on safety
ED Decision 2023/009/R

The following is a non-exhaustive list of examples of information security threat scenarios with apotential harmful impact on safety that may be considered by authorities and organisations.

Example 1: Aircraft to ATC digital communications———

Threat vector assets/domain—

ATC voice and ground automation systems—

ground communications providers—

air-ground/ground-air RF communications service providers—

aircraft and the assets used for voice and datalink communications

Non-exhaustive summary of potential threats—

threat (availability): exceeding system performance, saturation of communication
channel—threat (integrity): man-in-the-middle or injection attacks—

threat (confidentiality): passive listening to communication, spying on hardware device

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption of services prevents ATC communication with a single or multiple aircraft
and/or ATC ground system.

—

Manipulation of data through a man-in-the-middle attack would present false
information to the pilot and/or ATC system with the potential of creating a safety hazard
or injection of data to the aircraft or ground systems to disrupt the service and capability.

—

There are no specific regulatory requirements for encryption of data or voice for datalink
communications; however, for confidentiality purposes, the assets used to provide anddeliver the services should be controlled and limited to only those resources that require
access to ensure that the services cannot be disrupted and manipulated in any way.

Example 2: Tampered air traffic data—

Threat vector assets/domain—

Internet service provider (ISP)—ATM services network(s)—surveillance data—

ATC systems

Powered by EASA eRules

Page 163 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]——

Non-exhaustive summary of potential threats—

ISP compromise (confidentiality): An attacker gains unauthorised access to the systems
or infrastructure of the ISP providing network services to ATM system.

—

data tampering (integrity): Once the ISP is compromised, an attacker could manipulate
data in transit. This could involve injecting false data or removing/modifying legitimate
data.

—

denial of service (availability): an attacker could also potentially disrupt thecommunication of data entirely, resulting in a denial of service (DoS) to the ATM system.

—

malware injection (integrity/availability): An attacker could potentially use thecompromised ISP as a launching pad to inject malware into the systems, causing further
disruptions or enabling additional attacks.

Summary of threats scenarios and their potential harmful impacts on safety—

ISP compromise: interception and/or manipulation of sensitive data, impacting the safe
management of air traffic.

—

data tampering: incorrect situational awareness, potentially resulting in reduced
separation between aircrafts, and incorrect air traffic control decisions.

—denial of service: reduction of the ATC’s ability to ensure separation leading to theactivation of contingency procedures, including capacity reduction, with the eventual
possibility of large areas of airspace being closed.

Example 3: Aircraft operators’, CAMOs’ and aircraft maintenance organisations’ software supply
chain and ground infrastructure, including equipment used to support aircraft management,
operations and maintenance———Threat vector assets/domain—

aircraft operators’, CAMOs’ and maintenance organisations’ supply chain—

aircraft operator or maintenance internal ground infrastructure used to manage aircraftand operations (hardware/software) and other information technology assets—

information technology assets used to update systems on an aircraft (software andhardware) used for maintenance activities

Non-exhaustive summary of potential threats—

threat (availability): hardware/software/system disruption—

threat (integrity): compromised hardware/software/system—threat (confidentiality): compromised hardware/software/system

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption to the dissemination of meteorological information while the aircraft isairborne, may reduce the ability of the flight crew to avoid potentially hazardous
meteorological conditions (e.g. severe storms/fog at night).

—

Manipulation of navigation data/database will have the effect that flight plans andnavigation displays cannot be trusted.

Powered by EASA eRules

Page 164 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]—

Lack of control and access to information such as fleet maintenance programme or flightcrew planning affects the ability of organisations to maintain safe operations.

Application of bow-tie analysis to this example
Two coordinated bow-tie analyses of different risk dimensions are combined, as the ultimate interest
lies only in the aviation safety consequence.

Information security bow-tie analysis element
Information security threats1) hardware/software vulnerability exploitation:
disturbed system function2) hardware/software vulnerability exploitation:system integrity compromised3) hardware/software vulnerability exploitation:
confidentiality of information processed by system(s)compromised

Aviation safety bow-tie analysis element

Information security preventive barriers
Information security hazards & top events
1) disturbed system functionality (hazard) →disrupted/unreliable system functionality
2) system integrity compromised (hazard) → system
function unpredictable3) information disclosable (hazard) → undetectable
information exfiltration

Safety threats1) disrupted/unreliable system functionality
2) system function unpredictable3) undetectable information exfiltration

Information security mitigating barriers

Safety preventive barriers
1) Use of access controls for system administration2) etc.
Safety hazards & top events:
1) loss of system function (hazard) →in operational
maintenance system
2) loss of system function integrity (hazard) →systems operate with wrong information
3) loss of information confidentiality (hazard) →confidential maintenance and aircraft internals
information leaks
Safety mitigating barriers
1) use of back-up procedures to prevent faulty
maintenance actions
2) use of procedures to secure aircraft software
integrity

Information security consequences
1) loss of system function (= production system
down)2) loss of system function integrity (= some system
function wrong/inoperative)3) loss of confidentiality of information (= some
information can leak)

Safety consequences
1) faulty maintenance actions2) incorrectly completed maintenance actions3) exfiltration of information allows for identificationof vulnerabilities

Powered by EASA eRules

Page 165 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

4) disruption of aircraft systems, unpredictablesystem function, loss of major aircraft systems (suchas engine control)

Example 4: Design and production organisations’ software, supply chain, design and manufacturing
ground infrastructure———

Threat vector assets/domain—

design and production organisations’ supply chain for parts, hardware and software—

design and production organisations’ ground internal infrastructure used to manage
software/hardware used in the manufacturing and development of products that will be
used by aircraft manufacturers, operators or ATM/ANS ground automation systems(hardware/software) information technology assets—

design and production organisations’ information technology assets used by theircustomers to update systems on an aircraft (software/hardware) used for maintenance
operations or ATM/ANS ground automation systems

Non-exhaustive summary of potential threats—

threat (availability): systems used to store, transmit and exchange information are
rendered unavailable for essential operations through DoS attacks—

threat (integrity): systems used to store, transmit and exchange information arecompromised through man-in-the middle attacks—

threat (confidentiality): systems used to store, transmit and exchange information areaccessed by insider or external threats

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption of systems used to store, transmit and exchange information in a manner thatwould prevent the proper management of the aircraft and its systems and adversely
affect the operations of the aircraft—

Systems used to store, transmit and exchange information can no longer be considered
trusted. If they are not maintained at a level to ensure that all information exchange, dataand software can be considered trusted, both ground and aircraft operations are
disrupted.

—

Uncontrolled access to systems used to store, transmit and exchange information(including information that is received and exchanged with the supply chain) can provide
technical details that could be used to craft more sophisticated attacks targeting safetycritical systems.

Powered by EASA eRules

Page 166 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Example 5: Training system———

Threat vector assets/domain—

supply chain of all software and hardware that will be used in the training systems or
training devices (including flight simulators) used to train pilot or ATM/ANS groundsystems personnel—

internal infrastructure used in of all software and hardware that will be used in thedesign, manufacturing or production of products (hardware or software) that will be usedin aircraft or ATM/ANS ground systems—

management of internal operating domains and system of all software and hardware thatwill be used in the design, manufacturing or production of products (hardware orsoftware) that will be used in aircraft or ATM/ANS ground systems

Non-exhaustive summary of potential threats—

threat (availability): training systems or training devices are rendered unavailable bymeans of DoS attacks when they are needed to be used—threat (integrity): training systems or training devices are compromised through man-inthe middle attacks—

threat (confidentiality): functional models, information and data that are embedded intraining systems or training devices are accessed by insider or external threats

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption of training systems (hardware and software) will have an impact on theorganisations’ ability to maintain qualified staff. It would also prevent the aircraft and its
systems from being properly operated and affect maintenance operations for ATM/ANS
ground systems.

—

The training model or the failure modes and associated emergency conditions differ fromthe real aviation system behaviour and therefore induce inappropriate responses. If the
training systems cannot be trusted, this will affect the ability of organisations to maintainsufficiently qualified staff for their operations (pilots, maintenance or ATM/ANS groundpersonnel who have been exposed to improper training should be re-qualified).

—

Lack of control and access to training systems affects the ability of organisations tomaintain a training system that is known to be in a trusted state. In addition, uncontrolled
access to training systems that embed functional models, information and data canprovide technical details that could be used to craft more sophisticated attacks on the
training system itself or on the real-world safety-critical system.

Example 6: Airport’s fuel delivery system and associated infrastructure—

Threat vector assets/domain—

ground fuel storage and distribution infrastructure—

digital systems used to control fuel pumping and metering

Powered by EASA eRules

Page 167 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

—

—

—

supply chain for fuel delivery, including third-party fuel suppliers—

airport information technology assets used for fuel inventory management andscheduling deliveries

Non-exhaustive summary of potential threats—

threat (availability): disruption of fuel supply or delivery systems—

threat (integrity): tampering with fuel control systems or measurement devices—

threat (confidentiality): unauthorised access to fuel supply and delivery data

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption to fuel delivery can lead to flight delays or cancellations, causing operational
disruptions and potential safety issues if fuel reserves become critically low.

—

Tampering with fuel control systems or measurement devices could lead to incorrect fuelloads being delivered to aircraft, impacting aircraft weight and balance calculations, andpotentially causing fuel exhaustion incidents.

—

Unauthorised access to fuel supply data could allow threat actors to manipulate fuelscheduling or inventory data, potentially causing disruptions to airport operations andfuel availability for aircraft.

Example 7: National competent authority’s NOTAM system and associated infrastructure———

Threat vector assets/domain—

National NOTAM system infrastructure and digital interface—

Supply chain for NOTAM system maintenance and updates—

National competent authority’s IT assets used for NOTAM creation, distribution, andstorage

Non-exhaustive summary of potential threats—

threat (availability): disruption of the NOTAM system or its access—threat (integrity): tampering with NOTAM data or unauthorised NOTAM creation—

threat (confidentiality): unauthorised access to NOTAM data

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption to the NOTAM system could prevent the dissemination of critical aeronauticalinformation to pilots and air traffic controllers, potentially leading to safety issues.

—

Tampering with NOTAM data or unauthorised creation of NOTAMs could lead to incorrect
information being disseminated, potentially resulting in pilots making decisions based on
false or misleading data.

—

Unauthorised access to NOTAM data could lead to information leakage, potentiallyrevealing sensitive operational information.

Powered by EASA eRules

Page 168 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Example 8: Aviation authority’s airworthiness directive (AD) system and associated infrastructure———

Threat vector assets/domain—

EASA AD system infrastructure and digital interface—

supply chain for AD system maintenance and updates—

EASA IT assets used for AD creation, distribution, and storage

Non-exhaustive summary of potential threats—

threat (availability): Disruption of the AD system or its access—threat (integrity): tampering with AD data or unauthorised AD creation—

threat (confidentiality): unauthorised access to AD data

Summary of threats and their potential harmful impacts on safety—

Disruption to the AD system could prevent the dissemination of critical airworthinessinformation to aircraft operators and maintenance organisations, potentially leading tosafety issues.

—

Tampering with AD data or unauthorised creation of ADs could lead to incorrect
information being disseminated, potentially resulting in aircraft operators andmaintenance organisations making decisions based on false or misleading data.

—

Unauthorised access to AD data could lead to information leakage, potentially revealing
sensitive operational information.

Powered by EASA eRules

Page 169 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Appendix II — Main tasks stemming from the implementation ofPart-IS, including mapping to NIST CSF 1.1 competencies andISO/IEC 27001 clauses and controls
ED Decision 2023/009/R

Activity typePart-IS main task

Establish andoperate an
information security
management system(ISMS)
Establish the scopeof the ISMS
according to Part-IS
requirements
Implement andmaintain an
information security
policyIdentify and review
information security
risks
Implement
information security
risk treatment
measures
Implement measures
to detect information
security events andidentify those related
to aviation safety
Implement measuresthat have been
notified by thecompetent authority
Take appropriate
remedial actions toaddress findings
notified by thecompetent authority(non-compliances)

ReferenceManagement,
Operational

Part-ISManagement

IS.I.OR.200(a)NIST CSF Version
1.1

ISO/IEC 27001

Function

CategoryParagrap
h Clause

IDENTIFY

ID.RM

4
6.1.1

4.3

Management

IS.I.OR.205(a)IDENTIFY

ID.BE-2
ID.BE-4
ID.AM5

Management

IS.I.OR.200(a)(1)

IDENTIFY

ID.GV1

5.2

Management

IS.I.OR.200(a)(2)
IS.I.OR.205

IDENTIFY

ID.GV4
ID.RA

6.1.2
8.1
8.2

Management

IS.I.OR.200(a)(3)
IS.I.OR.210

PROTECT

PR.PT

6.1.3
8.1
8.3

DETECT

DE.AE3
DE.CM1
DE.CM2
DE.CM3Annex A Control
:2013
:2022

A5.1

A5.1

A11.1.2

Management

IS.I.OR.200(a)(5)
IS.I.OR.220

Operational

IS.I.OR.200(a)(6)

10.1

A6.1.3

A5.5

Both

IS.I.OR.200(a)(7)
IS.I.OR.225

10.1

A6.1.3

A5.5

Powered by EASA eRules

A12.4.1
A12.4.3
A16.1.7

A7.2
A8.15
A5.28

Page 170 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Activity typePart-IS main task

Management,
Operational

Reference

Part-ISNIST CSF Version
1.1
CategoryParagrap
h Clause

7.4

A6.1.3
A16.1.2
A16.1.3

A5.5
A6.8

9.2

A18.2.1
A18.2.2

A5.35
A5.36

A8.2.2
A13.2

A5.13
A5.14

4.4
9.1
9.3
10.1
10.2

A5.1.2
A16.1.7
A17.1.3
A18.2.1

A5.1
A5.28
A5.29
A5.35

4.2
5.2
5.3

A5.1
A6.1.1

A5.1
A5.2

Implement an
external information
security reporting
schemeManagement

IS.I.OR.200(a)(8)
IS.I.OR.230

RESPOND

Monitor compliancewith this Regulation
and report findings
to top management

Operational

IS.I.OR.200(a)(12)

IDENTIFY

ID.GV3Operational

IS.I.OR.200(a)(13)

PROTECTIDENTIFY
Implement andmaintain acontinuous
improvement
process to measure
the effectiveness andmaturity of the ISMS
and strive to improveit

PROTECT

Management

IS.I.OR.200(b)IS.I.OR.260

DETECTRESPONDRECOVERIDENTIFY
Document andmaintain all key
processes,
procedures, roles
and responsibilities

Management

IS.I.OR.200(c)PROTECT

Powered by EASA eRules

Annex A Control
:2013
:2022

Function

RS.CO2
RS.CO3
RS.CO4
RS.CO5

Protect
confidentiality of
exchanged
information

ISO/IEC 27001

PR.DS1
PR.DS2
ID.RA-6
ID.SC-4
PR.IP-7
PR.IP10DE.DP5
RS.MI3
RS.IM2
RC.IM2
ID.AM6
ID.GV4
ID.RM1
ID.SC-1
ID.SC-2
PR.AT2
PR.AT4PR.AT5

Page 171 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Activity typePart-IS main task

Management,
Operational

Reference

Part-ISNIST CSF Version
1.1
Function

Category

ISO/IEC 27001
Paragrap
h Clause

Annex A Control
:2013
:2022

PR.IP12DETECTRESPOND

Identify all elements
which could be
exposed to
information security
risks
Identify theinterfaces with otherorganisations which
could result in
exposure to
information security
risks
Identify information
security risks andassign a risk level
Review and update
the risk assessment
based on certain
criteria
Organisations under
Subpart C of Annex
III (PartATM/ANS.OR) to
Regulation (EU)2017/373 share thesafety support
assessment

Management

Management

IS.I.OR.205(a)IS.I.OR.205(b)IDENTIFY

DE.DP1
RS.CO1
RS.AN5
ID.AM1
ID.AM2
ID.AM4
ID.AM5IDENTIFY

ID.BE-1
ID.BE-2
ID.BE-4
ID.BE-5

4.3

6.1.2

8.2

Management

IS.I.OR.205(c)IDENTIFY

ID.RA-1
ID.RA-2
ID.RA-3
ID.RA-4
ID.RA-5

Operational

IS.I.OR.205(d)IDENTIFY

ID.RM

Operational

IS.I.OR.205(e)Powered by EASA eRules

4.3

A8.1.1

A5.9

A5.7

Page 172 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Activity typePart-IS main task

Develop andimplement measures
to address risks andverify theireffectivenessCommunicate theoutcome of the risk
assessment tomanagement, otherpersonnel and otherorganisations sharing
an interface
Establish an internal
information security
reporting scheme toenable the collectionand evaluation of
information security
events frompersonnel
Ensure that
contractedorganisations report
information security
eventsAnalyse internallyreported occurrences
to identify
information security
events, incidents,and vulnerabilities

Implement measures
to detect inprocesses andoperations

ReferenceManagement,
Operational

Part-ISOperational

IS.I.OR.210(a)Operational

Management

Management

Operational

Operational

Powered by EASA eRules

NIST CSF Version
1.1
Function

CategoryParagrap
h Clause

PROTECT

PR.IP
PR.PT

6.1.3
8.3

IDENTIFY

ID.AM3
ID.BE-1
ID.BE-2
ID.BE-4
ID.RM3
ID.SC-3

IS.I.OR.210(b)IS.I.OR.200(a)(4)
IS.I.OR.215(a)IS.I.OR.215(e)IS.I.OR.215(c)Annex A Control
:2013
:2022

8.1

PROTECT

PR.IP-7

IDENTIFY

ID.AM3

7.4

A16.1.1
A16.1.2

A5.28
A6.8

RESPOND

RS.CO2
RS.CO4

7.4

A15.1.1
A16.1.2

A5.19
A6.8

IDENTIFY

ID.RA-1
A12.6.1
A16.1.1
A16.1.4

A8.8
A5.24
A5.25

A11.1.2
A12.4.1
A12.6.1
A16.1.1

A7.2
A8.8
A8.15
A8.16

IS.I.OR.215(b)(1)-(b)(3)

IS.I.OR.220(a)ISO/IEC 27001

DETECT

DE.AE2DE.AE3DE.AE5

DETECT

DE.AE
DE.CM
DE.DP

Page 173 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Activity typePart-IS main task

information security
events which may
have a potential
impact on aviation
safetyImplement measures
to respond to
information security
events that may
cause an information
security incident
Cooperate on
investigations withother organisations
that contribute to
the information
security of its own
activities
Implement measures
to recover frominformation security
incidents
Manage risks
associated with
contracted activities
with regard to the
management of
information security
Create and maintaina process to ensurethat there issufficient personnel
to perform allactivities regarding
information security
management
Create and maintaina process to ensurethat the personnel
have the necessarycompetence foractivities regarding
information security
management

Management,
Operational

Operational

Management

Operational

Management

Management

Management

Powered by EASA eRules

Reference

Part-IS

IS.I.OR.220(b)IS.I.OR.215(d)IS.I.OR.220(c)IS.I.OR.235

IS.I.OR.240(f)NIST CSF Version
1.1

ISO/IEC 27001

Category

PROTECT

PR.PT1RESPOND

RS.RP
RS.AN
RS.MI

A16.1.5

A5.26

RESPOND

RS.AN3
RS.AN5

A15.1.2
A15.1.3
A16.1.7

A5.20
A5.21
A5.28

RECOVERRC.RP1
RC.IM1

A16.1.5
A16.1.6

A5.26
A5.27

IDENTIFY

ID.SC-1
ID.SC-2

A15.1
A15.2

A5.19
A5.20
A5.21
A5.22

IDENTIFY

ID.AM5
ID.AM6
ID.GV2

7.1

A6.1.1

A5.2

IDENTIFY

ID.AM5
ID.AM67.2

A7.2.2

A6.3

IS.I.OR.240(g)PROTECT

Paragrap
h Clause

Annex A Control
:2013
:2022
A16.1.2
A5.24
A16.1.3
A5.25
A16.1.4
A5.26
A16.1.5
A6.8

Function

PR.AT1Page 174 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Activity typePart-IS main task

Create and maintaina process to ensurethat the personnel
acknowledge theresponsibilities
associated with theassigned roles andtasks
Verify the identity
and trustworthinessof personnel who
have access to
information systems

Management,
Operational

Management

Management

Reference

Part-IS

IS.I.OR.240(h)IS.I.OR.240(i)NIST CSF Version
1.1

Operational

IS.I.OR.245

Correct noncompliance findings
upon notification by
the competentauthority within the
period agreed withthe competentauthority

Operational

IS.I.OR.225

Powered by EASA eRules

Annex A Control
:2013
:2022

Function

CategoryParagrap
h Clause

IDENTIFY

ID.GV2
ID.GV3

7.3
7.4

A7.1.2

A6.2

PROTECT

PR.AC6
PR.IP117.1

A7.1.1

A6.1

7.5

A8.2.2A8.2.3
A11.1.3
A11.1.4
A12.1.3
A12.3.1
A12.4.1
A12.4.2
A12.4.3

A5.10
A5.13
A7.3
A7.5
A8.6
A8.10
A8.13
A8.15

10.1

A18.1.1
A18.2

A5.31
A5.35
A5.36

IDENTIFY

Archive, protect andretain records andensure they aretraceable for a
specified time

ISO/IEC 27001

PROTECT

ID.RA-4
PR.AC2
PR.AC3
PR.AC4PR.DS1
PR.DS4PR.DS5PR.DS6
PR.IP-4
PR.IP-6
PR.PT1Page 175 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Activity typePart-IS main task

Implement an
information security
reporting system inaccordance with
Regulation (EU)No 376/2014

ReferenceManagement,
Operational

Part-ISManagement

IS.I.OR.230(a)NIST CSF Version
1.1
Function

DETECT
Report information
security incidents orvulnerabilities to thecompetent authority
and, under certain
conditions, to others

Operational

IS.I.OR.230(b)IS.I.OR.230(c)RESPONDRECOVER

Regularly assess theeffectiveness andmaturity of the ISMS
Take actions toimprove the ISMS if
required. Reassess
the ISMS elements
affected by the
implemented
measures.
Ensure accessibilityof the competentauthority to thecontractedorganisation
Top management
ensures that allnecessary resources
are available tocomply with theRegulation
Top management
establishes andpromotes the

ISO/IEC 27001
Annex A Control
:2013
:2022

CategoryParagrap
h Clause

DE.DP3
RS.CO2
RS.CO3
RS.CO4
RS.CO5
RC.CO3

7.4

A16.1.1
A16.1.2
A16.1.3

A5.24
A6.8

Operational

IS.I.OR.260(a)9A5.1.2
A12.7.1
A16.1.6

A5.1
A5.27
A8.34

Operational

IS.I.OR.260(b)10A5.1.2

A5.1

Management

IS.I.OR.235(b)9.3

A6.1.3
A15.1
A15.2

A5.5
A5.20
A5.22

Management

IS.I.OR.240(a)(1)

IDENTIFY

ID.AM5
ID.AM67.1

A6.1.1

A5.2

Management

IS.I.OR.240(a)(2)&(a)(3)IDENTIFY

ID.GV1

5.1
5.2
7.4

A5.1.1
A7.2.1
A7.2.2

A5.1
A5.4
A6.3

Powered by EASA eRules

Page 176 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Activity typePart-IS main task

Management,
Operational

Reference

Part-IS

information security
policy anddemonstrates a basic
understanding of theRegulation
Appoint a
responsible person
or a group of persons
with appropriate
knowledge tomanage compliancewith the Regulation
Create and maintainan information
security
management manual(ISMM)Develop a procedureon how to notify thecompetent authority
upon changes to the
ISMSManage changes tothe ISMS and notify
the competentauthority and/or
request for approvalof changes

NIST CSF Version
1.1
Function

Category

PROTECT

PR.AT1
PR.AT4IDENTIFYManagement

IS.I.OR.240(b)IS.I.OR.240(c)IS.I.OR.240(d)PROTECT

ID.AM6
ID.GV2
PR.AT1
PR.AT4

ISO/IEC 27001
Paragrap
h Clause

Annex A Control
:2013
:2022

7.1
7.2

A6.1.1
A7.2.1
A7.2.2

A5.2
A5.4
A6.3

7.5.1

A6.1.3
A12.1.1

A5.5
A5.37

Management

IS.I.OR.250

Management

IS.I.OR.255(a)IDENTIFY

ID.AM37.4
7.5.1

A6.1.3
A13.2.1
A13.2.2

A5.5
A5.14

Management

IS.I.OR.255(a)IS.I.OR.255(b)IDENTIFY

ID.AM37.4

A6.1.3
A13.2.1
A13.2.2

A5.5
A5.14

Powered by EASA eRules

Page 177 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203
ANNEX II — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.I.OR]

Appendix III — Examples of aviation services
ED Decision 2023/009/R

The following is a non-exhaustive and non-complete list of aviation services that can be used as a basis
to identify the scope of risk assessment for the organisation.

aerodrome ATM-MET services provider
aeronautical digital map service
AIM (external)
airportAPP ACC
ATC (external)
ATC superiorATM
ATM-MET services provider
civil AU operations centre
communication infrastructure
ER ACCFIS/TIS data integrator
national AIM
navigation infrastructure — ground-basednavigation Infrastructure — satellite-based
non-ATM-MET services provider
non-aviation users (external)
regional AIM
regional ASM
regional ATFCM
state AU operations centre
static aeronautical data service
sub-regional DCB common service provision
sub-regional/local ATFCM
sub-regional/national ASM
surveillance infrastructure airport
surveillance infrastructure en-routesurveillance infrastructure TMA
time reference (external)
tower (TWR)

Powered by EASA eRules

Page 178 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203

ANNEX III — INFORMATION SECURITY — ANNEXES VI (PARTARA) AND VII (PART-ORA) TO REGULATION (EU) NO 1178/2011
For the consolidated version of Part-ARA and Part-ORA, please refer to the Easy Access Rules for
Aircrew (Regulation (EU) No 1178/2011).

Powered by EASA eRules

Page 179 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203

ANNEX IV — INFORMATION SECURITY — ANNEX I (PART 21) TO
REGULATION (EU) NO 748/2012
For the consolidated version of Annex I (Part 21) to Regulation (EU) No 748/2012, please refer to the
Easy Access Rules for Airworthiness and Environmental Certification (Regulation (EU) No 748/2012).

Powered by EASA eRules

Page 180 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203

ANNEX V — INFORMATION SECURITY — ANNEXES II (PARTARO) AND III (PART-ORO) TO REGULATION (EU) NO 965/2012
For the consolidated version of Part-ARO and Part-ORO, please refer to the Easy Access Rules for Air
Operations (Regulation (EU) No 965/2012).

Powered by EASA eRules

Page 181 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203

ANNEX VI — INFORMATION SECURITY — ANNEX II (PARTADR.AR) TO REGULATION (EU) NO 139/2014
For the consolidated version of Part-ADR.AR, please refer to the Easy Access Rules for Aerodromes(Regulation (EU) No 139/2014).

Powered by EASA eRules

Page 182 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203

ANNEX VII — INFORMATION SECURITY — ANNEXES II (PART145), III (PART-66) AND VC (PART-CAMO) TO REGULATION (EU) NO
1321/2014
For the consolidated version of Part-145, Part-66, and Part-CAMO, please refer to the Easy Access
Rules for Continuing Airworthiness.

Powered by EASA eRules

Page 183 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203

ANNEX VIII — INFORMATION SECURITY — ANNEXES II (PARTATCO.AR) AND III (PART ATCO.OR) TO REGULATION (EU)2015/340
For the consolidated version of Part ATCO.AR and Part ATCO.OR, please refer to Easy Access Rules for
Air Traffic Controllers’ Licensing and Certification (Regulation (EU) 2015/340).

Powered by EASA eRules

Page 184 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Implementing Regulation (EU)2023/203

ANNEX IX — INFORMATION SECURITY — ANNEXES II (PARTATM/ANS.AR) AND III (PART-ATM/ANS.OR) TO IMPLEMENTINGREGULATION (EU) 2017/373
For the consolidated version of Part-ATM/ANS.AR and Part-ATM/ANS.OR, please refer to Easy Access
Rules for Air Traffic Management/Air Navigation Services (Regulation (EU) 2017/373).

Powered by EASA eRules

Page 185 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645

DELEGATED REGULATION (EU) 2022/1645
COVER REGULATION TO DELEGATED REGULATION (EU) 2022/1645
EXPLANATORY MEMORANDUM
Regulation (EU) 2022/1645

1.

CONTEXT OF THE DELEGATED ACT

The current European aviation safety regulatory framework contains a series of requirements which
are aimed at reducing the likelihood of an accident happening.
This combination of requirements allows that even if an error, mistake and/or deficiency happens, it
should not create a hazardous situation that could result in an accident or serious incident.
Consequently, an accident or serious incident would only happen in the remote random event ofseveral deficiencies happening simultaneously and, by chance, aligning themselves.
The concern is that not enough focus may have been put in properly addressing the situation where
existing flaws in different areas are aligned on purpose and exploited by individuals with a malicious
intent, no longer being a random event. Such a risk is constantly increasing in the civil aviation
environment as the current information systems are becoming more and more interconnected.
As a consequence, it is necessary to introduce requirements for the management of information
security risks which could have a potential impact on aviation safety.
In the particular case of this Delegated Act, the provisions introduced increase the robustness of the
management systems and reporting processes and procedures required by Annex II ‘Essential
requirements for airworthiness’ and Annex VII ‘Essential requirements for aerodromes’ to Regulation(EU) 2018/1139 (1) for design and production organisations, and for aerodrome operators andproviders of apron management services.
2.

CONSULTATIONS PRIOR TO THE ADOPTION OF THE ACT

In accordance with Article 128(4) of Regulation (EU) 2018/1139, before adopting a delegated act, theCommission shall consult experts designated by each Member State in accordance with the principles
laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law- Making. The draft
delegated act was presented to the Air Safety experts group, which includes representatives from theMember States, at its meetings on 17 February and 29 June 2022. The present delegated act is basedon EASA Opinion No 03/2021 which contents had been publicly consulted through Notice of Proposed
Amendment (NPA) 2019-07 ‘Management of information security risks’ (2) (RMT.0720), published by
EASA on 27 May 2019.

1 Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018 on common rules in the field of civil aviation andestablishing a European Union Aviation Safety Agency, and amending Regulations (EC) No 2111/2005, (EC) No 1008/2008, (EU) No 996/2010,(EU) No 376/2014 and Directives 2014/30/EU and 2014/53/EU of the European Parliament and of the Council, and repealing Regulations(EC) No 552/2004 and (EC) No 216/2008 of the European Parliament and of the Council and Council Regulation (EEC) No 3922/91 (OJ L 212,22.8.2018, p. 1) (https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1535612134845&uri=CELEX:32018R1139).
2https://www.easa.europa.eu/document-library/notices-of-proposed-amendment/npa-2019-07

Powered by EASA eRules

Page 186 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645

3.

LEGAL ELEMENTS OF THE DELEGATED ACT

Articles 19(1) and 39(1) of Regulation (EU) 2018/1139 empower the Commission to adopt delegatedacts, in accordance with Article 128 of that Regulation, laying down detailed rules with regard toorganisations responsible for the design and production of products, parts and non-installed
equipment, and with regard to organisations responsible for the operation of aerodromes and for theprovision of apron management services.
COMMISSION DELEGATED REGULATION (EU) 2022/1645
of 14 July 2022
laying down rules for the application of Regulation (EU) 2018/1139 of the European Parliament and of theCouncil, as regards requirements for the management of information security risks with a potential impact
on aviation safety for organisations covered by Commission Regulations (EU) No 748/2012 and No 139/2014
and amending Commission Regulations (EU) No 748/2012 and No 139/2014
Regulation (EU) 2022/1645

THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July
2018 on common rules in the field of civil aviation and establishing a European Union Aviation Safety
Agency, and amending Regulations (EC) No 2111/2005, (EC) No 1008/2008, (EU) No 996/2010, (EU)No 376/2014 and Directives 2014/30/EU and 2014/53/EU of the European Parliament and of theCouncil, and repealing Regulations (EC) No 552/2004 and (EC) No 216/2008 of the European
Parliament and of the Council and Council Regulation (EEC) No 3922/911, and in particular Articles
19(1) point (g) and 39(1) point (b) thereof.
Whereas:(1)

In accordance with the essential requirements set out in Annex II, point 3.1(b), to Regulation(EU) 2018/1139, design and production organisations are to implement and maintain amanagement system to manage safety risks.

(2)

In addition, in accordance with the essential requirements set out in Annex VII, points 2.2.1 and
5.2, to Regulation (EU) 2018/1139, aerodrome operators and organisations responsible for theprovision of apron management services are to implement and maintain a management system
to manage safety risks.

(3)

The safety risks referred to in recitals (1) and (2) may derive from different sources, including
design and maintenance flaws, human performance aspects, environmental threats andinformation security threats. Therefore, the management systems implemented by theorganisations as referred to in recitals (1) and (2), should take into account not only safety risks
stemming from random events, but also safety risks deriving from information security threats
where existing flaws may be exploited by individuals with a malicious intent. Those information
security risks are constantly increasing in the civil aviation environment as the current
information systems are becoming more and more interconnected, and increasingly becoming
the target of malicious actors.

1

OJ L 212, 22.8.2018, p. 1.

Powered by EASA eRules

Page 187 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645(4)

The risks associated with those information systems are not limited to possible attacks to thecyberspace, but encompass also threats which may affect processes and procedures as well as
the performance of human beings.

(5)

A significant number of organisations already use international standards, such as ISO 27001, inorder to address the security of digital information and data. These standards may not fully
address all the specificities of civil aviation.

(6)

Therefore, it is appropriate to set out requirements for the management of information security
risks with a potential impact on aviation safety.

(7)

It is essential that those requirements cover the different aviation domains and their interfaces
since aviation is a highly interconnected system of systems. Therefore, they should apply to all
the organisations that are already required to have a management system in accordance withthe existing Union aviation safety legislation.

(8)

The requirements laid down in this Regulation should be consistently applied across all aviation
domains, while creating a minimal impact on the Union aviation safety legislation alreadyapplicable to those domains.

(9)

The requirements laid down in this Regulation should be without prejudice to information
security and cybersecurity requirements laid down in Point 1.7 of the Annex to Commission
Implementing Regulation (EU) 2015/1998(1) and in Article 14 of Directive (EU) 2016/1148 of theEuropean Parliament and of the Council(2).

(10) The definition on information security used for the purposes of this legal act should not beinterpreted as divergent from the definition of security of network and information systems laid
down in Directive 2016/1148.
(11) In order to avoid duplication of legal requirements, where organisations covered by thisRegulation are already subject to security requirements arising from other Union acts referred
to in recital (9), which are, in their effect equivalent to the provisions laid down in thisRegulation, compliance with those security requirements should be considered to constitutecompliance with the requirements laid down in this Regulation.
(12) Organisations covered by this Regulation that are already subject to security requirements
arising from Regulation (EU) 2015/1998 should also comply with the requirements of Annex I(Part IS.D.OR.230 “Information security external reporting scheme”) to this Regulation as
Regulation (EU) 2015/1998 does not contain any provisions related to external reporting of
information security incidents.
(13) Regulations (EU) No 748/2012(3) and No 139/2014(4) should be amended in order to establish
the link between the management systems prescribed in the regulations listed above and theinformation security management requirements prescribed by this Regulation.

1 Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of thecommon basic standards on aviation security (OJ L 299, 14.11.2015, p. 1).
2 Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of

security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).
3 Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules for the airworthiness and environmental

certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations
4 Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down requirements and administrative procedures related to

aerodromes pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council

Powered by EASA eRules

Page 188 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645(14) In order to provide organisations with sufficient time to ensure compliance with the new rules
and procedures introduced by this Regulation, this Regulation should apply from 3 years after
the date of entry into force.
(15) The requirements laid down by this Regulation are based on Opinion No 03/2021(1), issued by
the Agency in accordance with Article 75(2) points (b) and (c) and Article 76(1) of Regulation(EU) 2018/1139.
(16) In accordance with Article 128(4) of Regulation (EU) 2018/1139, the Commission consulted
experts designated by each Member State in accordance with the principles laid down in theInter-institutional Agreement of 13 April 2016 on Better Law-Making2,
HAS ADOPTED THIS REGULATION:

Article 1 – Subject matter
Regulation (EU) 2022/1645

This Regulation sets out the requirements to be met by the organisations referred to in Article 2 inorder to identify and manage information security risks with potential impact on aviation safety which
could affect information and communication technology systems and data used for civil aviation
purposes and to detect information security events and identify those which are consideredinformation security incidents with potential impact on aviation safety and respond to, and recoverfrom, those information security incidents.

GM1 Article 1 — Subject matter
ED Decision 2023/008/R

When taking measures under this Regulation, affected entities — irrespective of their size — areencouraged to ensure that the measures they take are proportionate to the nature and safety risk of
their activities.

Article 2 – Scope
Regulation (EU) 2022/1645

1.

This Regulation applies to the following organisations:(a)production organisations and design organisations subject to Subparts G and J of Section
A of Annex I (Part 21) to Regulation (EU) No 748/2012, except design and production
organisations that are solely involved in the design and/or production of ELA2 aircraft as
defined in Article 1(2), point (j) of Regulation (EU) No 748/2012;(b)

aerodrome operators and apron management service providers subject to Annex III ‘Part
Organisation Requirements (Part-ADR.OR)’ to Regulation (EU) No 139/20143.

1 https://www.easa.europa.eu/document-library/opinions
2 OJ L 123, 12.5.2016, p. 1.
3 Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down requirements and administrative procedures related to

aerodromes pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (OJ L 44, 14.2.2014, p. 1).

Powered by EASA eRules

Page 189 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645

2.

This Regulation is without prejudice to information security and cybersecurity requirements laid
down in Point 1.7 of the Annex toCommission Implementing Regulation (EU) 2015/1998(1) andin Article 14 of Directive (EU) 2016/1148 of the European Parliament and of the Council(2).

Article 3 – Definitions
Regulation (EU) 2022/1645

For the purpose of this Regulation, the following definitions shall apply:(1)‘information security’ means the preservation of confidentiality, integrity, authenticity andavailability of network and information systems;(2)‘information security event’ means an identified occurrence of a system, service or network
state indicating a possible breach of the information security policy or failure of information
security controls, or a previously unknown situation that can be relevant for information
security;(3)‘incident’ means any event having an adverse effect on the security of network and information
systems as defined in Article 4(7) of Directive (EU) 2016/1148;(4)‘information security risk’ means the risk to organisational civil aviation operations, assets,
individuals, and other organisations due to the potential of an information security event.
Information security risks are associated with the potential that threats will exploit
vulnerabilities of an information asset or group of information assets;(5)‘threat’ means a potential violation of information security which exists when there is an entity,
circumstance, action or event that could cause harm;(6)‘vulnerability’ means a flaw or weakness in an asset or a system, procedures, design,
implementation, or information security measures that could be exploited and results in a
breach or violation of the information security policy.

GM1 Article 3 — Definitions
ED Decision 2023/008/R

For the sake of common understanding, the following is a description of the terms used in the AMC &GM to Part-IS.D.OR of Commission Delegated Regulation (EU) 2022/1645 as well as in the AMC & GM
to Part-IS.AR and Part-IS.I.OR of Commission Implementing Regulation (EU) 2023/203:
Assessment

In the context of management system performance monitoring,
continuous improvement and oversight, it refers to a planned anddocumented activity performed by competent personnel to evaluate andanalyse the achieved level of performance, effectiveness and maturity, as
well as compliance in relation to the organisation’s policy and objectives.
Note: An assessment focuses on required outcomes and the overall
performance, looking at the organisation as a whole. The main objective

1 Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of thecommon basic standards on aviation security (OJ L 299, 14.11.2015, p. 1).
2 Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of

security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

Powered by EASA eRules

Page 190 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645

of the assessment is to identify the strengths and weaknesses to drive
continuous improvement.
Remark: For ‘risk assessment’, please refer to the definition below.
Attack vector (or attack The path, interface, and actions by which an attacker executes an attack,path)
as defined in EUROCAE ED-202.
Audit

It refers to a systematic, independent, and documented process for
obtaining evidence, and evaluating it objectively to determine the extent
to which requirements are complied with.
Note: Audits may include inspections.

Competency

It is a combination of individual skills, practical and theoretical knowledge,
attitude, training, and experience.

Correction

It is the action to eliminate a detected non-compliance.

Corrective action

It is the action taken to eliminate or mitigate the root cause(s) and preventthe recurrence of an existing detected non-compliance or other
undesirable conditions or situations. Proper determination of the root
cause(s) is crucial for defining effective corrective actions to prevent
reoccurrence.

Deficiency

It is as a deviation from compliance with or a non-fulfilment of any
requirement or objectives, either from a regulatory or an organisation’s
perspective, either completely or partially.

Experience

It is the fact or state of having been affected by or gained knowledge andskills through observation, participation or doing.

Functional chain

The concept of functional chain dictates that information security risks areshared along organisations due to their respective interfaces, such as
supplier-customer relationships. Safety effects caused by information
security threats primarily materialise at aircraft level, originating upstreamof the aircraft. In the functional chain concept, each organisation assesses
its information security risks, which it may not be able to address andhence may expose other organisations to risks. It should pass related
information to the immediate partner(s) downstream for well-informed
risk management purposes and to ensure that the whole chain isadequately protected, even when no organisation has full visibility orcontrol.

HazardIt is a condition or an object with the potential to cause or contribute toan aircraft incident or accident.

Information
controlsecurity It is a measure that reduces risk.

Intentional
It refers to the deliberate act of engaging in electronic activities orunauthorised electronic communications (e.g. access to, or modification of, computerinteraction
systems, networks, or data) without proper authorisation or

permission and with the intent to disclose sensitive information,

Powered by EASA eRules

Page 191 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645

modify data, disrupt normal operations, or deny access to legitimate
users.
Just culture

It means a culture in which front-line operators or other persons are notpunished for actions, omissions or decisions taken by them that arecommensurate with their experience and training, but in which grossnegligence, wilful violations and destructive acts are not tolerated, as
defined in Article 2 of Regulation (EU) No 376/20141.

Knowledge

Content of information needed to perform adequately in the job at an
acceptable level, usually obtained through formal education and on-thejob experience. This knowledge is necessary for job performance but is not
sufficient on its own.

Management (activity)

In the general organisational context, it refers to the activities aimed at
directing, controlling, and continually improving the organisation withinappropriate structures. In the context of Commission DelegatedRegulation (EU) 2022/1645 and Commission Implementing Regulation(EU) 2023/203 it means, more specifically, the supervision and making ofdecisions necessary to achieve the organisation’s safety and information
security objectives.

Management system

It refers to a set of interrelated or interacting system elements to establish
policies, objectives and processes to achieve those objectives, where thesystem elements include the organisational structure, roles andresponsibilities, planning and operations.

Risk assessment

It is an evaluation that is based on engineering and operational judgement
and/or analysis methods in order to establish whether the achieved or
perceived risk is acceptable.

Risk register

It refers to a physical or digital means of documentation used as a risk
management tool that acts as a repository for all identified risks andcontains additional information about each risk, such as the nature of therisk, mitigation measures, ownership, status, etc.

SafetyIt refers to the state in which risks associated with aviation activities,
related to, or in direct support of the operation of aircraft, are reduced
and controlled to an acceptable level, as defined in ICAO Annex 19.

Safety risk

It refers to the predicted likelihood and severity of the consequences oroutcomes of a hazard.
Note: The term ‘likelihood’ is used instead of the term ‘probability’ toreflect a subjective analysis of the possibility of occurrence rather than apurely statistical assessment.

1

Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on the reporting, analysis
and follow-up of occurrences in civil aviation, amending Regulation (EU) No 996/2010 of the European Parliament andof the Council and repealing Directive 2003/42/EC of the European Parliament and of the Council and Commission
Regulations (EC) No 1321/2007 and (EC) No 1330/2007 (OJ L 122, 24.4.2014, p. 18) (https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=CELEX%3A32014R0376&qid=1669377456448).

Powered by EASA eRules

Page 192 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645

Powered by EASA eRules

Page 193 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645

Article 4 – Requirements arising from other Union legislation
Regulation (EU) 2022/1645

1.

Where an organisation referred to in Article 2 complies with security requirements laid down in
Article 14 of Directive (EU) 2016/1148 of the European Parliament and of the Council that areequivalent to the requirements laid down in this Regulation, compliance with those security
requirements shall be considered to constitute compliance with the requirements laid down inthis Regulation.

2.

Where an organisation referred to in Article 2 is an operator or an entity referred to in thenational civil aviation security programmes of Member States laid down in accordance with
Article 10 of Regulation (EC) No 300/2008 of the European Parliament and of the Council1, thecybersecurity requirements contained in Point 1.7 of the Annex to Implementing Regulation(EU) 2015/1998 are considered to be equivalent to the requirements laid down in thisRegulation, except as regards point IS.D.OR.230 of the Annex to this Regulation that shall becomplied with.

3.

The Commission, after consulting EASA and the Cooperation Group referred to in Article 11 of
Directive (EU) 2016/1148, may issue guidelines for the assessment of the equivalence of
requirements laid down in this Regulation and Directive (EU) 2016/1148.

Article 5 – Competent authority
Regulation (EU) 2022/1645

1.

2.

The authority responsible for certifying and overseeing compliance with this Regulation shallbe:(a)with regard to organisations referred to in Article 2, point (a), the competent authority
designated in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012;(b)with regard to organisations referred to in Article 2, point (b), the competent authority
designated in accordance with Annex III (Part-ADR.OR) to Regulation (EU) No 139/2014.

Member States, may for the purposes of this Regulation, designate an independent andautonomous entity to fulfil the assigned role and responsibilities of the competent authorities
referred to in paragraph 1. In that case, coordination measures shall be established between
that entity and the competent authorities, as referred to in paragraph 1, to ensure effective
oversight of all the requirements to be met by the organisation.

Article 6 – Amendment to Regulation (EU) No 748/2012
Regulation (EU) 2022/1645

For the consolidated version of Annex I (Part 21) to Regulation (EU) No 748/2012, please refer to the
Easy Access Rules for Airworthiness and Environmental Certification (Regulation (EU) No 748/2012).

1 Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation

security and repealing Regulation (EC) No 2320/2002 (OJ L 97, 9.4.2008, p. 72).

Powered by EASA eRules

Page 194 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
Cover Regulation to DelegatedRegulation (EU) 2022/1645

Article 7 – Amendment to Regulation (EU) No 139/2014
Regulation (EU) 2022/1645

For the consolidated version of Annex III (Part-ADR.OR) to Regulation (EU) No 139/20141, please referto the Easy Access Rules for Aerodromes (Regulation (EU) No 139/2014).

Article 8
Regulation (EU) 2022/1645

This Regulation shall enter into force on the twentieth day following that of its publication in the
Official Journal of the European Union.
It shall apply from 16 October 2025.
Regulation (EU) 2022/1645

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 14 July 2022.
For the Commission
The President
Ursula VON DER LEYEN

1Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down requirements and administrative procedures related
to aerodromes pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (OJ L 44, 14.2.2014, p. 1).

Powered by EASA eRules

Page 195 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

ANNEX — INFORMATION SECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]
IS.D.OR.100 Scope
Regulation (EU) 2022/1645

This Part establishes the requirements to be met by the organisations referred to in Article 2 of thisRegulation.

IS.D.OR.200 Information security management system (ISMS)
Regulation (EU) 2022/1645(a)

In order to achieve the objectives set out in Article 1, the organisation shall set up, implement
and maintain an information security management system (ISMS) which ensures that theorganisation:(1)

establishes a policy on information security setting out the overall principles of theorganisation with regard to the potential impact of information security risks on aviation
safety;(2)

identifies and reviews information security risks in accordance with point IS.D.OR.205;(3)

defines and implements information security risk treatment measures in accordance withpoint IS.D.OR.210;(4)implements an information security internal reporting scheme in accordance with point
IS.D.OR.215;(5)

defines and implements, in accordance with point IS.D.OR.220, the measures required todetect information security events, identifies those events which are considered
incidents with a potential impact on aviation safety except as permitted by point
IS.D.OR.205(e), and responds to, and recovers from, those information security incidents;(6)

implements the measures that have been notified by the competent authority as an
immediate reaction to an information security incident or vulnerability with an impact onaviation safety;(7)

takes appropriate action, in accordance with point IS.D.OR.225, to address findings
notified by the competent authority;(8)

implements an external reporting scheme in accordance with point IS.D.OR.230 in orderto enable the competent authority to take appropriate actions;(9)complies with the requirements contained in point IS.D.OR.235 when contracting any
part of the activities referred to in point IS.D.OR.200 to other organisations;(10) complies with the personnel requirements laid down in point IS.D.OR.240;(11) complies with the record-keeping requirements laid down in point IS.D.OR.245;(12) monitors compliance of the organisation with the requirements of this Regulation andprovides feedback on findings to the accountable manager or, in the case of designorganisations, to the head of the design organisation, in order to ensure effective
implementation of corrective actions;Powered by EASA eRules

Page 196 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](13) protects, without prejudice to applicable incident reporting requirements, theconfidentiality of any information that the organisation may have received from otherorganisations, according to its level of sensitivity.
(b)

In order to continuously meet the requirements referred to in Article 1, the organisation shall
implement a continuous improvement process in accordance with point IS.D.OR.260.

(c)

The organisation shall document, in accordance with point IS.D.OR.250, all key processes,
procedures, roles and responsibilities required to comply with point IS.D.OR.200 (a) andestablish a process for amending that documentation. Changes to those processes, procedures,roles and responsibilities shall be managed in accordance with point IS.D.OR.255.

(d)

The processes, procedures, roles and responsibilities established by the organisation in order
to comply with point IS.D.OR.200(a) shall correspond to the nature and complexity of its
activities, based on an assessment of the information security risks inherent to those activities,
and may be integrated within other existing management systems already implemented by theorganisation.

(e)Without prejudice to the obligation to comply with the reporting requirements contained inRegulation (EU) No 376/2014(1) and the requirements of point IS.D.OR.200(a)(13), theorganisation may be granted approval by the competent authority not to implement therequirements referred to in points (a) to (d) ) and the related requirements contained in points
IS.D.OR.205 through IS.D.OR.260, if it demonstrates to the satisfaction of that authority that its
activities, facilities and resources, as well as the services it operates, provides, receives andmaintains, do not pose any information security risks with a potential impact on aviation safety
neither to itself nor to other organisations. The approval shall be based on a documented
information security risk assessment carried out by the organisation or a third party inaccordance with point IS.D.OR.205 and reviewed and approved by its competent authority.
The continued validity of that approval will be reviewed by the competent authority following
the applicable oversight audit cycle and whenever changes are implemented in the scope ofwork of the organisation.

GM1 IS.D.OR.200 Information security management system (ISMS)ED Decision 2023/009/R

An information security management system (ISMS) is a systematic approach to establish,
implement, operate, monitor, review, maintain and continuously improve the state of information
security of an organisation. Its objective is to protect the information assets, such that the operationaland safety objectives of an organisation can be reached in a risk-aware, effective and efficient manner.
Generally speaking, an ISMS establishes an information security risk management process, based upon
the results of information security impact analyses, which basically determine its scope. If information
security breaches may cause or contribute to aviation safety consequences, information security
requirements need to limit their impact on levels of aviation safety, which are deemed acceptable.
Hence, all roles, processes, or information systems, which may cause or contribute to aviation safety(1) Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on the reporting, analysis and follow-up of
occurrences in civil aviation, amending Regulation (EU) No 996/2010 of the European Parliament and of the Council and repealing Directive
2003/42/EC of the European Parliament and of the Council and Commission Regulations (EC) No 1321/2007 and (EC) No 1330/2007(OJ L 122, 24.4.2014, p. 18).

Powered by EASA eRules

Page 197 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

consequences, are within the scope of Regulation (EU) 2022/1645. The ISMS provides for means to
decide on needed information security controls for all architectural layers (governance, business,
application, technology, data) and domains (organisational, human, physical, technical). It further
allows to manage the selection, implementation, and operation of information security controls.
Finally, it allows to manage the governance, risk management and compliance (GRC) within the ISMS
scope.
The risk management process is thus based on aviation safety risk assessments and derived
information security risk acceptance levels, which are designed to effectively treat and manage
information security risks with a potential impact on aviation safety caused by threats exploiting
vulnerabilities of information assets in aeronautical systems. Interacting bow-ties allow for a higher
level and non-exhaustive illustration of how different disciplines of risk assessment may need tocollaborate to establish a common risk perspective, as depicted in Figure 1.

Figure 1: Bow-tie representation of management of aviation safety risks posed by information
security threats
The ISMS in this Regulation should bring together the information security and aviation safetycompetencies in most of the processes, including, for instance, identifying critical systems, or threats,
and assessing potential impacts on and risks to aviation safety.
ISMS implementation and maintenance
An ISMS, as defined in this Regulation, employs the perspectives of governance, risk and compliance,
and an approach that combines the safety risk and performance dimensions to determine theinformation security controls that are appropriate and compliant with the specific context and caneffectively provide the level of protection required to achieve the aviation safety objectives by:—

Governance perspective refers to providing management direction and leadership aimed toachieve the entity’s own overarching objectives:—

leadership and commitment of the senior management defining and ensuring the close
involvement of the management and a ‘top-down’ ISMS implementation—

information security and safety objectives aligned and consistent with the entity’sbusiness objectives and monitored by, e.g., management reviews

Powered by EASA eRules

Page 198 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]—

information security policies stating the principles and objectives to be achieved—roles, responsibilities, competencies and resources required for an effective ISMS—

effective, target-group-oriented communication to internal and external stakeholders—

Risk perspective refers to a key aspect of an ISMS in an aviation safety context according to thisRegulation and serves as a basis for transparent decision-making and prioritisation of controls
and risk treatment options. It further refers to the assessment, treatment and monitoring of
information security risks in support of the management of aviation safety risks for the key
processes and information assets upon which they depend. This includes protection
requirements, risk exposure, attitude towards risks and risk acceptance criteria, methods andindustry standards.

—

Compliance perspective refers to the compliance with regulatory, legal and contractual
requirements. This includes:—

this Regulation,—

the entity’s own policies and standards and may further include international or industry
standards adopted by the entity from ISO, EUROCAE, etc.

This perspective comprises the definition, implementation and maintenance of the required
information security provisions whose effectiveness and compliance should be regularly
monitored and assured by, e.g. (internal) audits.
Based on these perspectives we may identify the following processes or subject areas that have beenshown to be relevant for the establishment of an effective ISMS. These ISMS processes and subject
areas can be summarised as follows:(a)context establishment defining the scope, interfaces, dependencies and requirements ofinterested parties;(b)leadership and commitment of the senior management;(c)information security and safety objectives;(d)information security policies;(e)roles, responsibilities, competencies and resources required for an effective ISMS;(f)communication to internal and external stakeholders to achieve a sufficient level of information
security awareness and training of all involved parties;(g)

information security risk management including risk assessment and treatment;(h)information security incident management establishing processes for the handling of
information security incidents and vulnerabilities;(i)

performance & effectiveness monitoring, measurement and evaluation;(j)internal audits and management reviews;(k)corrections and corrective actions;(l)continuous improvement;(m)relationship with suppliers;(n)documentation, record-keeping, and evidence collection.

Powered by EASA eRules

Page 199 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Additional critical success factors for the implementation and operation of an ISMS include thefollowing:—

The ISMS should be integrated with the entity’s processes and overall management structure
or even — at least partially, with safeguards for their respective integrity, and as reasonably
applicable — with an overarching management system comprising information security,
aviation safety and quality management.

—

Information security has to be considered at an early stage in the overall design of processes
and procedures, of systems and of information security controls, to be seamlessly integrated,
for maximum effectiveness, minimal functional interference and optimised cost. None of thesebenefits can be achieved by integrating it on later.

—

The risk management process determines appropriate characteristics of preventive controls toreach and maintain acceptable risk levels.

—

The incident management process ensures that the organisation detects, reacts and responds
to information security incidents in a timely manner. This is achieved by defining
responsibilities, procedures, scenarios and response plans in advance to ensure a coordinated,targeted and efficient response.

—

Continuous monitoring and reassessment are undertaken and improvements are made in
response.

The above-mentioned core components are related to the requirements in this Regulation, for which
Figure 2 provides a high-level depiction of the aspects that are more prominent in the implementation
phase and those that characterise the operational phase, as well as the review and possible
improvement, if the functions do not perform as planned

Figure 2: Representation of the Part-IS requirements from an ISMS’s life cycle perspective

Powered by EASA eRules

Page 200 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Plan-Do-Check-Act approach
The Plan-Do-Check-Act (PDCA) refers to a process approach that is often used to establish, implement,
operate, monitor, review and improve management systems. Figure 3 depicts the PDCA applied to an
ISMS.

Figure 3: Plan-Do-Check-Act approach applied to an ISMS

Benefits of an ISMS
The benefits of a management system operating in a dynamic, uncertain or unpredictable risk
environment are realised in the long term only when the organisation improves existing controls,
processes and solutions based on the assessments of risks, performance and maturity as well as on
the learnings from incidents, audits, non-conformities and their root causes. A successful adoption
and deployment of an ISMS allows an entity to:—achieve greater assurance to the management and interested parties that its information assets
are adequately protected against threats on a continual basis;—increase its trustworthiness and credibility providing confidence to interested parties that
information security risks with an impact on aviation safety are adequately managed;—

increase the resilience of the entity’s key processes against unauthorised electronic interactions
and maintains the entity’s ability to decide and act;

Powered by EASA eRules

Page 201 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]—

support the timely detection of control gaps, vulnerabilities or deficiencies aimed to prevent
information security incidents or at least to minimise their impact;—

detect and timely react to changes in the entity’s environment including system architecture
and threat landscape or the adoption of new technologies;—
provide a foundation for effective and efficient implementation of a comprehensive
information security strategy in times of digital transformation, increasing interconnectivity ofsystems, emerging information security threats and new technologies.
Relation to ISO/IEC 27001
The international standard ISO/IEC 27001 is a widely adopted standard for ISMS which specifies
generic requirements for establishing, implementing, maintaining and continually improving an ISMS.
It also includes requirements for the assessment and treatment of information security risks. The
requirements are applicable to all entities, regardless of type, size or nature. The conformity of an
ISMS with the ISO/IEC 27001 standard can be certified by an accredited certification body. ISO/IEC
27001 is compatible with other management system standards (quality, safety, etc.) that have also
adopted the structure and terms defined in Annex SL to ISO/IEC Directives, Part 1, Consolidated ISO
Supplement. This compatibility allows an entity to operate a single management system that meetsthe requirements of multiple management system standards.
ISO/IEC 27001 allows entities to define their own scope of audit and their own organisational risk
appetite. This, in turn, leads to information security requirements that provide the ISMS with criteria
for the acceptability of information security risks in line with the entity’srisk appetite (see Figure4).

Figure 4: Relation between the entity’s risk appetite and the information security objectives
The requirements for an ISMS specified by this Regulation are in most parts consistent and alignedwith ISO/IEC 27001; however, this Regulation introduces provisions specific to the context of aviation
safety. If an ISO/IEC 27001-based ISMS is already operated by an entity for a different scope andcontext, it can be adapted and extended to the scope and context of this Regulation in astraightforward manner based on an analysis of the scope and the gaps. In order to take credit from
ISO/IEC 27001 certifications to achieve compliance with Part-IS, aviation safety needs to be includedin the organisational risk management, with the relevant risk acceptance level determined by thePowered by EASA eRules

Page 202 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

applicable regulation (see Figure 5). Therefore, careful determination of the scope of the ISMS related
to aviation safety risks is needed, as it might differ from the one related to the other organisationalrisks. To allow demonstration of compliance with Regulation (EU) 2022/1645, careful delineation
between aspects of the ISMS related to aviation safety risks and other organisational risks may berequired. This could have an influence upon the decision to integrate ISMSs.

Figure 5: Introduction of aviation safety aspects in the entity’s risk appetite
PART-IS versus ISO/IEC 27001 cross reference table
For a mapping between the main tasks required under Part-IS and the clauses and associated controls
in ISO/IEC 27001, refer to Appendix II.

AMC1 IS.D.OR.200(a)(1) Information security management system(ISMS)ED Decision 2023/009/R

The organisation should define and document the scope of the ISMS, by determining activities,
processes, supporting systems, and identifying those which may have an impact on aviation safety.
The information security policy should be endorsed by the accountable manager or, in the case ofdesign organisations, by the head of the design organisation, and reviewed at planned intervals or if
significant changes occur. Moreover, the policy should cover at least the following aspects with apotential impact on aviation safety by:(a)committing to comply with applicable legislation, consider relevant standards and bestpractices;(b)

setting objectives and performance measures for managing information security;(c)defining general principles, activities, processes for the organisation to appropriately secure
information and communication technology systems and data;(d)committing to apply ISMS requirements into the processes of the organisation;

Powered by EASA eRules

Page 203 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](e)committing to continually improve towards higher levels of information security process
maturity as per IS.D.OR.260;(f)committing to satisfy applicable requirements regarding information security and its proactive
and systematic management and to the provision of appropriate resources for its
implementation and operation;(g)

assigning information security as one of the essential responsibilities for all managers;(h)committing to promote the information security policy through training or awareness sessions
within the organisation to all personnel on a regular basis or upon modifications;(i)encouraging the implementation of a ‘Just-(Culture’ and the reporting of vulnerabilities,
suspicious/anomalous events and/or information security incidents;(j)committing to communicate the information security policy to all relevant parties, as
appropriate.

Note: A significant change is a notable alteration or modification that has a meaningful impact on theorganisation’s operations, such as a structural change within the organisation due to reorganisations,a change in the business processes (e.g. working from home, use of personal devices), a technologicalevolution (e.g. distributed computing resources, artificial intelligence/machine learning) or an
evolution in the threat landscape.

GM1 IS.D.OR.200(a)(1) Information security management system(ISMS)ED Decision 2023/009/R

INFORMATION SECURITY POLICY AND OBJECTIVES

The information security policy should suit to the organisation’s purpose and direct its own
information security activities. Such policy should contain the needs for information security in theorganisation’s context, a high-level statement of direction and intent of the information security
activities, the principles and most important strategic and tactical objectives to be achieved by the
ISMS, as well as the general information security objectives or a specification of a framework (who,how) for setting information security objectives. The information security policy should also contain adescription of the established ISMS including roles, responsibilities and references to topic-specificpolicies and standards.
The information security objectives should be:—consistent and aligned with the information security policy and consider the applicable
information security requirements, derived from the overarching organisation’s objectives, andthe results from the risk assessment and treatment (which, in turn, supports theimplementation of the organisation’s strategic goals and information security policy);—

regularly reviewed to ensure that they are up to date and still appropriate;—measurable if practicable (to be able to determine whether the objective has been met), aimed
to be SMART (specific, measurable, attainable, realistic, timely) and aligned with all affected
responsible persons.

Powered by EASA eRules

Page 204 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

When defining information security objectives, e.g., based on the overarching organisation’s
objectives, the information security requirements or the results of risk assessments, it should bedetermined how these objectives will be achieved. The degree to which IS objectives are achieved
must be measurable. If possible, it should be measured by key performance indicators (KPIs) whichhave been defined in advance (refer to resources such as COBIT 5 for Information Security). It is
recommended to start with the definition of a limited number of information security objectives which
are relevant for the entity, more of a long-term nature and measurable with a reasonable effort
relative to the delivered benefits.

AMC1 IS.D.OR.200(a)(12) Information security management system(ISMS)ED Decision 2023/009/R

COMPLIANCE MONITORING

When establishing compliance with the provisions under points IS.D.OR.200(a)(12) the organisation
should implement a function to periodically monitor compliance of the management system with therelevant requirements and adequacy of the procedures including the establishment of an internal
audit process and an information security risk management process. When the organisation has
already established a compliance monitoring function under the implementing regulation for its
domain, such function should include the monitoring of the management system with the relevant
requirements within the scope of its activities. Compliance monitoring should include a feedback
mechanism of audit findings to the accountable manager or, in the case of design organisations, tothe head of the design organisation, or delegated persons to ensure implementation of corrective
actions as necessary.

GM1 IS.D.OR.200(a)(12) Information security management system(ISMS)ED Decision 2023/009/R

COMPLIANCE MONITORING

For the purpose of compliance monitoring, internal audits should be conducted at planned intervals
to provide assurance on the status of the ISMS to the management and to provide information on thefollowing:—

conformity of the ISMS to the requirements of this Regulation and the organisation’s own
requirements either stated in the information security policy, procedures and contracts orderived from information security objectives or outcomes of the risk treatment process;—effective implementation and maintenance of the ISMS.

Internal audits should follow an independent approach and a decision-making process based onevidences. Moreover, when setting up an audit programme the importance of the processes
concerned, and definitions of the audit criteria and scopes should be considered. Documented
information should be retained evidencing the audit results, their reporting to the relevant
management and the audit programme.

Powered by EASA eRules

Page 205 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

AMC1 IS.D.OR.200(a)(13) Information security management system(ISMS)ED Decision 2023/009/R

When establishing compliance with the provisions under points IS.D.OR.200(a)(13), the organisation
should implement and maintain information security controls that are sufficiently robust and effective
to protect information and ensure the need-to-know principle (i.e. limiting access to information to
only those who need it to perform their duties). It should protect the source of information inaccordance with the relevant provisions established in Regulation (EU) 2018/1139. It should also
comply with Regulation (EU) No 376/2014.

AMC1 IS.D.OR.200(c) Information security management system(ISMS)ED Decision 2023/009/R

When establishing compliance with the provisions under point IS.D.OR.200(c), the organisation
should:(a)

provide an outline of the structure of the specific information security personnel (internal andexternal), including their roles and responsibilities. This outline of the structure will be used to
manage and maintain the elements included within the scope of the ISMS and will be approvedby the accountable manager or, in the case of design organisations, by the head of the designorganisation. The organisation should review the outline of the structure at planned intervals
or if significant changes occur (see the Note in AMC1 IS.D.OR.200(a)(1));(b)

identify and categorise all relevant contracted organisations used to implement the ISMS. The
organisation should define and document procedures for the management of interfaces andcoordination between the organisation and other organisations, including contractedorganisations;(c)identify and define all key processes and procedures, and internal and external reporting
schemes that will be used to maintain compliance with the objectives of this Regulation overthe life cycle of the ISMS. The organisation may adjust existing processes or procedures forcompliance;(d)identify and document any other information that will be used to maintain compliance with theobjectives of this Regulation;(e)when creating and updating documented information, ensure appropriate identification anddescription (e.g. a title, date, author, or reference number) as well as a review and an approval
for suitability and adequacy;(f)control the documented information required by the ISMS to ensure that it is:(1)

available and suitable for use, where and when it is needed;(2)adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

Powered by EASA eRules

Page 206 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

GM1 IS.D.OR.200(c) Information security management system(ISMS)ED Decision 2023/009/R

The amount of information that should be documented to maintain compliance with the objectives ofthis Regulation may vary between organisations due to various factors, such as size and complexity,or the need for harmonisation with other management processes already in place. As generalguidance, taking into account the documents required to comply with point IS.D.OR.200(a), therecord-keeping requirements referred to in IS.D.OR.245 and the information security management
manual requirements referred to in IS.D.OR.250, the following is a non-exhaustive list of informationthat should be documented:(a)information security policy that should include the organisation’s information security
objectives — see IS.D.OR.200(a)(1);(b)

responsibilities and accountabilities for roles relevant to information security — see
IS.D.OR.250(a)(2), (3), (6) and (7) and the personnel requirements referred to in points
IS.D.OR.240(a), (b), (c), (d) and (f) and the related AMC and GM;(c)scope of the ISMS and the interfaces with, and dependencies on, other parties — see
IS.D.OR.200(a)(2) and the information security requirements referred to in points
IS.D.OR.205(a) and (b);(d)

information security risk management process — see the information security requirements
referred to in points IS.D.OR.205 and IS.D.OR.210;(e)archive of the risks identified in the information security risk assessment along with theassociated risk treatment measures (often referred to as ‘risk register’ or ‘risk ledger’) — see
IS.D.OR.245;(f)evidence of the competencies necessary for the personnel performing the activities required
under this Regulation — see IS.D.OR.240(g) and the related AMC and GM;(g)evidence of the current competencies of the personnel performing the activities required under
this Regulation — see IS.D.OR.245(b)(1);(h)(key) performance indicators derived from evidence of the monitoring and measurement of the
ISMS processes.

GM1 IS.D.OR.200(d) Information security management system(ISMS)ED Decision 2023/009/R

PROPORTIONALITY IN ISMS IMPLEMENTATION

When implementing the processes and procedures, as well as establishing the roles andresponsibilities required under point IS.D.OR.200(d), the organisation should primarily consider therisks that it may be posing to other organisations, as well as its own risk exposure. Other aspects that
may be relevant include the organisation’s needs and objectives, information security requirements,
its own processes and the size, complexity and structure of the organisation, all of which may changeover time.

Powered by EASA eRules

Page 207 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

SUPPORTED IMPLEMENTATION OF THE ISMS

In the context of Part-IS, all organisations initiate the implementation of an ISMS with determining its
scope, which in turn is based upon at least an assessment of aviation safety impacts for which
information security incidents are a cause or a contributing factor. Organisations, irrespective of theirsize, may not have yet sufficient knowledge about their information security risks, and may consider
seeking support by a service provider that can also provide additional personnel and expertise during
this implementation phase of the ISMS. The same may apply to later phases of the ISMS
implementation, and to this end organisations may want to consider the provision of IS.D.OR.235 andrelated AMC. Outsourcing specific ISMS functions, such as information security monitoring or incident
response to service providers, may help ensure that the organisation has access to experienced
personnel and expertise. Similarly, organisations may want to be supported by a service provider inperforming risk assessments.
Regarding the establishment of the appropriate personnel to implement and comply with theprovisions of this Regulation, organisations should always refer to AMC1 IS.D.OR.240(f) and
GM1 IS.D.OR.240(f), by considering that multiple responsibilities may be assigned to one person, while
always ensuring the independence of the compliance monitoring.
As an introduction to the nature of information security risks and their management, organisations
may use, as initial guidance, the NIST Interagency Report (NISTIR 7621 Rev.1) ‘Small BusinessInformation Security: The Fundamentals’.
INTEGRATION OF ISMS UNDER THIS REGULATION WITH EXISTING MANAGEMENT SYSTEMS

An organisation may take advantage of existing management systems when implementing an ISMS byintegrating it with those existing systems.
By integrating the ISMS with existing management systems, the organisation may reduce the effort
and costs required to implement and maintain the ISMS, while also ensuring consistency andalignment with the organisation’s overall management approach. Below is a non-exhaustive list of
potential synergies that can be exploited when integrating the ISMS with an existing management
system:—Leverage existing policies and procedures: an organisation may use its existing policies andprocedures as a foundation for its ISMS. This may help to ensure consistency and minimise theneed for additional documentation.

—

Align ISMS with other management systems: an organisation may align the ISMS with othermanagement systems, such as safety management systems (SMS), to ensure that the ISMS isconsistent with the organisation’s overall management approach.

—

Use existing risk management processes: an organisation may use their existing risk
management processes to identify and assess the information security risks potentially leading
to aviation safety risks.

—

Reuse existing controls: an organisation may reuse existing controls, such as access controls or
incident management process, to implement the information security controls required by the
ISMS.

—

Continuous improvement process: an organisation may use the continuous improvement
process of existing management systems to improve the ISMS over time.

Powered by EASA eRules

Page 208 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

AMC1 IS.D.OR.200(e) Information security management system(ISMS)ED Decision 2023/009/R

DEROGATION

Organisations should follow the directions provided in AMC1 IS.D.OR.205(a) and AMC1 IS.D.OR.205(b)to perform a documented information security risk assessment to seek the approval from thecompetent authority of a derogation under point IS.D.OR.200(e). In order to justify the grounds for anderogation, the risk assessment is expected to provide explanations for the exclusion of all elementsfrom the scope of the ISMS. It is up to the authority to determine whether this assessment is deemedsatisfactory for a derogation to be granted.
Organisations that would like to have the risk assessment performed by a third party should consider
the requirements of IS.D.OR.235 and the related AMC.

GM1 IS.D.OR.200(e) Information security management system(ISMS)ED Decision 2023/009/R

Any organisation that believes that it does not pose any information security risk with a potential
impact on aviation safety, either to itself or to other organisations, may consider requesting anapproval for a derogation by the competent authority following the procedure outlined in
AMC1 IS.D.OR.200(e).
An example of organisations that may consider asking for a derogation might include DOA or POA
holders that design or produce only components or parts that either are not involved in ensuring thestructural integrity of the aircraft (e.g. carpets, interiors) or have no major safety-related aircraft
functionalities, including but not limited to, aircraft software, navigation, avionics, engines, flightcontrol, landing gear, hydraulic, electrical, air, communications, etc.
The aforementioned example is only indicative of a potential scenario that might provide an initialbasis for the preparation of an information security risk assessment that justifies the exclusion of allelements of an organisation from the scope of the ISMS.

IS.D.OR.205 Information security risk assessment
Regulation (EU) 2022/1645

(a)

(b)

The organisation shall identify all of its elements, which could be exposed to information
security risks. That shall include:(1)

the organisation’s activities, facilities and resources, as well as the services theorganisation operates, provides, receives or maintains;(2)

the equipment, systems, data and information that contribute to the functioning of theelements listed in point (1).

The organisation shall identify the interfaces that it has with other organisations, and which
could result in the mutual exposure to information security risks.

Powered by EASA eRules

Page 209 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](c)

With regard to the elements and interfaces referred to in points (a) and (b), the organisation
shall identify the information security risks which may have a potential impact on aviation
safety. For each identified risk, the organisation shall:(1)

assign a risk level according to a predefined classification established by the organisation;(2)

associate each risk and its level with the corresponding element or interface identified inaccordance with points (a) and (b).

The predefined classification referred to in point (1) shall take into account the potential of
occurrence of the threat scenario and the severity of its safety consequences. Based on thatclassification, and taking into account whether the organisation has a structured and repeatablerisk management process for operations, the organisation shall be able to establish whether therisk is acceptable or needs to be treated in accordance with point IS.D.OR.210.
In order to facilitate the mutual comparability of risks assessments, the assignment of the risk
level pursuant to point (1) shall take into account relevant information acquired in coordination
with the organisations referred to in point (b).
(d)

The organisation shall review and update the risk assessment carried out in accordance withpoints (a), (b) and (c) in any of the following situations:(1)

there is a change in the elements subject to information security risks;(2)

there is a change in the interfaces between the organisation and other organisations, orin the risks communicated by the other organisations;(3)

there is a change in the information or knowledge used for the identification, analysis andclassification of risks;(4)

there are lessons learnt from the analysis of information security incidents.

GM1 IS.D.OR.205 Information security risk assessment
ED Decision 2023/009/R

Part-IS does not require the use of any specific information security framework, such as ISO, NIST, orothers to develop the risk assessment or in general to implement risk management. Each frameworkoffers different benefits and none of these frameworks is perfect for an individual organisation andshould be customised and tailored to meet the overall needs of an organisation as well as the specificneed to consider aviation safety aspects.
Organisation whose information security frameworks have achieved industry certifications canprovide this information as supporting artefacts; however, these organisations should show theapplicability of the industry certification to the scope of this Regulation (see GM1 IS.D.OR.200).
General guidance on risk management, including risk assessment, can be found in ISO/IEC 27005 andISO/IEC 31000 as well as NIST SP 800-30. Aviation organisations may also wish to consider aviationspecific guidance as defined in the risk management chapter of the latest version of EUROCAE ED201A and, as appropriate to the specific operating environment, in the chapters of EUROCAE ED-204A,
UROCAE ED-205A and EUROCAE ED-206 covering risk management.

Powered by EASA eRules

Page 210 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

AMC1 IS.D.OR.205(a) Information security risk assessment
ED Decision 2023/009/R

When conducting an information security risk assessment, the organisation should ensure that all
relevant aviation safety elements are identified and included in the ISMS scope as per IS.D.OR.200 and
related AMC.
A means to comply with the requirement in point IS.D.OR.205(a) is to perform a preliminary high-levelrisk assessment or impact assessment, carried out in accordance with a documented methodology
and following precise criteria for the inclusion in and exclusion from the ISMS scope of the elements
listed in IS.D.OR.205(a).

GM1 IS.D.OR.205(a) Information security risk assessment
ED Decision 2023/009/R

SCOPE AND BOUNDARIES IDENTIFICATIONThe organisation should develop clear and comprehensive understanding of its aviation activities andservices, the related processes and associated information systems, and the relevant data flows andinformation exchanges that define the scope of the ISMS and the boundaries for risk assessment.
Therefore, the organisation should develop corresponding documentation on resources anddependencies related to computing, networking and contracted services which have the potential toaffect the information security and safety of the functions, services, or capabilities within the scope ofthe risk assessment.
The following non-exhaustive list provides examples of items that may be considered for theidentification of the aforementioned scope and boundaries. The level of detail of the analysis can be
an iterative process, with the effort commensurate with the expected level of risk. As stated above,
the purpose is to establish understanding of all relevant assets, resources and dependencies that are
directly a part of the functions, services and capabilities through the following activities:(a)

Identification of operational inputs and outputs relevant to the functions, services andcapabilities of the organisation; these can be related to:—Internal or external sources;—internal or external leased or managed services, or other dependencies;(b)

Identification of all relevant assets (i.e. hardware, software, network and computing resources)used to create, process, transmit, store or receive the aforementioned operational inputs andoutputs;(c)

Identification of the operating environments (e.g. office, public access area, access-controlled
room etc.) and locations for all relevant assets;(d)

For each asset included in the scope, identification of the specific methods, processes andresources that will be used to manage, operate and maintain each asset throughout its life cycle,
including:—internal or contracted resources;—

contracted companies remotely managing the assets (i.e. provider of managed services).

Powered by EASA eRules

Page 211 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

AMC1 IS.D.OR.205(b) Information security risk assessment
ED Decision 2023/009/R

The organisation should, as part of the information security risk assessment, identify the interfaces it
has with other parties such as service providers, supply chains and other third parties, based on theexchange of data and information and the assets used for that exchange, which could lead to asituation where information security risks, as a result of mutual exposure, may either:—increase aviation safety risks faced by other parties; and/or—

increase aviation safety risks faced by the organisation.

GM1 IS.D.OR.205(b) Information security risk assessment
ED Decision 2023/009/R

RISK INFORMATION SHARINGInterfacing organisations should share information with each other about the potential exposure to
information security risks by following, for instance, the approach detailed in EUROCAE ED-201A,
Appendix B — B.1, B.2 and B.3. The purpose of this exchange of information is to enable organisations
to establish a matching mapping for the services identified under IS.D.OR.205(a), including all
information and data flows, in order to:(a)illustrate (e.g. through a functional diagram) the relationships of logical and physical paths
connecting the different parts involved;(b)

clearly identify all assets (i.e. hardware, software, network and computing resources) that will
be used in the exchange;;(c)identify all functions, activities and processes, including their respective information and data,
which will be created, transmitted, processed, received and stored, and associate those withthe responsible party which provides or performs those functions, activities and processes;(d)determine for these paths, constituting the so-called functional chains, the role of theinterfacing party as a producer, processor, dispatcher or consumer of the information or data
involved;(e)determine whether one interfacing party acts as an originator or receiver of a flow across suchpath.

TWO CATEGORIES OF INTERFACING ORGANISATIONSThere are two categories of interfacing organisations: those that are subject to Regulation (EU)2023/203 or Regulation (EU) 2022/1645, and those that are not.
Where the organisation has interfaces with an organisation that is subject to Regulation (EU) 2023/203
or Regulation (EU) 2022/1645, each entity:—

is responsible for the identification of the interfaces that its own organisation has with otherorganisations, and which could result in the mutual exposure to information security risks. The
entity may benefit from the sharing of risk information as this exchange allows for a moreaccurate assessment of those risks.

—remains accountable for the proper management of the information security risks within thescope of its own ISMS.

Powered by EASA eRules

Page 212 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

In all other cases, the organisation is accountable for the proper management of the information
security risks that may arise from its exposure to the interfacing entity. Where these risks need to betreated, the organisation always has the option of implementing mitigating measures and controls
within its own boundaries. In the specific case where the interfacing entity is a supplier, theorganisation may decide to manage the risks through contractual arrangements and require thesupplier to implement mitigating measures and controls within its own organisation.

GM2 IS.D.OR.205(b) Information security risk assessment
ED Decision 2023/009/R

EXAMPLES OF AVIATION SERVICES

Examples of aviation services that may be considered when determining of the ISMS scope andinterfaces are provided in Appendix III.

AMC1 IS.D.OR.205(c) Information security risk assessment
ED Decision 2023/009/R

The organisation should use a risk management framework that includes a methodology for assigningrisks with a risk level and establishing criteria for determining risk acceptance or further treatment.
The organisation should provide documented evidence of assessment of risks which have a potential
impact on aviation safety including the level of risks. The organisation should associate each risk withthe relevant elements and interfaces identified under IS.D.OR.205 (a) and (b), and document whether
the risk is acceptable or requires further treatment.
The organisation should provide the assurance that the risk assessment process is carried out with thenecessary rigour and discipline by documenting the process and its robustness. By doing so, theorganisation should consider:(a)reproducibility of the assessment’s results for similar inputs;(b)repeatability of the assessment over time in a way that the results of the different priorassessments can be compared to determine the changes;(c)

the gathering of inputs that are relevant and valid, in particular:

(d)

(1)

the information that allows the determination of the safety consequences;(2)

the information that allows the determination of the potential of occurrence of the threat
scenario;

iterative refinement over time allowing for more fine-grained threat scenarios as inputs become
available, with the aimof reducing uncertainty regarding threats, vulnerabilities, effectivenessof existing controls, and dependencies on external entities, in particular by:(1)

refining initial high-level threat scenarios with greater detail and specificity as more data
is gathered;(2)

refining data on known vulnerabilities by continuously updating information about their
exploitability and the associated consequences;(3)

reviewing the effectiveness of existing controls, and consider newly available controls;(4)

refining the understanding of the dependencies on external entities and theirimplications for the organisation’s risk profile.

Powered by EASA eRules

Page 213 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

GM1 IS.D.OR.205(c) Information security risk assessment
ED Decision 2023/009/R

RISK ASSESSMENT

The risk classification levels for the potential of occurrence of the threat scenario and severity of thesafety consequences listed below may be applied; however, this does not prevent the organisationfrom developing additional intermediate categories if it deems this necessary for risk assessments.
The organisation should specify and document the applied, organisation-specific, classification levels
with an accurate qualitative or quantitative definition in terms of a range or interval of numericalvalues in order to enable a sufficiently calibrated, consistent estimation, evaluation andcommunication within the organisation or with the interfacing entities. The potential of occurrence ofthe threat scenario may be expressed as an interval of likelihoods including the duration of theobservation. Supporting documentation and methods can be found in EUROCAE ED-203A, Chapter 3.6
which references the evaluation of the potential of occurrence of the threat scenario in the Security
Risk Assessment of EUROCAE ED-202A.
Note 1: The phrase ‘duration of the observation’ refers to the time period during which a threat
scenario is observed or monitored. It is essential in determining the likelihood of the threat scenario
occurring, since the probability of occurrence may vary depending on the length of the observation
period.
Note 2: EUROCAE ED-202A and EUROCAE ED-203A were originally developed for aircraft information
security risk assessment, but the generic principles developed in those documents can be adapted toother frameworks when deemed useful by the organisation.
In order to facilitate the mutual comparability of risk assessment methodologies between interfacingorganisations, the organisation may associate the assessment of the potential of occurrence of thethreat scenario with one of the following categories:—

High potential of occurrence: the threat scenario is likely to occur. The attack related to thethreat scenario is feasible and similar threat scenarios have occurred many times in the past.

—

Medium potential of occurrence: the threat scenario is unlikely to occur. The attack related tothe threat scenario is possible and a similar threat scenario may have occurred in the past.

—

Low potential of occurrence: the threat scenario is very unlikely to occur. The materialisation of
the threat scenario is theoretically possible; however, it is not known to have occurred.

The evaluation of the potential of occurrence of the threat scenario may be based on the following
aspects:
Protection (as defined in EUROCAE ED-203A)—

Security measures and architecture that deny access to assets: the degree to which an asset isopen to access from compromised systems—

Access to security measures: the degree to which a security measure prevents access/attack toitself from compromised systems—

Failure of mechanism: the degree to which the known implementation of a security measure
will fail to prevent an attack—

Detection methods or procedures to recognise the attack and appropriately respond to reduce
the potential of occurrence of the threat scenario

Powered by EASA eRules

Page 214 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Exposure reduction (as defined in EUROCAE ED-203A)—

Conditions under which an external access connection can be used by a user or attacker—

Limits on the functionality of an external access connection—

Organisational policies that control the time-to-feasibility for developing attack tools specific to
the product—

Vulnerability management including intelligence, scanning, treatment and retesting aimed to
discover, detect and treat reported or detected vulnerabilities in a fast, risk-prioritised mannerwith high assurance in order to reduce the attack surface—

Reduction of the severity of a successful attack (i.e. through a redundant system that canmaintain the continuity of service in case of a denial of service of a system critical for aviation
safety)Attack attempt (as defined in EUROCAE ED-203A)—

The capability of the attackers which is determined by the resources and expertise required fortheir attack
The capability of the attackers can be assessed through several ways, for instance:—

information from computer emergency response teams (CERTs) / computer security
incident response teams (CSIRTs), information sharing and analysis centres (ISACs);—

analyses of past activities, techniques and procedures (TTPs) and success rate of attacks.

For the same reason the organisation may associate the outcome of the evaluation of theseverity of the safety consequences with one of the following categories:—

High severity: those immediate or delayed scenarios that can cause or contribute to an
unsafe condition where an unsafe condition means an occurrence associated with theoperation of an aircraft in which:—a person is fatally or seriously injured;—

the aircraft sustains damage or structural failure;—

the aircraft is either missing or completely inaccessible;—

Moderate severity: those immediate or delayed scenarios that can cause or contribute tosafety incidents where an incident means any occurrence other than an accident,
associated with the operation of an aircraft, which affects or could affect the safety ofoperations;—

Low severity: those immediate or delayed scenarios that can cause or contribute tonegligible safety consequences.

Examples for high, moderate, and low severity can be found in EUROCAE ED-201A, Appendix B for
products, ATM systems and airspace.
If the organisation cannot determine the safety effect, the assessment should identify assumptions
from the risk-sharing information at interfaces with other organisations along the functional chain,leading up to the safety effect.

Powered by EASA eRules

Page 215 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Some of those assumptions can be granted with the certification of products: where assets are subject
to product certification from other aviation regulations addressing product information security, theorganisation performing the risk assessment may consider the perimeter of the product certificationas already covered. This should be acceptable under the condition that this certification is valid andthat the instructions provided by the OEM to maintain the certification validity are implemented by
the organisation.
Additional information can also be found in Regulation (EU) 2015/1018 on mandatory reporting ofoccurrences in civil aviation. Further examples of impact severity classifications for aviation domains
can be found in EUROCAE ED-201A, Appendix B — Tables B-5, B-6 and B-7.
Risk acceptance criteria
Risk acceptance criteria are critical and should be developed, specified and documented. The criteria
may define multiple thresholds, with a desired target risk level, but allowing also for the accountable
manager or, in the case of design organisations, for the head of the design organisation, or delegatedpersons to accept risks above this level under defined circumstances and conditions.
In order to facilitate the mutual comparability of risk assessments between interfacing entities, theorganisation should classify the risks in the following categories:—

unacceptable risk;—

conditionally acceptable risk;—

acceptable risk.

For what concerns the conditional acceptance of risks, the criteria for acceptance should take into
account how long a risk is expected to exist (temporary or short-term activity or exposure), or may
include requirements for the commitment of future treatments to reduce the risk at an acceptablelevel within a defined time duration and show how the risk will be managed over time through theorganisation’s risk governance processes.
Moreover, risks should be conditionally accepted only under the condition that the organisation
demonstrates the presence of a comprehensive risk management structure that includes risk
assessment, risk treatment and risk monitoring processes for operations. The risk management should
consider the variability and consistency of threat likelihood, vulnerability, existing controls, external
dependencies and safety impact. This is typically achieved when the organisation reaches a higher
level of maturity that is representative of functionality and repeatability of information security risk
management — see GM1 IS.D.OR.260(a).
The following Figure 1 depicts a risk acceptance matrix based on the aforementioned categories thatcan be used by interfacing organisations for mutual comparability.

Powered by EASA eRules

Page 216 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Figure 1: Example of a risk acceptance matrix for comparison purposes* The potential of occurrence of the threat scenario is reassessed in a timely manner (refer to
IS.D.OR.205(d)) and monitored to ensure that it remains low and that if the risk materialises, it is early
detected and dealt with.

A comprehensive risk management structure typically entails the following aspects and processes:—

a repeatable and reproduceable risk assessment. If the risk factors are considered fairly
uncertain and within some wide value range or not sufficiently precise, further iterations of therisk assessment are performed involving additionally gathered or detailed information and amore in-depth assessment in order to reduce uncertainty and increase precision;—a thorough review of those risks proposed to be conditionally acceptable that is performed by
the accountable manager or, in the case of design organisations, by the head of the designorganisation, or delegated person(s) who may impose additional conditions for the risk
retention, including risk treatment measure and the timeline for its implementation;—

strict monitoring of the key risk indicators that includes a defined, reliable detection of thepotentially evolving risk materialisation;—

an incident response scheme is in place with reactive measures that are triggered by detection
mechanisms in order to immediately contain the consequences, in particular, for risk scenarios
involving a high severity level.

Note: As detailed in NIST SP-800 Rev.1, repeatability refers to the ability to repeat the assessment in
the future, in a manner that is consistent with and hence comparable to prior assessments —enabling
the organisation to identify trends. Therefore, a risk assessment process can be classified as‘repeatable’ when under similar conditions an entity or a person delivers consistent results.
As detailed in NIST SP-800 Rev.1, reproducibility refers to the ability of different experts to produce
the same results from the same data. Therefore, a risk assessment process can be classified as‘reproducible’ when another entity or person, given the same inputs, assumptions, information
security context and threat environment can replicate the same steps and reach the same conclusions.

Powered by EASA eRules

Page 217 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Threat scenario identification
A threat scenario is one of the possible ways a threat could materialise. Typically, a threat scenario
describes a potential attack targeting one or more vulnerabilities of assets, as well as processes.
The purpose of the threat scenario identification under this Regulation is to develop a list of scenariosthat may lead to an information security threat having an impact on aviation safety.
A threat scenario, in general, is characterised by the following:—a threat source of the information security attack;—an attack vector and a path through the organisation up to the asset;—

the information security controls that would mitigate the attack;—the consequence of the attack including the affected safety aspects.

Threat scenario identification guidance can be found in EUROCAE ED-202A, Chapter 3.4. This is not
the only source where guidance can be found, and the organisation may refer to different guidance
more appropriate for their application.
Additional methods to identify relevant threat scenarios
When conducting this analysis, both information security and safety aspects should be coordinatedthroughout the process to ensure mutual understanding of the threat preventive measures andmitigating measures being applied. In the following Figure 2 the interactions between information
security and aviation safety are depicted through a ‘bow-tie’ diagram that highlights the links between
risk controls and the underlying management system.

Figure 2: Interactions between information security and aviation safety risk management areas

Note: A preventive barrier or measure is a proactive action or control implemented to reduce thelikelihood of a risk, hazard, or threat materialising while a mitigating measure is an action or control
designed to reduce the severity or impact of an undesired event, would it occur.

Powered by EASA eRules

Page 218 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Examples of threat scenarios
Threat catalogues may provide guidance and elements for the elaboration of threat scenarios that are
relevant for the organisation. References can be found in ARINC 811 – Att. 3 – Tables 3-7 and 3-8 forthe threat catalogues examples and other threat catalogue examples as they are provided by EU
institutions — for example, the ENISA threat taxonomy. However, this is not an exhaustive list of
examples, and the identification of threat scenarios should therefore not be limited to those examples
only. In addition, other relevant resources containing information on information security threats andthe information security threat landscape should be consulted to support the risk assessment processwith relevant inputs.
A set of examples of threat scenarios can be found in Appendix I.

AMC1 IS.D.OR.205(d) Information security risk assessment
ED Decision 2023/009/R

The organisation should take into account the following criteria when establishing compliance withthe objectives contained in point IS.D.OR.205 (d):(a)

The risk assessment performed under points IS.D.OR.205 (a), (b) and (c) should be reviewed atregular intervals to identify and account for relevant changes. The periodicity at which potentialchanges have to be evaluated should be determined by the organisation performing theassessment considering the criticality of the assets within the scope of the risk assessment,
levels of residual risk of the assets within the scope of the risk assessment and any contractualor regulatory requirements. A higher criticality or level of risk will require more frequent review.

(b)

The periodicity of risk assessment reviews should be documented by the organisation andinclude the justification, date of approval and information about the risk owner.

GM1 IS.D.OR.205(d) Information security risk assessment
ED Decision 2023/009/R

The criteria to consider for the frequency of the risk assessment review may be the risk level as wellas the criticality and complexity of the assets concerned. The objective of a risk assessment review isto trigger the revaluation of risks, their likelihood and impact in case of relevant changes. One possible
way is to have a tiered approach to risk assessment, with a higher-level risk assessment being used forthe identification of changes. The higher-level risk assessment could allow the identification of thedetailed risks that should be reviewed in a next step. Risk assessments should be subject to regularreviews to:(a)allow for continuous improvement of the quality of risk assessment;(b)ensure efficiency and effectiveness of risk controls and mitigating measures in both their designand operation;(c)review plans and actions for risk treatment;(d)identify any organisational change which may require a review of the priorities as well as of thetreatment of risks;(e)maintain an overview of the complete risk picture; andPowered by EASA eRules

Page 219 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](f)

identify any emerging risks.

Risk assessment reviews should involve the risk owners, project teams and other stakeholders asapplicable. Evidence of risk assessment review should be documented and should include:—

evidence of approval of the review by the designated risk owner; and—the rationale behind or basis for the risk owner’s approval of the review.

Such evidence may comprise, but is not limited to:—reports which constitute a form of documentation to track information security risks potentially
impacting an organisation;—

the documentation of the information security risk assessment;—

exerts from a business or security risk register.

The periodicity of risk assessment reviews should also be documented by the organisation in
information security manuals, processes or procedures and should align with wider change
management activities and management reviews of information security. Further guidance on criteria
and frequency of risk assessment review can be found in EUROCAE ED-201A, Chapter 4, as well as in
EUROCAE ED-205A, Chapter 3.2 (for ATMS/ANS).

GM2 IS.D.OR.205(d) Information security risk assessment
ED Decision 2023/009/R

The following are examples of changes that should be identified during the risk assessment review asthey may trigger an update of the risk assessments:
(a)

(b)

there is a change in the elements subject to information security risks as identified in
IS.D.OR.205(a); a change in the elements will include:—

additions to, or removals from, the scope of the risk assessment of individual elements;—changes to design or configuration of elements within the scope of the risk assessmentthat have the potential to alter the risk assessment outcomes; or—changes to values, which would potentially trigger changes to impact levels, of elements
within the scope of the risk assessment;

there is a change in the interfaces between the organisation and other organisations with which
the organisation shares information security risks or relies upon to mitigate information security
risks (e.g. supply chains, service providers, cloud providers and customers), as identified in
IS.D.OR.205(b), or between the system within the scope of the risk assessment and any otherinterconnected systems, or in the risks notified to the organisation by other organisations, as
identified in IS.D.OR.205(b), or owners or managers of the other systems including:—establishment of new interfaces;—

removal of existing interfaces;—changes to existing interfaces that would have the potential to alter the risk assessment
outcomes.

Powered by EASA eRules

Page 220 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Note: Some organisational or system interconnections may be with organisations that are notwithin the scope of this Regulation as defined in Article 2 and therefore are not subject to therequirements of Part-IS. Where this is the case, these organisations should be informed of their
responsibility to report such changes as listed above through contractual arrangement andreporting requirements between the affected organisations on a case-by-case basis and whereapplicable;
(c)

(d)

there is a change in the information or knowledge used for the identification, analysis andclassification of risks including:—changes to threats and their values or addition of new threats that have not previously
been assessed;—changes to vulnerabilities or addition of new vulnerabilities that have not previously beenassessed;—changes in impacts or consequences of assessed threats or vulnerabilities;—changes in aggregation of risks that may result in unacceptable levels of risks;—changes or improvements in the risk management process, risk assessment approach andrelated activities;—changes or improvements in the treatments of risks;—changes in the criteria used to determine acceptance and treatments of risks;

there are lessons learned from the analysis of information security incidents including:—understanding why and how incidents have occurred; and—reviewing all types of incidents including those due to external factors, technical reasons,human errors (inadvertent behaviour). For human intentional acts a distinction can bemade between malign and benign actions.

IS.D.OR.210 Information security risk treatment
Regulation (EU) 2022/1645(a)

The organisation shall develop measures to address unacceptable risks identified in accordancewith point IS.D.OR.205, implement them in a timely manner and check their continued
effectiveness. Those measures shall enable the organisation to:(1)

control the circumstances that contribute to the effective occurrence of the threat
scenario;(2)

reduce the consequences on aviation safety associated with the materialisation of thethreat scenario;(3)

avoid the risks.

Those measures shall not introduce any new potential unacceptable risks to aviation safety.

Powered by EASA eRules

Page 221 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](b)

The person referred to in point IS.D.OR.240(a) and (b) and other affected personnel of theorganisation shall be informed of the outcome of the risk assessment carried out in accordancewith point IS.D.OR.205, the corresponding threat scenarios and the measures to be
implemented.
The organisation shall also inform organisations with which it has an interface in accordancewith point IS.D.OR.205(b) of any risk shared between both organisations.

GM1 IS.D.OR.210 Information security risk treatment
ED Decision 2023/009/R

Unacceptable risks identified in accordance with point IS.D.OR.205 require a risk treatment processthat may lead to the introduction of information security measures, often referred to as information
security controls.
For each identified risk, the organisation should define the specific risk treatment measures, methods
or resources that will be used over the life cycle of each asset to:—

manage risk reduction;—

monitor and maintain each asset;—

update and fulfil activities for configuration management;—

manage supply chain;—manage contracted services or service provider.

The review of risk treatment measures should include life cycle considerations which are introducedby equipment, procedures and personnel.
A risk treatment plan as an outcome of the risk management process should include a prioritisationof risks, the corresponding information on the objectives and means for risk treatment to reach an
acceptable level of risk, as well as agreed timelines specifying when responsible personnel should have
implemented the risk treatment measures. The timelines for the implementation of a risk treatment
measure should be agreed by the personnel responsible for the implementation and should becommunicated to and accepted by the accountable manager or, in the case of design organisations,by the head of the design organisation, of the organisation or delegated person(s).
Any subsequent implementation delay, together with its cause, reason, rationale or necessity, should
be documented in the risk treatment plan, for risks that may lead to an unsafe condition. The updated
risk treatment should be communicated to the competent authority in case the materialisation of risk
would lead to an unsafe condition. The delay is also subject to the acceptance by the accountable
manager of the organisation, or by the head of the design organisation, or delegated person(s). This
person may condition such acceptance on the implementation or availability of compensating controls
or reactive measures to monitor, early detect and timely respond to the materialisation of the risk intreatment. In order to timely respond, the incident response team may be informed to trigger their
preparedness.
The risk treatment plan can act as a means of communication with the competent authority todemonstrate effective treatment of unacceptable risks. Similarly, this plan can be utilised tocommunicate to interfacing organisations how shared risks are controlled.

Powered by EASA eRules

Page 222 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

In accordance with IS.D.OR.205(d), a regular or conditional review of the risk assessment is necessary,and this includes the review of the risk treatment measures developed under IS.D.OR.210(a) to
identify whether they are still effective or they require adaptations.
In addition, the organisation should also consider the potential impact on the effectiveness of risktreatment measures where a shared information security risk may arise as a result of the interaction
between interfacing entities (see IS.D.OR.235 and related AMC).

AMC1 IS.D.OR.210(a) Information security risk treatment
ED Decision 2023/009/R(a)

The risk treatment process should reach at least one of the objectives listed under
IS.D.OR.210(a).

(b)

When establishing compliance with the objectives under points IS.D.OR.210(a)(1) and
IS.D.OR.210(a)(2), the organisation should take into account that:

(c)

(1)

the measures developed under these points should be implemented according to a risktreatment plan with defined, risk-based priorities, objectives and agreed timelines andowners;(2)

life cycle considerations should be identified and associated to ensure continuous
effectiveness of the information security measures including exchange of data with otherentities;(3)

it should review and update the risk assessment, according to IS.D.OR.205(d), to evaluate
whether the measures developed under these points introduce new unacceptable risks
or modify existing risks in a way that they become unacceptable.

Risk treatment should be documented and recorded, for example, in a risk registry, even if therisk has been avoided.

IS.D.OR.215 Information security internal reporting scheme
Regulation (EU) 2022/1645(a)

The organisation shall establish an internal reporting scheme to enable the collection andevaluation of information security events, including those to be reported pursuant to point
IS.D.OR.230.

(b)That scheme and the process referred to in point IS.D.OR.220 shall enable the organisation to:(1)

identify which of the events reported pursuant to point (a) are considered information
security incidents or vulnerabilities with a potential impact on aviation safety;(2)

identify the causes of, and contributing factors to, the information security incidents andvulnerabilities identified in accordance with point (1), and address them as part of theinformation security risk management process in accordance with points IS.D.OR.205 andIS.D.OR.220;(3)

ensure an evaluation of all known, relevant information relating to the information
security incidents and vulnerabilities identified in accordance with point (1;)(4)

ensure the implementation of a method to distribute internally the information asnecessary.

Powered by EASA eRules

Page 223 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](c)

Any contracted organisation which may expose the organisation to information security risks
with a potential impact on aviation safety shall be required to report information security
events to the organisation. Those reports shall be submitted using the procedures establishedin the specific contractual arrangements and shall be evaluated in accordance with point (b).

(d)

The organisation shall cooperate on investigations with any other organisation that has asignificant contribution to the information security of its own activities.

(e)

The organisation may integrate that reporting scheme with other reporting schemes it has
already implemented.

AMC1 IS.D.OR.215(a)&(b) Information security internal reporting
schemeED Decision 2023/009/R

Organisations should use as a source the incidents detected during activities performed to showcompliance with IS.D.OR.220(a). Organisations should have a mechanism to collect notifications ofevents by personnel and by sources outside the company including suppliers, partners, customers,
open-source software, and information security researchers. The mechanism for collecting
information by personnel and external sources should be easily accessible and communicated.
The organisation should collect all events gathered through the detection means for internal analysis.
Each event should be analysed to identify whether it is reportable and if so, what potential or actual
impact on aviation safety has occurred. Information security events should be considered in
combination with other events to provide correlation to identify incidents or vulnerabilities with apotential impact on aviation safety.
The organisation should consider the outcome of the risk assessment and the exploitability of newvulnerabilities discovered during the detection activities conducted according to the measuresrequired in IS.D.OR.220(a).
The organisation should identify all internal stakeholders that require notification of a specific incident
or vulnerability and ensure that these stakeholders receive all necessary information on the incident
or vulnerability in order to act effectively and in a timely manner to support the required detection
and response periods.

GM1 IS.D.OR.215(a)&(b) Information security internal reporting
schemeED Decision 2023/009/R

RELATIONSHIP BETWEEN INTERNAL AND EXTERNAL REPORTING

Organisations should collect and report internally incidents and vulnerabilities aiming at covering all
items within the scope of this Regulation. Both internal and external reporting are necessary for acomplete and effective reporting system. Internal reports should be assessed in a timely manner andwhere the potential impact on safety is an unsafe condition, organisations should initiate reporting ofthese internal reports according to IS.D.OR.230.

Powered by EASA eRules

Page 224 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

GM2 IS.D.OR.215(a)&(b) Information security internal reporting
schemeED Decision 2023/009/R

ORGANISATION OF COLLECTION AND EVALUATION OF INFORMATION SECURITY EVENTS

It is a common practice in large organisations to centralise information security operations in a security
operations centre (SOC) and make use of an information security information and event management(SIEM) system. A SIEM system collects all events from sources such as log files in a common databaseand allows the analysts and responders in a joint SOC to review and act on these events. Organisations
may choose to use a SOC for events relevant to Part-IS in isolation or in combination with events not
subject to Part-IS but of interest to the organisation, such as events relating to business interests.
Events can be automatically aggregated, correlated and analysed in order to detect abnormal
behaviour leading to information security incidents.
Organisations that do not have a SOC capability and do not use a SIEM system need to consider how
to establish processes to meet the required collection and evaluation capabilities as well as detection
and response times.

GM3 IS.D.OR. 215(a)&(b) Information security internal reporting
schemeED Decision 2023/009/R

RELEVANT INFORMATION FOR INCIDENTS AND VULNERABILITIESUnderstanding the causes of, and contributing factors to, information security incidents andvulnerabilities relevant to Part-IS allows lessons learned to be gained and to introduce corrections toprocesses and asset design. However, understanding causes and contributing factors may not always
be possible or may not aid in continuous improvement of aviation safety. Where vulnerabilities arise
from assets developed solely or primarily for aviation, it is expected to be possible to perform thenecessary investigation on the root causes. These root causes will inform the affected organisation(s)to improve processes and asset design to remediate vulnerability and to ensure that such
vulnerabilities are not introduced in other assets. Understanding the root causes of vulnerabilities also
allows the aviation community to learn and thus avoid similar vulnerabilities in the future.

GM1 IS.D.OR.215(c) Information security internal reporting scheme
ED Decision 2023/009/R

If contracted organisations are also subject to this Regulation, the exchange of information andreporting should be covered under the management of shared risks and through the establishment ofan external agreement between the organisations. Guidance regarding the development of external
agreements can be found in EUROCAE ED-201A, Chapter 4.4 External agreements.
More in general, and in all other cases, any service contract should include standard clauses
concerning obligations for the contracted organisation to:—report within an agreed time information security incidents that may have an impact on thecontracting organisation. Incidents and vulnerabilities which could lead to unsafe conditions
should be reported as soon as possible and in such a manner that the external reporting
obligation under IS.D.OR.230 can be ensured;—designate a point of contact for the incident management and possible crisis management.

Powered by EASA eRules

Page 225 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

In some cases contracted organisations, such as service providers with distributed resources, may not
be able to offer any ad hoc reporting. In these cases the internal reporting requirement may be fulfilled
through other means that satisfy the objective of this provision. For instance, the contractedorganisations may provide an up-to-date list of vulnerabilities affecting the systems within the scopeof the contracted services. This list should be monitored by the contracting organisation as part of theinternal reporting of information security events.

GM1 IS.D.OR.215(d) Information security internal reporting scheme
ED Decision 2023/009/R

The cooperation under point IS.D.OR.215(d) can be substantiated by sharing elements from incident
records that can support other organisations’ information security activities. In case the organisations
are bound by contractual obligations, this contract may also include commitment to cooperate.
Organizations may consider developing formal agreements (e.g. memorandum of understanding)outlining roles and responsibilities for information security collaboration such as governancemeetings, joint development activities, and real-time indicators of compromise (IoC) sharing.
Moreover, commitment to cooperate may also be achieved through the active participation of theorganisation in information security sharing initiatives; for instance, ISAC(s). Additionally, for their own
awareness, organisations may also subscribe to receive vulnerability and threat alerts, like those
distributed by CERTs.

IS.D.OR.220 Information security incidents — detection, response
and recovery
Regulation (EU) 2022/1645

(a)

(b)

Based on the outcome of the risk assessment carried out in accordance with point IS.D.OR.205
and the outcome of the risk treatment performed in accordance with point IS.D.OR.210, theorganisation shall implement measures to detect incidents and vulnerabilities that indicate thepotential materialisation of unacceptable risks and which may have a potential impact onaviation safety. Those detection measures shall enable the organisation to:(1)

identify deviations from predetermined functional performance baselines;(2)

trigger warnings to activate proper response measures, in case of any deviation.

The organisation shall implement measures to respond to any event conditions identified inaccordance with point (a) that may develop or have developed into an information security
incident. Those response measures shall enable the organisation to:(1)

initiate the reaction to the warnings referred to in point (a)(2) by activating predefinedresources and course of actions;(2)contain the spread of an attack and avoid the full materialisation of a threat scenario;(3)

control the failure mode of the affected elements defined in point IS.D.OR.205(a).

Powered by EASA eRules

Page 226 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](c)

The organisation shall implement measures aimed at recovering from information security
incidents, including emergency measures, if needed. Those recovery measures shall enable theorganisation to:(1)

remove the condition that caused the incident, or constrain it to a tolerable level;(2)

reach a safe state of the affected elements defined in point IS.D.OR.205(a) within arecovery time previously defined by the organisation.

GM1 IS.D.OR.220 Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

Without prejudice to the definition of ‘information security event’ in Article 3 of Regulation (EU)2022/1645, those events that indicate the potential materialisation of unacceptable risks include both
occurrences (i.e. anything that causes harm or have the potential to cause harm) and discovery ofvulnerabilities. In fact, information security risks are associated with the potential that threats will
exploit vulnerabilities, therefore the discovery of an exploitable vulnerability is an information security
event.
In light of this, in the context of this Regulation:—

detection activities required under IS.D.OR.220(a) include vulnerability discovery;—

response activities under IS.D.OR.220(b) include vulnerability management.

AMC1 IS.D.OR.220(a) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

DETECTION

When complying with the requirement in IS.D.OR.220(a), the organisation should define andimplement a strategy to detect information security incidents which may have a potential impact onsafety.
This should be done in a way to ensure that at least the detection strategy is able to cover all known
information security threats to their assets that may materialise in a safety hazard having
unacceptable consequences.
DETECTION STRATEGY

In order to determine the scope of the event detection, the organisation should:(a)identify a list of threat scenarios from the risks identified under IS.D.OR.205;(b)

identify, as a minimum, those assets that, if compromised, contribute to the scenario(s) that
may materialise in an unsafe condition. For this identification of the assets, the measures
introduced under IS.D.OR.210 should also be considered.

Powered by EASA eRules

Page 227 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Note: The contribution of an asset to the threat scenario and the materialisation of an unsafe
condition should be assessed by considering also the whole functional chain. In some cases, the asset
may be at the end of a functional chain and if it is compromised, the effect on safety is direct and may
be immediate; conversely, if the asset is far from the end of a functional chain and it is compromised,the effect should propagate and may be delayed.

GM1 IS.D.OR.220(a) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

DETECTION STRATEGY

When developing the detection strategy, for those items within the scope of event detection, theorganisation should define the conditions that trigger a process that, for example, would require
personnel intervention and further analysis. These conditions on the items may be defined using
elements from the:(a)expected functional baseline: engage in the identification of deviations from the expectedfunctional operation of the system (excluding information security functions/controls);(b)expected information security baseline: engage in the identification of deviations from theexpected information security operation of information security controls.

These conditions should consider both abnormal behaviour and substantial deviations from thebaselines and relevant correlation of multiple independent events.
Further guidance on the objectives for the establishment of a detection strategy can be found in
EUROCAE ED-206, Chapter 4.

AMC1 IS.D.OR.220(b) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R(a)

INCIDENTS
The organisation should take into account the following aspects when establishing compliancewith the objectives contained in point IS.D.OR.220(b) relative to incidents:(1)

Preparation of procedures and delineation of roles and responsibilities to respond in atimely, effective and orderly manner to any relevant information security incidents.

(2)

The response procedure should:(i)consider the warnings, unitary or combined, from IS.D.OR.220(a)(ii)

establish, in accordance with IS.D.OR.220(b)(2), a containment strategy for each
asset category considering the potential worst-case effect and the mission
constraints, and provide criteria indicating when the incident is contained;(iii)

define, in accordance with IS.D.OR.220(b)(3), the acceptable impact on safety andinformation security of each asset within the scope when they fail due to thematerialisation of a threat scenario.

Powered by EASA eRules

Page 228 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](3)

The response time should be commensurate with the impact level assessed in (2)(iii).

(4)

The response measures implemented under IS.D.OR.220(b) should be based on the
response procedure referred to in the point (a)(2) and they should, in particular, consider
the following:

(5)

(b)

(i)

the maximum acceptable safety level degradation of the assets within the scope ofincident;(ii)

the actions, such as resistance, containment, deception and control of the possible
ways systems can fail, which will contribute to achieving the acceptable safety level
degradation identified in point (i) while minimising the impact on operations;(iii)

the resources required to implement the actions specified in point (ii).

The response time and the measures should take into account the potential immediate
negative impact on safety if the measure is taken before it has been fully verified that it
would not cause additional immediate safety impacts.

VULNERABILITIESThe organisation should take into account the following aspects when establishing compliancewith the objectives contained in point IS.D.OR.220(b) relative to vulnerabilities:(1)

Establishment of a vulnerability management strategy defining procedures, roles andresponsibilities to respond in a timely, effective and orderly manner to any detected
relevant vulnerabilities.

(2)

The response measures implemented under point IS.D.OR.220(b) should be based on the
maximum acceptable risk of the items within the scope of the vulnerability, considering
the worst-case scenario of the vulnerability being exploited.

(3)

The response time should be commensurate with the pre-triage done on the warnings
and the assessment of the potential impact of the vulnerability, if it is exploited.

GM1 IS.D.OR.220(b) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

An attack is considered contained (i.e. it is not spreading any further) when the boundaries of theincident have been identified and the threat does not propagate beyond these boundaries. Further
guidance can be found in EUROCAE ED-206, Chapter 5.
The term ‘warning’ as used in IS.D.OR.220 should be understood as an alert that would require timely
awareness and response from the information security events management team.
In the context of information security response, ‘deception’ refers to a range of techniques that aim
to mislead potential attackers or malicious users, thereby protecting the system and its data.
Deception techniques, such as honeypots or breadcrumb trails, are designed to confuse, slow down,
or divert attackers, increasing their cost and risk while providing defenders with valuable time andintelligence.
Guidance regarding the vulnerability management strategy can be found in EUROCAE ED-206, Chapter
3.4 — Vulnerability management considerations. This is not the only source where guidance can befound, and the organisation may refer to different guidance more appropriate for their application.
Powered by EASA eRules

Page 229 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

AMC1 IS.D.OR.220(c) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

When complying with the requirement in IS.D.OR.220(c), the organisation should develop an incident
recovery procedure including at least the following:(a)a list of those assets that enable safe operations, as well as the dependencies among them,constituting the scope of the recovery;(b)a description of the process with the necessary priority actions to be executed for a return to asafe and secure state for the assets within the scope of the recovery;(c)

the resources required to execute the actions defined in point (b) to ensure that these resources
are readily available after an incident has occurred;(d)the objectives for recovery time that should be set in relation to the safety criticality of theassets within the scope of the recovery.

GM1 IS.D.OR.220(b)&(c) Information security incidents —detection, response and recovery
ED Decision 2023/009/R

RECOVERY OBJECTIVES AND TIMING

Point IS.D.OR.220(b) addresses event conditions which may develop or have developed into
information security incidents, that may have a potential impact on aviation safety, and require
response and recovery measures to be in place to ensure that operational safety remains above aminimum acceptable level..
The level of operations and safety may be interrelated, so in some cases when the level of operations
is compromised by an information security incident and drops, the level of safety does the same. Thisis, for instance, the case of air traffic control; if air traffic services are reduced or become unreliable,
the safety of flights is reduced too.
However, in other cases the relation between the level of operations and safety may be the inverse,or they may be decoupled, so when an incident occurs and the level of operations drops, the level ofsafety is preserved. One example is the compromise of the software loading process on board theaircraft. In this case, a detected incident followed by the decision to interrupt the software loading
operations would preserve the existing level of safety.
The following Figure 1 depicts a conceptual framework that may be considered for the definition of
the response and recovery objectives, including the recovery time. It represents, in the worst-casescenario, how the expected level of operational safety (safety level) for a process or an activity mayvary over time when an information security incident occurs. In this scenario, the safety level is first
reduced by the incident and then it degrades as long as the time passes. The figure also shows the
expected effect that mitigating measuress and controls should have, respectively: in containing theoperational safety drop as soon as an incident occurs, and in improving the recovery, i.e. the returnto the expected safety level.

Powered by EASA eRules

Page 230 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Figure 1: Conceptual framework for the definition of the response and recovery objectives

As mentioned, there might be different relations between the level of operations and safety thatwould lead to a different representation of the above figure. In certain cases, an incident may have adelayed effect on the safety level (e.g. a compromised development environment) as depicted in
Figure 2, or it may have no impact if properly controlled, as in the case of the compromised software
loading process mentioned before, which is depicted in Figure 3.

Moreover, it should be noticed that there might be different ways the same incident can be dealt with,since there are several factors that may affect safety.

Powered by EASA eRules

Page 231 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

In practical terms, the objectives for recovery time referred to in AMC1 IS.D.OR.220(c) may be
expressed as a list of resources and services to be restored by order of priority, within the scope ofthe recovery. Guidance about objectives for recovery time can be found in EUROCAE ED-206, Chapter
7.3.5.

GM1 IS.D.OR.220(c) Information security incidents — detection,
response and recovery
ED Decision 2023/009/R

A recovery procedure or recovery plan should describe incident recovery actions and the internal orexternal resources that are involved (e.g. staff, IT, buildings, providers). Guidance about incident
recovery plan can be found in EUROCAE ED-206, Chapter 7 – Recover.
The resources required to apply the recovery measures should be available in order to implement therecovery actions in a timely manner after an incident has occurred. Those resources may be internallyavailable or provided by contracted organisations as provided for in IS.D.OR.235. The contracting ofrecovery activities should be established before an incident occurs (proactive), and the contract
should include provisions for the contracted party to react in a timely manner.
The return to a safe and secure state may initially require emergency measures, which are actions thatare initiated based on the best information available at the time, before complete understanding of
the situation is achieved and these measures can potentially degrade the level of service orfunctionalities. The return to a safe and secure state should be evaluated against the initial risk
assessment and may only temporarily differ from the normal operational conditions. However, any
increase of the residual risk and the duration of this risk increase, i.e. due to the implementation of
emergency measures, should be documented and accepted at the right level of accountability.
The recovery activities mentioned here may also be the outcome of the response to incidents forwhich the organisation has received information that requires the implementation of adequate
measures in order to react to information security incidents or vulnerabilities with a potential impact
on aviation safety.
In such context the organisation may not have a process or a recovery plan covering the specificoccurrence. Therefore, the definition from the organisation of a specific recovery plan and its approvalby the competent authority is usually required.

IS.D.OR.225 Response to findings notified by the competentauthority
Regulation (EU) 2022/1645

(a)

(b)

After receipt of the notification of findings submitted by the competent authority, theorganisation shall:(1)

identify the root cause or causes of, and contributing factors to, the non-compliance;(2)

define a corrective action plan;(3)

demonstrate the correction of the non-compliance to the satisfaction of the competentauthority.

The actions referred to in point (a) shall be carried out within the period agreed with thecompetent authority.

Powered by EASA eRules

Page 232 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

AMC1 IS.D.OR.225 Response to findings notified by the competentauthority
ED Decision 2023/009/R

The compliance with IS.D.OR.225 should be managed as required for each organisation in thecorresponding implementing regulation for the domain as identified in point Article 2(1) of Regulation(EU) 2022/1645 concerning the response to findings notified by the competent authority. The domain
regulation may require the organisation to respond to the findings in accordance with theircategorisation.

GM1 IS.D.OR.225 Response to findings notified by the competentauthority
ED Decision 2023/009/R

The requirement for the categorisation of findings and the period within which the actions in
IS.D.OR.225(a) should be performed can be found in the corresponding implementing regulation forthe domain, under the authority requirements. For the opening of findings related to this Regulation,
the competent authority will follow the above-mentioned requirement.

IS.D.OR.230 Information security external reporting scheme
Regulation (EU) 2022/1645(a)

The organisation shall implement an information security reporting system that complies withthe requirements laid down in Regulation (EU) No 376/2014 and its delegated andimplementing acts if that Regulation is applicable to the organisation.

(b)Without prejudice to the obligations of Regulation (EU) 376/2014, the organisation shall ensurethat any information security incident or vulnerability, which may represent a significant risk toaviation safety, is reported to their competent authority. Furthermore:

(c)

(1)

where such an incident or vulnerability affects an aircraft or associated system orcomponent, the organisation shall also report it to the design approval holder;(2)

where such an incident or vulnerability affects a system or constituent used by theorganisation, the organisation shall report it to the organisation responsible for thedesign of the system or constituent.

The organisation shall report the conditions referred to in point (b) as follows:(1)

a notification shall be submitted to the competent authority and, if applicable, to thedesign approval holder or to the organisation responsible for the design of the system orconstituent, as soon as the condition has been known to the organisation;(2)

a report shall be submitted to the competent authority and, if applicable, to the design
approval holder or to the organisation responsible for the design of the system orconstituent, as soon as possible, but not exceeding 72 hours from the time the condition
has been known to the organisation, unless exceptional circumstances prevent this.
The report shall be made in the form defined by the competent authority and shallcontain all relevant information about the condition known to the organisation;

Powered by EASA eRules

Page 233 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](3)

a follow-up report shall be submitted to the competent authority and, if applicable, tothe design approval holder or to the organisation responsible for the design of the systemor constituent, providing details of the actions the organisation has taken or intends totake to recover from the incident and the actions it intends to take to prevent similar
information security incidents in the future.
The follow-up report shall be submitted as soon as those actions have been identified,and shall be produced in the form defined by the competent authority.

GM1 IS.D.OR.230 Information security external reporting scheme
ED Decision 2023/009/R

Organisations are required to report occurrences to their competent authority.
EXAMPLES

Design organisations approved by EASA: EASA is the competent authority.
Air operators certified by the competent authority of a Member State: the competent authority of theMember State is the competent authority.
SPECIAL CASES

In a situation where an organisation has two air operator certificates (AOCs) under two different EU
Member States (State A and B), the occurrences involving aircraft operating under the State A AOC
have to be reported to the State A competent authority, instead the occurrences involving aircraft
operating under the State B AOC have to be reported to the State B competent authority.
For organisations holding multiple approvals, the reporting will be done to the competent authorityof the approved part of the organisation where the incident has occurred, or the vulnerability has
been discovered. In case the incident/vulnerability affects multiple approvals, the reporting will bedone to all the competent authorities.
For organisations holding an approval but operating outside the EU (e.g. Part-145), EASA is thecompetent authority and they have to report to the Agency.
Dual-use aircraft — a vulnerability may need to be reported through both the military and civil
reporting systems if it affects a dual-use function/system. Information reported through the civil
reporting system should be sanitised (i.e. all sensitive information should be properly removed).

AMC1 IS.D.OR.230(a)&(b) Information security external reporting
schemeED Decision 2023/009/R

In order to comply with the provisions under IS.ID.OR.230 (a) and (b), the organisation should report:(a)any occurrence covered by Regulation (EU) No 376/2014 that originated from intentional
unauthorised electronic interactions;(b)information security incidents having a potential significant risk to aviation safety not covered
under Regulation (EU) No 376/2014;(c)vulnerabilities that pose a significant risk to aviation safety and are not yet adequately mitigatedin accordance with an approved vulnerability management strategy (see AMC1 IS.D.OR.220(b)).

Powered by EASA eRules

Page 234 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

From the aforementioned reports, it is the responsibility of the competent authorities under Part-IS
to ensure compliance with Article 7 of this Regulation and to submit any relevant information thatneeds to be shared with the information security competent authorities designated under Article 8 of
Directive (EU) 2016/1148.

GM1 IS.D.OR.230(a)&(b) Information security external reporting
schemeED Decision 2023/009/R

RELATION BETWEEN IS.D.OR.230(b) AND REGULATION (EU) No 376/2014

Regulation (EU) No 376/2014 of the European Parliament and of the Council lays down requirementson the reporting, analysis and follow-up of occurrences in civil aviation. Compliance with point
IS.D.OR.230(b) does not exempt organisations from compliance with Regulation (EU) No 376/2014.
For each category of reporter, Regulation (EU) No 2015/1018 defines the nature of items to be
mandatorily reported. Regulation (EU) No 376/2014 also considers voluntary reporting of other items
that are perceived by the reporter as a threat to aviation safety.
Furthermore, compliance with Regulation (EU) No 376/2014 does not exempt organisations fromcompliance with point IS.D.OR.230(b). However, this should not give rise to two parallel reporting
systems, and point IS.D.OR.230(b) and Regulation (EU) No 376/2014 should be seen ascomplementary in that respect.
In practice, this means that reporting obligations under point IS.D.OR.230(b) on the one hand andreporting obligations under Regulation (EU) No 376/2014 on the other hand are compatible. These
reporting obligations may be discharged using one reporting channel. In addition, any natural or legal
person that has more than one role subject to the obligation to report may discharge all thoseobligations through a single report. Organisations are encouraged to properly describe this in theirorganisation manual, to address cases in which the responsibilities are discharged on behalf of theorganisation.
FOLLOW-UP ANALYSIS

When the analysis of an occurrence reported under Regulation (EU) No 376/2014 later identifies thatthe root cause of, or the contributing factor to, the occurrence was an intentional unauthorised
electronic interaction, the organisation should update its notification to the competent authority.
SIGNIFICANT RISK TO AVIATION SAFETY

In line with the definition of occurrence under Article 2(7) of Regulation (EU) No 376/2014 any
information security incident or vulnerability, which may represent a significant risk to aviation safety
should be considered a reportable occurrence. Significant risk to aviation means unsafe condition, i.e.
one that can result in an accident or a serious incident (as defined in ICAO Annex 13).
Note: When assessing the possibility that the effects of an information security incident could lead toan unsafe condition, the organisation should consider the combination of effects if the incident
involves multiple systems; indeed, some assumptions about system independence that may be valid
for fortuitous occurrences may be violated by deliberate acts.

Powered by EASA eRules

Page 235 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

RELATION BETWEEN IS.D.OR.230(b)(1) AND OTHER REPORTING REQUIREMENTS OF information security
occurrences RELATED TO AVIATION PRODUCTS OR PARTS

For organisations subject to reporting requirements of information security occurrences related toaviation products or parts, compliance with the specific provisions in the implementing regulation for
their domain is considered sufficient to achieve compliance with the requirement in point
IS.D.OR.230(b)(1). For example, for organisations subject to Regulation (EU) No 748/2012, thereporting can be done in accordance with point 21.A.3A of Annex I (Part 21) to that Regulation.

AMC1 IS.D.OR.230(c) Information security external reporting
schemeED Decision 2023/009/R

Within the overall limit of 72 hours the degree of urgency for submission of a report should bedetermined by the level of the safety impact judged to have resulted from the information security
incident or discovered vulnerability. Where an occurrence is judged by the person identifying thepossible unsafe condition to have resulted in an immediate and particularly significant hazard, thecompetent authority expects to be advised immediately and by the fastest possible means (telephone,
fax, email, telex, etc.) of whatever details are available at that time.

GM1 IS.D.OR.230(c) Information security external reporting scheme
ED Decision 2023/009/R

Guidance regarding the reporting of information security incidents and vulnerabilities can be found in
EUROCAE ED-206, Chapter 6.4.2.2 — Reporting timeline and Chapter 6.4.5 — Reporting information
content. This is not the only source where guidance can be found, and the organisation may refer todifferent guidance more appropriate for their application.
Note: The person reporting an occurrence under Regulation (EU) No 376/2014 may not have thecapability to determine the nature of the occurrence. This is particularly true for information security
and the result can come from forensic analysis that determines the information security nature of theoccurrence. The evaluation will be done as part of the initial internal reporting process (seeIS.D.OR.215 and related AMC). The evaluation of the occurrence can demonstrate the possibility thatit materialises into an unsafe condition taking into account the likelihood of realisation.

IS.D.OR.235 Contracting of information security management
activities
Regulation (EU) 2022/1645(a)

The organisation shall ensure that when contracting any part of the activities referred to in point
IS.D.OR.200 to other organisations, the contracted activities comply with the requirements ofthis Regulation and the contracted organisation works under its oversight. The organisation
shall ensure that the risks associated with the contracted activities are appropriately managed.

(b)

The organisation shall ensure that the competent authority can have access upon request to
the contracted organisation to determine continued compliance with the applicablerequirements laid down in this Regulation.

Powered by EASA eRules

Page 236 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

GM1 IS.D.OR.235 Contracting of information security management
activities
ED Decision 2023/009/R

Organisations may decide to outsource certain activities to suppliers, both for their own operational
needs and for the purpose of complying with this Regulation (information security management
activities). Activities contracted for operational needs may fall within the scope of Part-IS and
therefore the relevant information security risks have to be managed in accordance with therequirements in points IS.D.OR.205 and IS.D.OR.210. Instead, information security management
activities are subject to the specific provisions of IS.D.OR.235 because matters relating to these
activities can have a major impact on the organisation.
Therefore the objectives of point IS.D.OR.235 are:(a)to protect critical and sensitive information and assets when being handled by organisations
contracted for the provision of information security management activities (includingorganisations in the supply chain) at either their facilities or the organisation facilities, or whenbeing transmitted between the organisation and contracted organisations, or being remotely
accessed by contracted organisations;(b)to prevent information security risks from being introduced through products and services
developed or provided by the contracted organisations to the organisation, in the frame of theprovision of information security management activities;(c)to ensure that information security risks are managed throughout all the stages of the relation
with the contracted organisations.

GM2 IS.D.OR.235 Contracting of information security management
activities
ED Decision 2023/009/R(a)

The contracting of information security management activities is a means to allocate tasks fromthe contracting organisation to third parties (contracted organisations). The contracting
organisation remains responsible for the oversight of the contracted organisation(s) andaccountable for compliance with this Regulation.

(b)

A contract could take the form of a written agreement, letter of agreement, service letter
agreement, memorandum of understanding, etc. as appropriate for the contracted activities.

Powered by EASA eRules

Page 237 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

GM3 IS.D.OR.235 Contracting of information security management
activities
ED Decision 2023/009/R

EXAMPLES

The following Table 1 provides some examples of information security management activities that
may be contracted in relation to the provisions referred to as in IS.D.OR.200.

Table 1: Examples of information security management activities that may be contracted
IS.D.OR.200 points related to activities

Example of contracted activity(a)(1): establishes a policy on information Information
security setting out the overall principles consultancyof the organisation with regard to thepotential impact of information security
risks on aviation safety;

security

policydrafting

and(a)(2): identifies and reviews information Identify activities, facilities and resources.
security risks in accordance with point
Identify interfaces with other organisations
IS.D.OR.205;
which could be exposed to information security
risks.
Perform risk analysis or part of it, e.g. identify
and classify information security risks.
(a)(3) defines and implements information Define, develop and implement measures.
security risk treatment measures in
Verify the initial and the continued effectivenessaccordance with point IS.D.OR.210;
of the implemented measures (e.g. redteam/blue-team exercises, penetration testing,vulnerability scanning, etc.).
Communicate to the involved stakeholders theoutcome of the risk assessment and their
responsibilities as part of the risk treatment
process.
(a)(4): implements an information security Define, develop and implement an internalinternal reporting scheme in accordance reporting scheme to enable the collection andwith point IS.D.OR.215;
evaluation of information security events andvulnerabilities of equipment, processes andservices.

Powered by EASA eRules

Page 238 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

IS.D.OR.200 points related to activities

Example of contracted activity(a)(5): defines and implements, in accordancewith point IS.D.OR.220, the measuresrequired to detect information security
events, identifies those events which areconsidered incidents with a potential
impact on aviation safety except aspermitted by point IS.D.OR.205 (e), andresponds to, and recovers from, those
information security incidents;

Define, develop and implement measures todetect events.
Define, develop and implement measures to
respond to any event conditions.
Define, develop and implement measures aimed
at recovering from information security
incidents.

Implement immediate reaction measures to a(a)(6): implements the measures that have been information security incident or vulnerability as
notified by the competent authority as an notified by the competent authority.
immediate reaction to an information
security incident or vulnerability with an
impact on aviation safety;(a)(7): takes appropriate action, in accordance Identify root cause.
with point IS.D.OR.225, to address
Define corrective action plan.
findings notified by the competent
Provide evidence of the corrective actions
authority;
implemented to close the finding.
(a)(8): implements an external reporting schemein accordance with point IS.D.OR.230 inorder to enable the competent authority
to take appropriate actions;(a)(9):

Define, develop and implement an externalreporting scheme to enable the communicationof the information security incidents andvulnerabilities of equipment, processes andservices to the competent authority and whenrequired to the design approval holder or theorganisation responsible for the design.

complies with the requirements Not applicablecontained in point IS.D.OR.235 whencontracting any part of the activities
described in point IS.D.OR.200 to otherorganisations;Powered by EASA eRules

Page 239 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

IS.D.OR.200 points related to activities(a)(10): complies
requirements
IS.D.OR.240;

with thecontained

Example of contracted activity

personnel Activities of the accountable manager / head ofinpoint design organisation in the frame of theprovisions for a ‘common responsible person’ as
referred to in IS.D.OR.240
Compliance
IS.D.OR.240

monitoringasforeseen

byContracted organisation to ensure that sufficientpersonnel is on duty to perform the activities
related to this Regulation
Define, develop and deliver adequate training toachieve the competencies required by the staff.
Perform pre-employment checks(a)(11): complies with the record-keeping Define, develop and implement secured
requirements
contained inpoint archiving.
IS.D.OR.245;
Provision of secure data centre (as a service)
Provision of records updates(a)(12): monitors compliance of the organisation Compliance monitoring (as foreseenwith the requirements of this Regulation IS.D.OR.240) including the execution
and provides feedback on findings to the independent audits
accountable manager / head of designorganisation
toensureeffective
implementation of corrective actions;byof(a)(13): protects, without prejudice to applicable Define, develop and implement solutions toincident reporting requirements, the protect the confidentiality of any information.
confidentiality of any information that theorganisation may have received fromother organisations, according to its levelof sensitivity.
(b): In order to continuously meet therequirements referred to in Article 1, theorganisation
shall
implementacontinuous improvement process inaccordance with point IS.D.OR.260.

Powered by EASA eRules

Execute independent effectiveness and maturity
assessments.
Define, develop and implement the necessary
improvement measures.

Page 240 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

IS.D.OR.200 points related to activities

Example of contracted activity(c): The organisation shall document, in
accordance with point IS.D.OR.250, all key
processes, procedures, roles andresponsibilities required to comply withpoint IS.D.OR.200(a), and shall establish aprocess for amending this documentation.
Changes to those processes, procedures,roles and responsibilities shall be
managed in accordance with point
IS.D.OR.255.

Production of documentation to detail all key
processes, procedures, roles and responsibilities
required to comply with point IS.D.OR.200(a)(e.g. information security policies, generaldescription of the staff, procedures to specify
compliance).
Define, develop and implement processes forapproving amendments and changes.

GM1 IS.D.OR.235(a) Contracting of information security
management activities
ED Decision 2023/009/R

PRIOR ASSESSMENT

The purpose of the prior assessment is to evaluate suppliers’ competencies, sustainability as well as
qualifications in relation to the information security activities to be contracted. This prior assessment
may need to be carried out taking into account other legal requirements or procurement proceduresthat apply to the organisation, and may therefore be carried out in different ways, such as:(a)in case of public bids, inclusion of eligibility requirements in the procurement documents forthe potential suppliers;(b)review of the information security certifications granted by external and impartial auditors to
the potential suppliers;(c)review of self-assessment questionnaires compiled by the potential suppliers;

RISK ASSESSMENT ASSOCIATED WITH THE PROVISION OF THE CONTRACTED ACTIVITIESThe risk assessment should take into account the maturity level of the contracted organisation, andshould consider the following:(a)identification and assessment of critical and sensitive information and assets that may beshared with, or provided by, external suppliers;(b)

identification of the information security requirements of the organisation that are applicableto the contracted organisation;(c)evaluation, by means of a supplier assessment, of the ability of the contracted organisation(both existing and new contracted organisations) to meet the information security
requirements of the contracting organisation;(d)assessment of risks that may be introduced by the contracted organisation.

This agreed risk assessment should also consider the roles and responsibilities of the contracting andcontracted organisation as well as their interfaces.

Powered by EASA eRules

Page 241 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

AMC1 IS.D.OR.235(a) Contracting of information security
management activities
ED Decision 2023/009/R(a)

OVERSIGHT OF THE CONTRACTED ORGANISATION

In order to exercise oversight of the contracted organisation, the organisation under Part-IS should
have:
(1)

a process to ensure compliance with the provisions regarding contracted activities contained inthis Regulation;(2)

a structured process to follow the expected execution of the contract that includes:(i)

definition and agreement of the scope of the activities;(ii)

definition of the roles and responsibilities of the parties (i.e. contracting and contractedorganisation).

(iii)

definition and review of key performance indicators;(iv)

reaction to deviation from contractual obligations;(v)performance of compliance audits, according to the predefined scope and objectives,with the aim of evaluating operational and associated assurance activities.

(vi)

provision of feedback on the result of the compliance audits both within the organisationand to the contracted organisation, and response to findings. The feedback on theoutcome of the compliance audits within the contracting organisation should reach theaccountable manager or, in the case of design organisations, the head of the designorganisation, or delegated person(s) to ensure proper monitoring of the response tofindings (i.e. implementation of corrective actions) or, if deemed necessary, terminationof the contract.

Note: The right of the organisation to conduct compliance audits of the contracted organisation should
be included in the contract between the parties.
(b)

MANAGEMENT OF THE RISKS ASSOCIATED WITH THE CONTRACTED ACTIVITIESIn order to properly manage the risks associated with the contracted activities, the organisation shouldmeet the following criteria:(1)

A prior assessment of the suppliers is conducted before outsourcing any information security
management activities. The assessment should evaluate suppliers’ competencies, sustainability
as well as qualifications in relation to the activities to be contracted.

(2)

There is an assessment of the risks associated with the provision of the contracted activities
that has been agreed between the organisation under Part-IS and the contracted organisation.

(3)

The organisation establishes and maintains appropriate information security communication
channels with the contracted organisation.

Powered by EASA eRules

Page 242 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

GM2 IS.D.OR.235(a) Contracting of information security
management activities
ED Decision 2023/009/R

AUDIT OF CONTRACTED ORGANISATIONS

The following aspects should be considered by the organisation when auditing a supplier contracted
to perform information security management activities:—

the scope of the audit as well as the objective should be limited to processes, resources (i.e.
contracted organisation personnel, systems/equipment, networks) and data used for the
execution of Part-IS contracted activities;—

compliance and/or implementation audits should be done at the contracting organisation’s
discretion;—

findings identified during an audit should be addressed through a remediation plan with a timeframe to be validated by the contracting organisation.

AMC1 IS.D.OR.235(b) Contracting of information security
management activities
ED Decision 2023/009/R

In order to ensure access by the competent authority to the contracted organisation upon request,
the organisation under Part-IS should ensure that such a requirement or clause is included in thecontractual documentation.
The competent authority’s access to the contracted organisations should be at least equivalent to that
granted to the contracting organisation and, in any case, sufficient to ensure the assessment ofcontinued compliance of the contracted activities with the applicable requirements.

GM1 IS.D.OR.235(b) Contracting of information security
management activities
ED Decision 2023/009/R

Access to the contracted organisation means to have visibility of evidence for compliance of thecontracted activities (such as artefacts, documents, independent certifications).
Evidence of compliance could be achieved either by transfer of documents and/or access to
information at the premises in accordance with the ‘audit scope’ as defined in the contract.
In those cases where the organisation would use commercial off-the-shelf services with standard
contractual clauses as part of the contracted information security management activities, theorganisation should consider whether these clauses provide sufficient access to the required
information.
The opportunity to visit the premises should be evaluated considering different aspects such as thesensitivity of the related information or the practical accessibility to the contracted organisation (e.g.
the contracted organisation is a service provider with distributed resources).

Powered by EASA eRules

Page 243 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

IS.D.OR.240 Personnel requirements
Regulation (EU) 2022/1645(a)

The accountable manager of the organisation or, in the case of design organisations, the headof the design organisation, designated in accordance with Regulation (EU) No 748/2012 andRegulation (EU) No 139/2014 as referred to in points 1(a) and (b) of Article 2 of this Regulation,
shall have corporate authority to ensure that all activities required by this Regulation can befinanced and carried out. That person shall:(1)

ensure that all necessary resources are available to comply with the requirements of thisRegulation;(2)

establish and promote the information security policy referred to in point
IS.D.OR.200(a)(1);(3)

demonstrate a basic understanding of this Regulation.

(b)

The accountable manager or, in the case of design organisations, the head of the designorganisation, shall appoint a person or group of persons to ensure that the organisation is incompliance with the requirements of this Regulation, and shall define the extent of theirauthority. That person or group of persons shall report directly to the accountable manager or,in the case of design organisations, to the head of the design organisation, and shall have theappropriate knowledge, background and experience to discharge their responsibilities. It shallbe determined in the procedures who deputises for a particular person in the case of lengthy
absence of that person.

(c)

The accountable manager or, in the case of design organisations, the head of the designorganisation shall appoint a person or group of persons with the responsibility to manage thecompliance monitoring function referred to in point IS.D.OR.200(a)(12).

(d)

Where the organisation shares information security organisational structures, policies,
processes and procedures, with other organisations or with areas of their own organisation
which are not part of the approval or declaration, the accountable manager or, in the case ofdesign organisations, the head of the design organisation, may delegate its activities to acommon responsible person.
In such a case, coordination measures shall be established between the accountable managerof the organisation or, in the case of design organisations, the head of the design organisation,and the common responsible person to ensure adequate integration of the information security
management within the organisation.

(e)

The accountable manager or the head of the design organisation, or the common responsible
person referred to in point (d), shall have corporate authority to establish and maintain theorganisational structures, policies, processes and procedures necessary to implement point
IS.D.OR.200.

(f)

The organisation shall have a process in place to ensure that they have sufficient personnel on
duty to carry out the activities covered by this Annex.

(g)

The organisation shall have a process in place to ensure that the personnel referred to in point(f) have the necessary competence to perform their tasks.

(h)The organisation shall have a process in place to ensure that personnel acknowledge theresponsibilities associated with the assigned roles and tasks.

Powered by EASA eRules

Page 244 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](i)

The organisation shall ensure that the identity and trustworthiness of the personnel who haveaccess to information systems and data subject to the requirements of this Regulation areappropriately established.

GM1 IS.D.OR.240 Personnel requirements
ED Decision 2023/009/R

The objectives of the requirements contained in points (a) through (e) are:(a)to ensure that an effective organisational structure is in place in order to comply with therequirements of this Regulation;(b)

to provide trust to other organisations with whom they share risks.

AMC1 IS.D.OR.240(a)(2) Personnel requirements
ED Decision 2023/009/R

PROMOTION OF INFORMATION SECURITY POLICY

The accountable manager or, in the case of design organisations, the head of the design organisationof the organisation should make sure that the information security policy is known and easily
accessible for staff members as appropriate to their duties.

AMC1 IS.D.OR.240(a)(3) Personnel requirements
ED Decision 2023/009/R

BASIC UNDERSTANDING OF THE REGULATION

In order to demonstrate a basic understanding of this Regulation, the accountable manager of theorganisation or, in the case of design organisations, the head of the design organisation should havethe ability to explain the overarching objectives of the Regulation and its implications for theorganisation.

GM1 IS.D.OR.240(a)(3) Personnel requirements
ED Decision 2023/009/R

BASIC UNDERSTANDING OF THE REGULATIONIn the event that the accountable manager or, in the case of design organisations, the head of thedesign organisation has no previous experience in the areas of activity pertinent to Part-IS, he or she
may gain the necessary understanding by attending a training covering the content the Regulation andthe technical basis for compliance. In particular, the training material should cover the overarching
objectives of Part-IS, and the assessment should evaluate the understanding of these regulatory
objectives.

Powered by EASA eRules

Page 245 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

AMC1 IS.D.OR.240(b) Personnel requirements
ED Decision 2023/009/R

APPOINTMENT OF A PERSON OR GROUP OF PERSONSThe person or group of persons appointed under point IS.D.OR.240(b) with the responsibility to ensurecompliance with the requirements of this Regulation should represent the management structure of
the organisation.
The person or group of persons has direct access to the accountable manager or, in the case of designorganisations, to the head of the design organisation (or the common responsible person, if
appointed) to provide guidance, direction and support for the planning, implementation andoperation of the process and standards to comply with the Regulation. They should have direct accessto keep the accountable manager or, in the case of design organisations, the head of the designorganisation (or the common responsible person) properly informed on compliance and information
security matters (for instance, through meetings organised on a regular basis).
Appointments should take into account the possibility that a person may not be able to carry out theorganisational tasks assigned to them for a period of time, and thus also identify the necessary
deputies.
These appointed persons should demonstrate a complete understanding of the requirements of thisRegulation, to be able to ensure that the organisation’s processes and standards accurately reflect theapplicable requirements. It is their role to ensure that compliance is proactively managed, and thatany early warning signs of non-compliance are documented and acted upon.
A description of the functions and the responsibilities of the appointed persons and deputies,
including their names, should be contained in the ISMM (see point IS.D.OR.250(a)(2)).

GM1 IS.D.OR.240(b) Personnel requirements
ED Decision 2023/009/R

A condition of a lengthy absence of an appointed person occurs when that person is unable to performthe assigned organisational duties. For example, if an information security management activity isrequired to be carried out by appointed persons at a specified interval, an absence is consideredlengthy when it exceeds this interval and therefore a vulnerability in the management activity may
arise.

GM1 IS.D.OR.240(b)&(c) Personnel requirements
ED Decision 2023/009/R

Appointments may be made by email, organisational chart, roles & responsibilities table, etc. usuallyin use by the organisation. The organisation may adopt any titles for the foregoing information security
management positions, but it should identify to the competent authority the titles and the persons
chosen to carry out these functions.

Powered by EASA eRules

Page 246 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

GM1 IS.D.OR.240(c) Personnel requirements
ED Decision 2023/009/R

COMPLIANCE MONITORING FUNCTION

The person appointed under point IS.D.OR.240(c) with the responsibility to manage the compliancemonitoring function required under point IS.D.OR.200(a)(12) may be the same person as, or report to,
the person responsible for the compliance monitoring function required under the implementing
regulation for the domain.

AMC1 IS.D.OR.240(d) Personnel requirements
ED Decision 2023/009/R

COORDINATIONThe criteria to establish coordination that ensures adequate integration of the information security
management within the organisation are the following:(a)the scope and boundaries of the organisations have been established and communicated to thecommon responsible person;(b)

the requirements of this Regulation have been communicated to and shared with the common
responsible person;(c)

the common responsible person has direct access to the accountable manager or, in the caseof design organisations, to the head of the design organisation;(d)issues are proactively managed and any early warning signs of non-compliance are documented
and acted upon.

GM1 IS.D.OR.240(e) Personnel requirements
ED Decision 2023/009/R

COMMON RESPONSIBLE PERSON

If a common responsible person (CRP) is delegated by the accountable manager or, in the case ofdesign organisations, by the head of the design organisation for the activities under this Regulation,
this person should also be given the appropriate delegation that is necessary to implement theprovisions of IS.D.OR.200, including the authority and the financial means to mobilise and control the
resources across the organisations, or parts of the organisation involved. This delegation may also
include the appointment of the person or group of persons referred to in IS.D.OR.240(b) and (c) and,in general, the CRP may be assisted in the performance of his or her duties by additional personnel.
The possibility of delegating a CRP applies to an organisation that shares information security
organisational structures, policies, processes and procedures with other organisations or with parts of
its own organisation that are not part of the authorisation or declaration, and therefore this CRP is
expected to have information security responsibilities and competencies. In particular, the CRP should
be capable of managing the organisation’s information security strategy and its implementation toensure the achievement of the objectives described in Article 1. According to the European
Cybersecurity Skills Framework (ECSF) published by ENISA in September 2022, this person may bedescribed, for instance, as (Chief) Information Security Officer, Cybersecurity Programme Director or
Information Security Manager. However, it should be noticed that these descriptions and the related
skills do not consider the aviation safety perspective that is required in Article 1.
Powered by EASA eRules

Page 247 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Where an entity holds multiple authorisations or declarations, the relevant accountable managers or,in the case of design organisations, the relevant head of the design organisations may delegate to thesame CRP, who will therefore be responsible for implementing the provisions of IS.D.OR.200 for afunctional cluster sharing information security structures, policies, processes and procedures.

AMC1 IS.D.OR.240(f) Personnel requirements
ED Decision 2023/009/R

SUFFICIENT PERSONNEL

To determine the sufficiency of the personnel, the following elements should be taken into
consideration:(a)the organisational structures, policies, processes and procedures subject to information
security management;(b)the amount of coordination required with other organisations, contractors and suppliers;(c)the level of risk associated with the activities performed by the organisation.

GM1 IS.D.OR.240(f) Personnel requirements
ED Decision 2023/009/R

SUFFICIENT PERSONNEL

For the purpose of this Regulation, personnel refers to the combination of the personnel directly
employed by the organisation, as well as the personnel contracted as specified in IS.D.OR.235.
The activities reported in Appendix II, on the main tasks stemming from the implementation of PartIS, should be considered when establishing the organisational structure necessary to comply with therequirements of this Regulation.

AMC1 IS.D.OR.240(g) Personnel requirements
ED Decision 2023/009/R

NECESSARY COMPETENCE

(a)

(b)

To determine the competence needed by the personnel performing the activities, the following
elements should be taken into consideration:(1)

work roles and the associated tasks;(2)

required knowledge, skills and abilities.

As part of the process to ensure that personnel maintain the necessary competence, theorganisation should:(1)

assess the personnel qualifications and experience with respect to the competence
required for the assigned work roles to identify gaps;(2)align the personnel qualifications and experience with the competence expected to fulfil
their roles by organising adequate learning programmes for existing members of
personnel, by recruiting new resources, or by a combination thereof;(3)

maintain the personnel competence during the time they are assigned to the work role.

Powered by EASA eRules

Page 248 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

GM1 IS.D.OR.240(g) Personnel requirements
ED Decision 2023/009/R

NECESSARY COMPETENCE AND TRAINING PROGRAMME

A training programme should start with the identification of the competence required by the
personnel for each role, followed by the identification of the gaps between the existing competence
and the required one.
In order to develop the list of competencies an organisation may use, as initial guidance, an existing
cybersecurity competence framework such as the NICE (National Initiative for Cybersecurity
Education) based on the NIST Cybersecurity Framework (NIST CSF).
In Appendix II, the main tasks of this Regulation are listed and mapped to the competences derived
from the NIST CSF. This mapping may be used to establish a baseline to identify the aforementioned
competence gaps. However, it should be noticed that existing cybersecurity/information security
competence frameworks such as the NICE typically focus primarily on the protection of standard
information technologies; therefore, the proposed list of competencies may need to be adapted tothe technologies or integrated with processes used in the organisation.
The bridging of the identified gaps should be seen as the objective of the training programme, whichshould further include the scope, content, methods of delivery (e.g. classroom training, e-learning,
notifications, on-the-job training) and frequency of training that best meet the organisation’s needs
considering the size, scope, required competencies, and complexity of the organisation.
Finally, as information security/cybersecurity evolves due to the rise of new threats, the organisation
should periodically review the adequacy of the training programme.

AMC1 IS.D.OR.240(h) Personnel requirements
ED Decision 2023/009/R

ACKNOWLEDGEMENT OF RESPONSIBILITIESRegarding any assigned role and task, the organisation should specify all information security
responsibilities an employee has in a clear and transparent manner.
As part of this, all personnel performing the activities required under this Regulation should
acknowledge, in a traceable and verifiable manner, understanding of the assigned roles and theassociated information security responsibilities.

GM1 IS.D.OR.240(h) Personnel requirements
ED Decision 2023/009/R

ACKNOWLEDGEMENT OF RESPONSIBILITIESAcknowledgement of receipt such as a valid electronic or wet signature, confirmation email, etc., is a
traceable proof of acknowledgement.

Powered by EASA eRules

Page 249 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

AMC1 IS.D.OR.240(i) Personnel requirements
ED Decision 2023/009/R

IDENTITY AND TRUSTWORTHINESSFor the personnel who have access to information systems and data subject to the requirements ofPart-IS, the identity should be determined on the basis of documentary evidence.
To establish the trustworthiness of such personnel, the organisation should have a documented
process and appropriate criteria to ensure that individuals can be trusted to perform their role.

GM1 IS.D.OR.240(i) Personnel requirements
ED Decision 2023/009/R

IDENTITY AND TRUSTWORTHINESS(a)

Trustworthiness may be established, for example, by:
(1)

(2)

prior to employment, a background check carried out in accordance with the applicable
rules of Union and national law. This check may include verification of:(i)

education, previous employment and any gaps in the previous years;(ii)

absence of criminal record;(iii)

any other relevant information or intelligence considered relevant to the suitabilityof a person to work in the expected role;

during employment, monitoring the employee’s commitment and conduct.

Note: The absence of criminal record may be verified by means of a certificate issued by the
responsible authority in the Member State in accordance with Regulation (EU) 2016/1191. In
the case of prospective foreign employees, the above checks may be carried out on the basis ofequivalent certificates issued by the country of origin, such as a ‘certificate of good conduct’.
(b)Furthermore, the process and criteria to establish personnel’s trustworthiness may have toconsider whether:(1)

the information systems and data to be accessed have been associated with a highseverity of the safety consequences with the risk assessment process under IS.D.OR.205;(2)

controls or mitigating measures for risk treatment identified during the risk analysis rely
on organisational/operational procedures — for instance, correct configuration andadministration of information technologies, database operations, information security
monitoring, etc.

In such cases, the personnel who have administrator rights or unsupervised and unlimited access tothe systems and data mentioned in (a) (1), or the personnel who applies the measures under above
point (b)(2), may be subject to more stringent criteria.
(c)Intelligence and any other relevant information may be gathered by screening and analysing
public sources such as social media and websites, within the limits set by relevant national laws
and regulations.

Powered by EASA eRules

Page 250 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](d)

Some organisations subject to Part-IS may also be subject to Regulation (EU) 2015/1998 that
requires successful completion of background checks for personnel in certain roles, as well as amechanism for the ongoing review of these checks. In such cases the organisation may consider
suitable for the establishment of the personnel’s identity and trustworthiness required under
Part-IS, in relation to their role, the process and the relevant criteria defined in Regulation (EU)2015/1998 for standard and enhanced background checks. However, it should be noted thatcompliance with the provisions for the establishment of identity and trustworthiness under
Part-IS does not constitute compliance with the provisions on background checks as defined inRegulation (EU) 2015/1998.

IS.D.OR.245 Record-keeping
Regulation (EU) 2022/1645(a)

The organisation shall keep records of its information security management activities(1)

The organisation shall ensure that the following records are archived and traceable:(i)any approval received and any associated information security risk assessment inaccordance with point IS.D.OR.200(e;)(ii)

contracts for activities referred to in point IS.D.OR.200(a)(9);(iii)

records of the key processes referred to in point IS.D.OR.200(d);(iv)

records of the risks identified in the risk assessment referred to in point
IS.D.OR.205 along with the associated risk treatment measures referred to in point
IS.D.OR.210;(v)

records of information security incidents and vulnerabilities reported inaccordance with the reporting schemes referred to in points IS.D.OR.215 andIS.D.OR.230;(vi)

records of those information security events which may need to be reassessed toreveal undetected information security incidents or vulnerabilities.

(2)

The records referred to in point (1)(i) shall be retained at least until 5 years after theapproval has lost its validity.

(3)

The records referred to in point (1)(ii) shall be retained at least until 5 years after thecontract has been amended or terminated.

(4)

The records referred to in point (1)(iii), (iv) and (v) shall be retained at least for a periodof 5 years.

(5)

The records referred to in point (1)(vi) shall be retained until those information security
events have been reassessed in accordance with a periodicity defined in a procedure
established by the organisation.

Powered by EASA eRules

Page 251 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](b)

The organisation shall keep records of qualification and experience of its own staff involved in
information security management activities(1)

The personnel’s qualification and experience records be retained for as long as the person
works for the organisation, and for at least 3 years after the person has left theorganisation.

(2)

Members of the staff shall, upon their request, be given access to their individual records.
In addition, upon their request, the organisation shall provide them with a copy of theirindividual records on leaving the organisation.

(c)

The format of the records shall be specified in the organisation’s procedures.

(d)

Records shall be stored in a manner that ensures protection from damage, alteration and theft,with information being identified, when required, according to its security classification level.
The organisation shall ensure that the records are stored using means to ensure integrity,
authenticity and authorised access.

GM1 IS.D.OR.245 Record-keeping
ED Decision 2023/009/R

Records are required to document results achieved or to provide evidence of activities performed.
Records become factual when recorded and cannot be modified. Therefore, they are not subject toversion control. Even when a new record is produced covering the same issue, the previous record
remains valid.
The ‘approval received’ referred to in point (a)(1)(i) includes any ‘certificate’ received by theorganisation when it is provided for by the implementing rule for its domain.

AMC1 IS.D.OR.245(a)(1)(vi)&(a)(5) Record-keeping
ED Decision 2023/009/R

When complying with the requirements under points (a)(1)(vi) and (a)(5), the organisation should
establish a data retention policy defining procedures to:(a)manage relevant security data files;(b)establish the periodical assessment of their content; and(c)define the criteria to allow deletion of records of information security events when the objectiveof the requirement under (a)(5) has been met.

GM1 IS.D.OR.245(a)(1)(vi)&(a)(5) Record-keeping
ED Decision 2023/009/R

The objective of the requirement under (a)(1)(vi) is to ensure detection of possible indication of
information security incidents or vulnerabilities which are not obvious by normal operation (e.g.
previously unknown situations), while the objective of the requirement under (a)(5) is to allow thenecessary flexibility to control the volume of the stored information security events.
Records of information security events include those events identified to be within the scope of thedetection activities under IS.D.OR.220(a), as well as other information security data produced byassets that have been identified under IS.D.OR.205.
Powered by EASA eRules

Page 252 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

A data retention policy clarifies what information should be stored or archived and for how long. Someguidance about data retention can be found in EUROCAE ED-206, Chapter 2.6.
Once a data set completes its retention period, it can be deleted or moved as permanent historical
data to a secondary or tertiary storage.

AMC1 IS.D.OR.245(c)&(d) Record-keeping
ED Decision 2023/009/R

When complying with the requirements under points (c) and (d) for all the records required by points
IS.D.OR.245 (a) and (b), the organisation should consider the following:(a)

Records should be kept in paper form or in electronic format or a combination of both media.
The records should remain accessible whenever needed within a reasonable time and usable
throughout the required retention period. The retention period starts when the record has beencreated.

(b)

Records data integrity, availability and authenticity should be protected in consistency withprotection of corresponding operational data, and as such, should be within the scope of the
ISMS.

(c)

Storage systems should be protected against unauthorised access (i.e. data leakage attempts
against personal data/modification of records) and thus should have information security
measures implemented in consistency with the level of information security risk associated with
them.

(d)

Once records are not required to be retained anymore, the destruction of records anddecommissioning of assets used for their storage should be implemented appropriately.

GM1 IS.D.OR.245(c)&(d) Record-keeping
ED Decision 2023/009/R

RECORDS ACCESSIBILITY THROUGHOUT THE RETENTION PERIOD

It is recommended to follow best practices for data retention and, for data that may need to berestored, backup strategies, such as the use of automated backup tools, segregation or geographic
separation of backup storage location(s), and to consider offline backups to prevent ransomware risks.
These practices should be considered also when record-keeping is contracted to service providers with
distributed resources.
Special attention should be paid to significant hardware and software changes, ensuring that storeddigital records remain accessible and readable. (e.g. file system, application file format, forward
compatible database versions, etc.). Paper-based information needs to be archived in an adequate
environment, in which records are protected against degradation factors (e.g. excessive heat, light or
humidity).
RECORDS DATA INTEGRITY AND PROTECTION FROM UNAUTHORISED ACCESS

A commonly used method to achieve authenticity and integrity protection is the use of digital
signatures at document level. Digital signatures can be added to the document’s file (e.g. PDF) toensure that a record has not been modified by someone other than its author (integrity) and that theauthor is who is expected to be (authenticity).

Powered by EASA eRules

Page 253 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Moreover, to prevent unauthorised access, records can be protected for example by implementing arole-based access control (RBAC) approach, or certain records can be password protected at the filelevel. Commercial applications feature built-in basic password protection functions for their fileformats. Access protection can also be achieved by protecting the environment where the individual
records are stored (e.g. access protection on databases, file shares, directories, etc.).

IS.D.OR.250 Information security management manual (ISMM)
Regulation (EU) 2022/1645(a)

The organisation shall make available to the competent authority an information security
management manual (ISMM) and, where applicable, any referenced associated manuals andprocedures, containing:(1)a statement signed by the accountable manager or, in the case of design organisations,by the head of the design organisation, confirming that the organisation will at all times
work in accordance with this Annex and with the ISMM. If the accountable manager or,in the case of design organisations, the head of the design organisation, is not the chief
executive officer (CEO) of the organisation, then such CEO shall countersign thestatement;(2)

the title(s), name(s), duties, accountabilities, responsibilities and authorities of theperson or persons referred to in point IS.D.OR.240(b) and (c);(3)

the title, name, duties, accountabilities, responsibilities and authorities of the common
responsible person referred to in point IS.D.OR.240(d), if applicable;(4)

the information security policy of the organisation as referred to in point IS.D.OR.200(a)
(1);

(5)

a general description of the number and categories of staff and of the system in place toplan the availability of staff as required by point IS.D.OR.240;(6)

the title(s), name(s), duties, accountabilities, responsibilities and authorities of the key
persons responsible for the implementation ofpoint IS.D.OR.200, including the person or
persons responsible for the compliance monitoring function referred to in point
IS.D.OR.200(a)(12);(7)

an organisation chart showing the associated chains of accountability and responsibility
for the persons referred to in points (2) and (6);(8)

the description of the internal reporting scheme referred to in point IS.D.OR.215;(9)the procedures that specify how the organisation ensures compliance with this Part, andin particular:(i)the documentation point IS.D.OR.200(c;)(ii)

the procedures that define how the organisation controls any contracted activities
referred to in point IS.D.OR.200(a)(9);(iii)

the ISMM amendment procedure defined in point (c);Powered by EASA eRules

Page 254 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](10) the details of currently approved alternative means of compliance.
(b)

The initial issue of the ISMM shall be approved and a copy shall be retained by the competentauthority. The ISMM shall be amended as necessary to remain an up-to-date description of the
ISMS of the organisation. A copy of any amendments to the ISMM shall be provided to thecompetent authority.

(c)

Amendments to the ISMM shall be managed in a procedure established by the organisation.
Any amendments that are not included within the scope of this procedure and any amendments
related to the changes referred to in point IS.D.OR.255(b), shall be approved by the competentauthority.

(d)

The organisation may integrate the ISMM with other management expositions or manuals it
holds, provided there is a clear cross reference that indicates which portions of the
management exposition or manual correspond to the different requirements contained in thisAnnex.

GM1 IS.D.OR.250(a) Information security management manual(ISMM)ED Decision 2023/009/R

The organisation may choose to document some of the information required under point
IS.D.OR.250(a) in separate documents (e.g. procedures). In this case, it should ensure that the manualcontains adequate references to any document kept separately. Any such documents are then to beconsidered an integral part of the organisation’s information security management system manual.
In the event where an entity holds multiple authorisations or declarations, the ISMM may apply to
one or more organisations at a time based on a common ISMS. This ISMM should include at least an
approval document of each organisation and should formally be approved by each organisation’s
accountable manager or, in the case of design organisations, by each head of the design organisations
or responsible person. A common responsible person may be appointed as per IS.D.OR.240(d) and theguidelines of GM1 IS.D.OR.240(e).
To ensure that all parties involved can fulfil their responsibilities, all manuals, procedures, andcommunication between them are advised to be, at least, in one common language, e.g. English.
Those parties involved include the competent authorities with which that common language shouldbe agreed upon.

IS.D.OR.255 Changes to the information security management
systemRegulation (EU) 2022/1645(a)Changes to the ISMS may be managed and notified to the competent authority in a proceduredeveloped by the organisation. This procedure shall be approved by the competent authority.

(b)With regard to changes to the ISMS not covered by the procedure referred to in point (a), theorganisation shall apply for and obtain an approval issued by the competent authority.
With regard to these changes:

Powered by EASA eRules

Page 255 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](1)

the application shall be submitted before any such change takes place, in order to enable
the competent authority to determine continued compliance with this Regulation and toamend, if necessary, the organisation certificate and related terms of approval attached
to it;(2)the organisation shall make available to the competent authority any information it
requests to evaluate the change;(3)

the change shall be implemented only upon receipt of a formal approval by thecompetent authority;(4)

the organisation shall operate under the conditions prescribed by the competentauthority during the implementation of such changes.

AMC1 IS.D.OR.255 Changes to the information security
management system
ED Decision 2023/009/R

Without prejudice to the communication of changes as required for each organisation in thecorresponding implementing regulation for the domain as listed in point Article 2(1) of Regulation (EU)2022/1645, the procedure referred to in IS.D.OR.255(a)(1) should take into account the criticality of
the changes when proposing how they will be managed. In particular, those changes that could havean impact on the achievement or maintenance of compliance with the provisions under Part-IS, or
which could lead to an unacceptable level of risk (e.g. as per the guidance provided in GM1
IS.D.OR.205(c)), should be subjected to scrutiny. Upon establishment of this procedure, any further
changes to it should be subject to approval by the competent authority.
Where prior approval is sought from the competent authority for a change not covered by anapproved procedure, or where no such approved procedure exists, the organisation should provide atleast the following information:—

the nature and purpose of the change;—

the implementation plan of the change;—

the verification plan of the change;—

the potential impact on aviation safety introduced by the change.

A significant deviation from the original implementation plan during the change process is an eventthat should be reported to the competent authority as this deviation may require reconsidering thechange impact.

GM1 IS.D.OR.255 Changes to the information security management
systemED Decision 2023/009/R

Point IS.D.OR.255 is structured as follows:
Point (a) introduces the possibility for the organisation to agree with the competent authority thatchanges to the ISMS can be implemented without prior approval as long as these changes are covered
in a change procedure.

Powered by EASA eRules

Page 256 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Point (b) introduces an obligation of prior approval (by the competent authority) for changes notcovered by the procedure mentioned above, and indicates how those changes should be handled.
The organisation should consider the establishment of a procedure in order to manage and notify
changes to the competent authority as provided for under IS.D.OR.255(a). In case of lack of any
approved procedure, the organisation will have, for any change, to apply for and obtain an approval
as required under IS.D.OR.255(b). In any case, all changes should be notified to the competentauthority upon implementation.

GM2 IS.D.OR.255 Changes to the information security management
systemED Decision 2023/009/R

RELATION BETWEEN CHANGES TO THE ISMS AND CONTINUOUS IMPROVEMENT

Changes stemming from the continuous improvement process established by the organisation (seeIS.D.OR.260) should be handled as any other change according to the guidelines in AMC1 IS.D.OR.255
and GM1 IS.D.OR.255.
EXAMPLE OF CHANGES THAT MAY HAVE AN IMPACT ON THE ISMS

Below are some examples of changes that may have an impact on the ISMS, or which could lead to an
unacceptable level of risk and therefore should be subject to scrutiny by the competent authority
according to the provisions established under IS.D.OR.255:
(a)

(b)

(c)

Changes to the scope of the ISMS, interfaces or related policies:—

The organisation expands its business functions, and integrates another company within
its organisational structure.

—

The organisation has identified non-conformities indicating an incorrect scope.

—

The organisation amends its information security policy and/or information security
objectives with a potential impact on aviation safety.

—

Changes to the interfaces of the organisation resulting e.g. from modification in theinsourced or outsourced activities.

Changes in responsibilities and accountability as well as in the organisational structure involving
the implementation and continuing monitoring of compliance with this Regulation:—

The accountable manager has delegated certain responsibilities under Part-IS to a person
or a group of persons.

—

The organisation contracts information security management activities as per
IS.D.OR.235.

Changes to the methodology used for risk management:—

The organisation changes the classification for likelihood or impact in their risk
management methodology e.g. to obtain more granularity.

—

The organisation implements changes to their risk treatment methodology.

—

The organisation integrates its information security risk management into existing
management systems.

Powered by EASA eRules

Page 257 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](d)

Changes to the security event management process:—The organisation decides to contract security event management activities.

—

The organisation changes the process to notify security events and the criteria to escalate
to higher management for a quicker resolution.

—

The organisation changes its policy for mitigating vulnerabilities.

—

The organisation changes its incident recovery procedure.

EXAMPLE OF CHANGES THAT DO NOT HAVE AN IMPACT ON THE ISMS

Not all operational changes related to information security have an impact on the ISMS, therefore not
all changes are required to be reported to the competent authority, following the provisions
established under IS.D.OR.255. The following scenarios may be representative of such changes:—

After a successfully detected security event which could have easily evolved to an incident, theorganisation decides to roll out an extensive cyber security awareness campaign for all
employees.

—

Update in the staff training programme and/or training content as a result of the continuous
improvement processes established within the organisation.

—

The organisation replaces the software tool that it uses for encrypting sensitive files withanother software solution.

—

The organisation has decided to make an internal restructuring for business reasons, changing
the names of departments or sections, without making any changes in the responsibilities andaccountability (e.g. accountable manager) involving the ISMS of the organisation.

—

The organisation decides to update an existing preventive control e.g. configuring a new firewall
in its internal network.

IS.D.OR.260 Continuous improvement
Regulation (EU) 2022/1645(a)

The organisation shall assess, using adequate performance indicators, the effectiveness andmaturity of the ISMS. That assessment shall be carried out on a calendar basis predefined by
the organisation or following an information security incident.

(b)

If deficiencies are found following the assessment carried out in accordance with point (a), theorganisation shall take the necessary improvement measures to ensure that the ISMS continues
to comply with the applicable requirements and maintains the information security risks at an
acceptable level. In addition, the organisation shall reassess those elements of the ISMS
affected by the adopted measures.

AMC1 IS.D.OR.260 Continuous improvement
ED Decision 2023/009/R

The continuous improvement process (CIP), as required by IS.D.OR.200(b), should aim to continuously
improve the effectiveness, suitability and adequacy of the ISMS. This should be achieved by a proactive
and systematic assessment of the ISMS and all its elements — including its maturity. The assessment
should take into account the outcomes and conclusions of other information security and assurance

Powered by EASA eRules

Page 258 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

processes including audits, management reviews, evaluation of performance, effectiveness andmaturity, as well as the outcomes of the derived corrective actions and corrections.
The steps to be performed should be at least the following:(a)

Identification of improvement opportunities based on the outcomes of the assessment of the
ISMS with respect to its suitability, effectiveness, adequacy and, if deemed necessary,
efficiency, as well as on any other suggestion for improvement. The assessment should consider
performance indicators which reflect its processes and elements and the defined objectives for
effectiveness and maturity.

(b)

Evaluation of the identified opportunities regarding cost benefit, absence or reduction ofundesired effects and achievement of the targeted objectives and intended outcomes.

(c)Proposal of the evaluated improvement opportunities to the management, and recommend
actions to support their review and decision-making.

(d)According to the decision taken under point (c), planning, development and implementation ofactions and changes to the ISMS, its processes or elements to achieve the improvements.

(e)

Evaluation the effectiveness of the implemented actions and ISMS changes, and, as applicable,
verification that the root cause of identified deficiencies has been eliminated.

The management should assess and review the outcomes of the CIP at planned intervals to ensure thecontinuing effectiveness, adequacy and suitability of the ISMS, to decide on the prioritisation of theimplementation of actions and changes, as well as to revise or set new objectives or targets forcontinuous improvement.

GM1 IS.D.OR.260 Continuous improvement
ED Decision 2023/009/R

Point IS.D.OR.260 covers assurance processes for the ISMS in a manner that can be considered
equivalent to the safety assurance in ICAO Doc 9859 ‘Safety Management Manual (SMM)’, which
includes performance monitoring and measurement, management of change and continuous
improvement of the SMS.
In this Regulation:—

IS.D.OR.260(a) addresses, using adequate performance indicators, the effectiveness andmaturity assessment of the ISMS;—

IS.D.OR.260(b) addresses the improvement measures, i.e. corrections and corrective actions,for the deficiencies detected in IS.D.OR.260(a) and the continuous improvement process.

Similar provisions for continuous improvement are provided for in other information management
systems such as ISO/IEC 27001 (see Appendix II to this document).
The context and risk environment of organisations are never static and therefore require a dynamic
adaptation, evolution and change of the organisation’s objectives, architectures, organisational
structures and processes to maintain the information security risks at an acceptable level.
Consequently, the ISMS should be considered as an evolving and learning part/element of theorganisation which needs to be continuously monitored and improved to ensure alignment with theorganisation’s safety objectives and effectiveness.

Powered by EASA eRules

Page 259 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

The CIP aims to continuously improve the effectiveness, suitability, adequacy and, if deemednecessary, the efficiency of the ISMS. An organisation may integrate the Part-IS CIP in some otheralready operated CIP and may apply methods such as Plan-Do-Check-Act (PDCA) Cycle or DefineMeasure-Analyse-Improve-Control (DMAIC) (see also GM1 IS.D.OR.200).
The CIP is based on a proactive and systematic assessment of the ISMS and all its elements including
the information security processes and controls driven by the ISMS. The assessment should be carriedout against organisational targets for desired levels of performance, effectiveness and maturity. Thesetargets, besides ensuring the achievement of compliance with the requirements under this Regulation,
may also aim to include objectives established by the organisation’s policy or standards and by
management decisions.
The above-mentioned assessment is based on the outcome of performance evaluations, audits, risk
and incident processes, as well as already applied corrections and corrective actions. Some factorsthat should be considered when performing the assessment are the following:—

Adequacy refers to whether the system establishes the disciplines needed to manage
information security, e.g. by using broadly accepted industry standards, in a sufficient mannerwith regard to compliance with the requirements of this Regulation.

—

Effectiveness of the ISMS and the effective implementation of processes and controls driven
by the ISMS is assessed by analysing whether:——

the information security risks are managed to achieve the safety objectives;—

the intended outcomes of the ISMS are achieved, and the requirements or objectives aremet;—

all types of deficiencies are managed including failures to fulfil or correctly implement a
requirement or control.

Efficiency of the ISMS refers to the implementation of streamlined processes; however,efficiency improvements should not adversely impact effectiveness.

Identification of improvement opportunities
Improvement opportunities may be identified from the results of the CIP assessment or may beintroduced as suggestions from other sources. The identification often involves deviations orcorrective actions as well as ineffective processes or controls which are not remediated.
Suggestions for improvements stem from sources including:—

Risk management: the results of regular risk analysis and subsequent risk treatment are a
primary factor in improving the ISMS, where the risk treatment process involves monitoring of
the implemented security measures and evaluating their effectiveness.

—

Performance & effectiveness evaluation: conclusions from (key) performance indicators, theirmeasurement, analysis and continued monitoring as well as the result of the assessment of theeffectiveness including the outcomes of the subsequently applied corrections and corrective
actions—

Evaluation of maturity including the results of the subsequent corrections and corrective actions—

Lessons learned from the security incident detection, handling and response process and froma potential treatment of a root cause

Powered by EASA eRules

Page 260 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]—

Results of (internal) audits may be used to verify whether the ISMS and controls within the audit
scope meet the organisation’s requirements, and to determine where there are potential areas
for improvement.

—

Review and evaluation by management of the current action plan, setting or revision of theobjectives or decision on improvement opportunities and actions—

Organisation’s suggestion programme (suggestions for improvement), reviews, surveys orassessments with employees or feedback from suppliers or interfacing parties

Any outcome of this process should be documented. The resulting actions may be integrated into an
overarching action plan which is centrally consolidated and periodically reviewed according to therelevant policies. The resulting action plan may be further divided into a tactical, short-/mid-term
action plan and a strategic, long-term action plan.

AMC1 IS.D.OR.260(a) Continuous improvement
ED Decision 2023/009/R(a)

ISMS EFFECTIVENESS EVALUATION
When complying with IS.D.OR.260(a), the organisation should have a process in place tomonitor, measure, evaluate and review the effectiveness of its ISMS that defines:(1)

who monitors, measures, analyses and evaluates the results and takes accountable
decisions;(2)

when the above steps should be performed;(3)

which methods for monitoring, measurement, analysis and evaluation are applied toensure comparable and reproducible results.

The calendar basis of the assessments should be commensurate with the maximum level of risk
established under IS.D.OR.205.
The process to monitor, measure, evaluate and review the effectiveness of the organisation’s
ISMS referred to under AMC1 IS.D.OR.260(a) should include as a minimum:

(b)

(1)

the gathering and retention of metrics of the activities, and additional information that
could be useful for monitoring purposes;(2)

the analysis of the metrics in order to identify trends and deviations from predefined
performance targets.

ISMS MATURITY ASSESSMENT
The organisation should assess the maturity of its ISMS using a suitable maturity model in order
to identify areas for improvement to the ISMS. To do so, the organisation should:(1)define or adopt a maturity model which represents a set of important and relevant
processes and capabilities that are expected to be implemented and maintained;(2)

for each assessed process or capability, ensure that the model defines criteria against
which specific aspects, characteristics and effectiveness should be assessed andevaluated when determining a maturity level;(3)

define for each assessed process or capability its desired target maturity level.

Powered by EASA eRules

Page 261 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](c)

For each assessed information security process or capability contained in the maturity model,
the organisation should:(1)

evaluate and justify the current maturity level;(2)

identify any area for improvement it should make to reach the targeted maturity level;(3)collect and record the evidence regarding strengths and weaknesses of the implemented
ISMS and its evaluated maturity.

GM1 IS.D.OR.260(a) Continuous improvement
ED Decision 2023/009/R

(a)

(b)

As general guidance, the elements of the ISMS that should be monitored, measured andevaluated should be, as a minimum:(1)

the risk assessment and treatment process (including risks at the interfaces with otherorganisations);(2)

the management of non-conformities and corrective actions;(3)

the incident and vulnerability management;(4)

the personnel competence management.

Existing maturity models for ISMS maturity evaluation
As general guidance, for the definition or the adoption of a maturity model (MM), the following
existing models may be considered:—

Cybersecurity Capability Maturity Model (C2M2), version 1.1: this model was publishedby the US Department of Energy in 2014. It introduces the notion of Maturity Indicator
Levels (MIL) ranging from 0 to 3 and addresses not only performance levels but also
performance practices (under Approach Objectives and approach progression) as well asassurance practices (under Management Objectives and institutionalization progression).

—

Systems Security Engineering – Capability Maturity Model (SSE-CMM): published by ISO
as ISO 21827 in 2008. It focuses on engineering practices, much less on operational
practices that are split in 11 ‘Security Base Practices’, and 11 ‘Project and Organizational
Base Practices’. It introduces the notion of five Capability Levels, from ‘Performed
Informally’ to ‘Continuously Improving’.

—

NIST Cybersecurity Framework (NIST CSF), version 1.1: published by NIST in April 2018.
Although it is not proposed as a MM, the framework defines four ‘Implementation Tiers’,
from ‘Partial’ to ‘Adaptive’, which are a qualitative measure of organisational
cybersecurity risk management practices. It focuses on the functionality and repeatabilityof cybersecurity risk management.

—

ATM Cybersecurity Maturity Model, edition 1: published in February 2019 by the
EUROCONTROL NM for organisations in the ATM domain. Whilst not being designed for
wider application, it can be adapted as necessary. It defines five maturity levels, ranging
from ‘Non-existent’ to ‘Adaptive’ inspired by the ‘Tier’ terminology from the NIST CSF. In
fact, the model is founded on NIST CSF, together with some elements of ISO/IEC 27001.

Powered by EASA eRules

Page 262 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

The following Table 1 maps the MM mentioned above to a hypothetical five-level MM.
Table 1: Mapping matrix of an existing MM to a hypothetical five-level MM
Mapping to a
five-level
MM

C2M2

Eurocontrol NM

ISO 21827

InitialMIL 0

Non-Existent

Performed
Informally

DefinedMIL 1 (Initial)

PartialPlanned & Tracked

Partial

Implemented

MIL 2 (Identified)DefinedWell defined

Risk-Informed

ManagedMIL 3 (Managed)

AssuredQuantitatively
Controlled

Repeatable

Adaptive

Continuously
Improving

Adaptive

Improved

NIST CSF 1.1

No specific maturity level is required. However, if and when compliance is achieved, organisations will
determine which requirements of which models have already been met (mandatory) and can opt toreach a level that is beneficial to the organisation (voluntary). In the longer term, achieving higher
maturity levels may increase the confidence of oversight authorities, which can have an impact upon
the level of oversight activities regarding such organisation.

AMC1 IS.D.OR.260(b) Continuous improvement
ED Decision 2023/009/R

When a deficiency is identified, the organisation should react in a timely manner following a definedprocess leading to a managed status regarding the deficiency, its associated consequences and, if
needed, the prevention of its future recurrence or occurrence elsewhere.
Based on an evaluation of the impact and extent of the deficiency and the potential consequences for
the ISMS, the process should include as criteria for compliance:(a)deciding on corrections and their implementation without undue delay in order to limit the
impact of the deficiency and deal with its consequences as well as, as applicable, to control or
eliminate it;(b)deciding on the need for, and the implementation of, corrective actions to eliminate thecause(s) of, and contributing factors to, the deficiency based on a root cause analysis and anevaluation of actions remediating the cause aimed at being proportionate to the consequences
and impact of the deficiency;(c)verifying the implemented actions:(1)

to be effective and to result in acceptable residual risks,(2)

not to have unintended side effects leading to other deficiencies, new risks, or an ISMS
not aligned with the applicable requirements, as well as(3)for corrective actions, to effectively remediate or eliminate the root cause;Powered by EASA eRules

Page 263 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR](d)reporting to and reviewing the identified deficiencies, action plan and results of the action takenwith the accountable manager of the organisation or, in the case of design organisations, withthe head of the design organisation and, as necessary, with other involved or affected roles andparties;(e)documenting as evidence the detected deficiencies, the planned and implemented corrections
and/or corrective actions with deadlines and responsible persons, the management feedback,the outcomes of the process step under point (c) above and, if necessary, the change decisions
made for the ISMS itself.

GM1 IS.D.OR.260(b) Continuous improvement
ED Decision 2023/009/R

The ‘necessary improvement measures’ referred to in IS.D.OR.260(b) refer to correction or corrective
actions to eliminate deficiencies or actions aimed at improving the effectiveness as well as thematurity of the ISMS.
A process satisfying the criteria defined in AMC1 IS.D.OR.260 should include the following aspects:(a)identifying the extent, impact, context and triggers of the deficiency, evaluating it according tosome established criteria, analysing potential consequences on the ISMS including a potential
existence in other areas;(b)deciding on corrections and their implementation to immediately limit the impact and manage
the consequences of the deficiency as well as, as applicable, to control or eliminate it;(c)deciding on corrective actions required to eliminate the (root) cause(s) of the deficiency thatare proportionate to the consequences;(d)reassessing the elements of the ISMS which may be affected by the implemented actions toensure that no further risk is introduced;(e)verifying the implemented actions referred to in point (c) of AMC1 IS.D.OR.260(b);(f)

reporting to and reviewing the outcomes of the process steps with the management (see point(d) of AMC1 IS.D.OR.260(b));(g)

documenting and evidencing the result of the process steps above (see point (e) of AMC1
IS.D.OR.260(b)).

Powered by EASA eRules

Page 264 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Appendix I — Examples of threat scenarios with a potential harmful
impact on safety
ED Decision 2023/009/R

The following is a non-exhaustive list of examples of information security threat scenarios with apotential harmful impact on safety that may be considered by authorities and organisations.

Example 1: Aircraft to ATC digital communications———

Threat vector assets/domain—

ATC voice and ground automation systems—

ground communications providers—

air-ground/ground-air RF communications service providers—

aircraft and the assets used for voice and datalink communications

Non-exhaustive summary of potential threats—

threat (availability): exceeding system performance, saturation of communication
channel—threat (integrity): man-in-the-middle or injection attacks—

threat (confidentiality): passive listening to communication, spying on hardware device

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption of services prevent ATC communication with a single or multiple aircraft
and/or ATC ground system.

—

Manipulation of data through a man-in-the-middle attack would present false
information to the pilot and/or ATC system with the potential of creating a safety hazard
or injection of data to the aircraft or ground systems to disrupt the service and capability.

—

There are no specific regulatory requirements for encryption of data or voice for datalink
communications; however, for confidentiality purposes, the assets used to provide anddeliver the services should be controlled and limited to only those resources that require
access to ensure that the services cannot be disrupted and manipulated in any way.

Example 2: Tampered air traffic data—

Threat vector assets/domain—

Internet service provider (ISP)—ATM services network(s)—surveillance data—

ATC systems

Powered by EASA eRules

Page 265 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]——

Non-exhaustive summary of potential threats—

ISP compromise (confidentiality): An attacker gains unauthorised access to the systems
or infrastructure of the ISP providing network services to ATM system.

—

data tampering (integrity): Once the ISP is compromised, an attacker could manipulate
data in transit. This could involve injecting false data or removing/modifying legitimate
data.

—

denial of service (availability): an attacker could also potentially disrupt thecommunication of data entirely, resulting in a denial of service (DoS) to the ATM system.

—

malware injection (integrity/availability): An attacker could potentially use thecompromised ISP as a launching pad to inject malware into the systems, causing further
disruptions or enabling additional attacks.

Summary of threats scenarios and their potential harmful impacts on safety—

ISP compromise: interception and/or manipulation of sensitive data, impacting the safe
management of air traffic.

—

data tampering: incorrect situational awareness, potentially resulting in reduced
separation between aircrafts, and incorrect air traffic control decisions.

—denial of service: reduction of the ATC’s ability to ensure separation leading to theactivation of contingency procedures, including capacity reduction, with the eventual
possibility of large areas of airspace being closed.

Example 3: Aircraft operator, CAMOs’ and aircraft maintenance organisations’ software supply
chain and ground infrastructure, including equipment used to support aircraft management,
operations and maintenance———Threat vector assets/domain—

aircraft operators’, CAMOs’ and maintenance organisations’ supply chain—

aircraft operator or maintenance internal ground infrastructure used to manage aircraftand operations (hardware/software) and other information technology assets—

information technology assets used to update systems on an aircraft (software andhardware) used for maintenance activities

Non-exhaustive summary of potential threats—

threat (availability): hardware/software/system disruption—

threat (integrity): compromised hardware/software/system—threat (confidentiality): compromised hardware/software/system

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption to the dissemination of meteorological information while the aircraft isairborne, may reduce the ability of the flight crew to avoid potentially hazardous
meteorological conditions (e.g. severe storms/fog at night).

—

Manipulation of navigation data/database will have the effect that flight plans andnavigation displays cannot be trusted.

Powered by EASA eRules

Page 266 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]—

Lack of control and access to information such as fleet maintenance programme or flightcrew planning affects the ability of organisations to maintain safe operations.

Application of bow-tie analysis to this example
Two coordinated bow-tie analyses of different risk dimensions are combined, as the ultimate interest
lies only in the aviation safety consequence.

Information security bow-tie analysis element
Information security threats1) hardware/software vulnerability exploitation:
disturbed system function2) hardware/software vulnerability exploitation:system integrity compromised3) hardware/software vulnerability exploitation:
confidentiality of information processed by system(s)compromised

Aviation safety bow-tie analysis element

Information security preventive barriers
Information security hazards & top events
1) disturbed system functionality (hazard) →disrupted/unreliable system functionality
2) system integrity compromised (hazard) → system
function unpredictable3) information disclosable (hazard) → undetectable
information exfiltration

Safety threats1) disrupted/unreliable system functionality
2) system function unpredictable3) undetectable information exfiltration

Information security mitigating barriers

Safety preventive barriers
1) Use of access controls for system administration2) etc.
Safety hazards & top events:
1) loss of system function (hazard) →in operational
maintenance system
2) loss of system function integrity (hazard) →systems operate with wrong information
3) loss of information confidentiality (hazard) →confidential maintenance and aircraft internals
information leaks
Safety mitigating barriers
1) use of back-up procedures to prevent faulty
maintenance actions
2) use of procedures to secure aircraft software
integrity

Information security consequences
1) loss of system function (= production system
down)2) loss of system function integrity (= some system
function wrong/inoperative)3) loss of confidentiality of information (= some
information can leak)

Safety consequences
1) faulty maintenance actions2) incorrectly completed maintenance actions3) exfiltration of information allows for identificationof vulnerabilities

Powered by EASA eRules

Page 267 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

4) disruption of aircraft systems, unpredictablesystem function, loss of major aircraft systems (suchas engine control)

Example 4: Design and production organisations’ software, supply chain, design and manufacturing
ground infrastructure———

Threat vector assets/domain—

design and production organisations’ supply chain for parts, hardware and software—

design and production organisations’ ground internal infrastructure used to manage
software/hardware used in the manufacturing and development of products that will be
used by aircraft manufacturers, operators or ATM/ANS ground automation systems(hardware/software) information technology assets—

design and production organisations’ information technology assets used by theircustomers to update systems on an aircraft (software/hardware) used for maintenance
operations or ATM/ANS ground automation systems

Non-exhaustive summary of potential threats—

threat (availability): systems used to store, transmit and exchange information are
rendered unavailable for essential operations through DoS attacks—

threat (integrity): systems used to store, transmit and exchange information arecompromised through man-in-the middle attacks—

threat (confidentiality): systems used to store, transmit and exchange information areaccessed by insider or external threats

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption of systems used to store, transmit and exchange information in a manner thatwould prevent the proper management of the aircraft and its systems and adversely
affect the operations of the aircraft—

Systems used to store, transmit and exchange information can no longer be considered
trusted. If they are not maintained at a level to ensure that all information exchange, dataand software can be considered trusted, both ground and aircraft operations are
disrupted.

—

Uncontrolled access to systems used to store, transmit and exchange information(including information that is received and exchanged with the supply chain) can provide
technical details that could be used to craft more sophisticated attacks targeting safetycritical systems.

Example 5: Training system—

Threat vector assets/domain—

supply chain of all software and hardware that will be used in the training systems or
training devices (including flight simulators) used to train pilot or ATM/ANS groundsystems personnel

Powered by EASA eRules

Page 268 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

—

—

—

internal infrastructure used in of all software and hardware that will be used in thedesign, manufacturing or production of products (hardware or software) that will be usedin aircraft or ATM/ANS ground systems—

management of internal operating domains and system of all software and hardware thatwill be used in the design, manufacturing or production of products (hardware orsoftware) that will be used in aircraft or ATM/ANS ground systems

Non-exhaustive summary of potential threats—

threat (availability): training systems or training devices are rendered unavailable bymeans of DoS attacks when they are needed to be used—threat (integrity): training systems or training devices are compromised through man-inthe middle attacks—

threat (confidentiality): functional models, information and data that are embedded intraining systems or training devices are accessed by insider or external threats

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption of training systems (hardware and software) will have an impact on theorganisations’ ability to maintain qualified staff. It would also prevent the aircraft and its
systems from being properly operated and affect maintenance operations for ATM/ANS
ground systems.

—

The training model or the failure modes and associated emergency conditions differ fromthe real aviation system behaviour and therefore induce inappropriate responses. If the
training systems cannot be trusted, this will affect the ability of organisations to maintainsufficiently qualified staff for their operations (pilots, maintenance or ATM/ANS groundpersonnel who have been exposed to improper training should be re-qualified).

—

Lack of control and access to training systems affects the ability of organisations tomaintain a training system that is known to be in a trusted state. In addition, uncontrolled
access to training systems that embed functional models, information and data canprovide technical details that could be used to craft more sophisticated attacks on the
training system itself or on the real-world safety-critical system.

Example 6: Airport’s fuel delivery system and associated infrastructure——

Threat vector assets/domain—

ground fuel storage and distribution infrastructure—

digital systems used to control fuel pumping and metering—

supply chain for fuel delivery, including third-party fuel suppliers—

airport information technology assets used for fuel inventory management andscheduling deliveries

Non-exhaustive summary of potential threats—

threat (availability): disruption of fuel supply or delivery systems—

threat (integrity): tampering with fuel control systems or measurement devices

Powered by EASA eRules

Page 269 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]——

threat (confidentiality): unauthorised access to fuel supply and delivery data

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption to fuel delivery can lead to flight delays or cancellations, causing operational
disruptions and potential safety issues if fuel reserves become critically low.

—

Tampering with fuel control systems or measurement devices could lead to incorrect fuelloads being delivered to aircraft, impacting aircraft weight and balance calculations, andpotentially causing fuel exhaustion incidents.

—

Unauthorised access to fuel supply data could allow threat actors to manipulate fuelscheduling or inventory data, potentially causing disruptions to airport operations andfuel availability for aircraft.

Example 7: National competent authority’s NOTAM system and associated infrastructure———

Threat vector assets/domain—

National NOTAM system infrastructure and digital interface—

Supply chain for NOTAM system maintenance and updates—

National competent authority’s IT assets used for NOTAM creation, distribution, andstorage

Non-exhaustive summary of potential threats—

threat (availability): disruption of the NOTAM system or its access—threat (integrity): tampering with NOTAM data or unauthorised NOTAM creation—

threat (confidentiality): unauthorised access to NOTAM data

Summary of threats scenarios and their potential harmful impacts on safety—

Disruption to the NOTAM system could prevent the dissemination of critical aeronauticalinformation to pilots and air traffic controllers, potentially leading to safety issues.

—

Tampering with NOTAM data or unauthorised creation of NOTAMs could lead to incorrect
information being disseminated, potentially resulting in pilots making decisions based on
false or misleading data.

—

Unauthorised access to NOTAM data could lead to information leakage, potentiallyrevealing sensitive operational information.

Example 8: Aviation authority’s airworthiness directive (AD) system and associated infrastructure—

Threat vector assets/domain—

EASA AD system infrastructure and digital interface—

supply chain for AD system maintenance and updates—

EASA IT assets used for AD creation, distribution, and storage

Powered by EASA eRules

Page 270 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]——

Non-exhaustive summary of potential threats—

threat (availability): Disruption of the AD system or its access—threat (integrity): tampering with AD data or unauthorised AD creation—

threat (confidentiality): unauthorised access to AD data

Summary of threats and their potential harmful impacts on safety—

Disruption to the AD system could prevent the dissemination of critical airworthinessinformation to aircraft operators and maintenance organisations, potentially leading tosafety issues.

—

Tampering with AD data or unauthorised creation of ADs could lead to incorrect
information being disseminated, potentially resulting in aircraft operators andmaintenance organisations making decisions based on false or misleading data.

—

Unauthorised access to AD data could lead to information leakage, potentially revealing
sensitive operational information.

Powered by EASA eRules

Page 271 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Appendix II — Main tasks stemming from the implementation ofPart-IS, including mapping to NIST CSF 1.1 competencies andISO/IEC 27001 clauses and controls
ED Decision 2023/009/R

Activity typePart-IS main task

Establish and operate
an information security
management system(ISMS)
Establish the scope of
the ISMS according toPart-IS requirements
Implement andmaintain an
information security
policyIdentify and review
information security
risks
Implement information
security risk treatment
measures
Implement measures
to detect information
security events andidentify those related
to aviation safety
Implement measuresthat have been notified
by the competentauthority
Take appropriate
remedial actions toaddress findings
notified by thecompetent authority(non-compliances)

Reference
NIST CSF Version
1.1

ISO/IEC 27001

FunctionCategoryParagrap
h Clause

IS.D.OR.200(a)IDENTIF
Y

ID.RM

4
6.1.1

ManagementIS.D.OR.205(a)IDENTIFY

ID.BE-2
ID.BE-4
ID.AM-5

4.3

ManagementIS.D.OR.200(a)(1)

IDENTIFY

ID.GV-1

5.2

ManagementIS.D.OR.200(a)(2)
IS.D.OR.205

IDENTIFY

ID.GV-4
ID.RA

ManagementIS.D.OR.200(a)(3)
IS.D.OR.210

PROTECT

PR.PT

DETECT

DE.AE-3
DE.CM1
DE.CM2
DE.CM3

Management,Operational

ManagementPart-IS

Annex A Control
:2013
:2022

A5.1

A5.1

6.1.2
8.1
8.2
6.1.3
8.1
8.3
A11.1.2
A7.2
A8.15
A5.28

ManagementIS.D.OR.200(a)(5)
IS.D.OR.220

Operational

IS.D.OR.200(a)(6)10.1

A6.1.3A5.5

Both

IS.D.OR.200(a)(7)
IS.D.OR.225

10.1

A6.1.3

A5.5

Powered by EASA eRules

A12.4.1
A12.4.3
A16.1.7

Page 272 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Activity typePart-IS main task

Management,Operational

Reference

Part-ISNIST CSF Version
1.1

ISO/IEC 27001

FunctionCategoryParagrap
h Clause

Annex A Control
:2013
:2022

7.4

A6.1.3
A16.1.2
A16.1.3

A5.5
A6.8

9.2

A18.2.1
A18.2.2

A5.35
A5.36

A8.2.2
A13.2

A5.13
A5.14

4.4
9.1
9.3
10.1
10.2

A5.1.2
A16.1.7
A17.1.3
A18.2.1

A5.1
A5.28
A5.29
A5.35

4.2
5.2
5.3

A5.1
A6.1.1

A5.1
A5.2

4.3

A8.1.1

A5.9

Implement an external
information security
reporting scheme

ManagementIS.D.OR.200(a)(8)
IS.D.OR.230

RESPON
D

RS.CO-2
RS.CO-3
RS.CO-4
RS.CO-5

Monitor compliancewith this Regulation
and report findings to
top management

Operational

IS.D.OR.200(a)(12)

IDENTIFY

ID.GV-3

Protect confidentialityof exchanged
information

Operational

IS.D.OR.200(a)(13)

PROTECT

PR.DS-1
PR.DS-2

IDENTIFY

ID.RA-6
ID.SC-4

PROTECT

PR.IP-7
PR.IP-10

DETECT

DE.DP-5

RESPOND

RS.MI-3
RS.IM-2

RECOVER

RC.IM-2

IDENTIFY

ID.AM-6
ID.GV-4
ID.RM-1
ID.SC-1
ID.SC-2

PROTECT

PR.AT-2
PR.AT-4
PR.AT-5
PR.IP-12

Implement andmaintain a continuous
improvement process
to measure theeffectiveness andmaturity of the ISMS
and strive to improve it

Document andmaintain all key
processes, procedures,roles and
responsibilities

ManagementManagementIS.D.OR.200(b)IS.D.OR.260

IS.D.OR.200(c)DETECTRESPOND
Identify all elements
which could be
exposed to information
security risks

ManagementPowered by EASA eRules

IS.D.OR.205(a)IDENTIFY

DE.DP-1
RS.CO-1
RS.AN-5
ID.AM-1
ID.AM-2
ID.AM-4
ID.AM-5

Page 273 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Activity typePart-IS main task

Identify the interfaces
with otherorganisations which
could result in
exposure to
information security
risks
Identify information
security risks andassign a risk level
Review and update therisk assessment basedon certain criteria
Develop andimplement measures
to address risks andverify theireffectivenessManagement,Operational

ManagementReference

Part-IS

IS.D.OR.205(b)NIST CSF Version
1.1

ISO/IEC 27001

FunctionCategoryParagrap
h Clause

IDENTIFY

ID.BE-1
ID.BE-2
ID.BE-4
ID.BE-5

4.3

6.1.2

ManagementIS.D.OR.205(c)IDENTIFY

ID.RA-1
ID.RA-2
ID.RA-3
ID.RA-4
ID.RA-5

Operational

IS.D.OR.205(d)IDENTIF
Y

ID.RM

8.2

Operational

IS.D.OR.210(a)PROTEC
T

PR.IP
PR.PT

6.1.3
8.3

IDENTIFY

ID.AM-3
ID.BE-1
ID.BE-2
ID.BE-4
ID.RM-3
ID.SC-3

PROTECT

PR.IP-7

Communicate theoutcome of the risk
assessment tomanagement, otherpersonnel and otherorganisations sharing
an interface

Operational

Establish an internal
information security
reporting scheme toenable the collectionand evaluation of
information security
events from personnel

ManagementIS.D.OR.200(a)(4)IS.D.OR.215(a)IS.D.OR.215(e)IDENTIFY

ID.AM-3

7.4

Ensure that contractedorganisations report
information security
eventsManagementIS.D.OR.215(c)RESPON
D

RS.CO-2
RS.CO-4

7.4

Powered by EASA eRules

IS.D.OR.210(b)Annex A Control
:2013
:2022

A5.7

8.1

A16.1.1
A16.1.2

A15.1.
1
A16.1.2

A5.28
A6.8

A5.19
A6.8

Page 274 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Activity typePart-IS main task

Analyse internallyreported occurrences
to identify information
security events,
incidents, andvulnerabilities

Implement measures
to detect in processes
and operations
information security
events which may havea potential impact onaviation safety
Implement measures
to respond to
information security
events that may cause
an information security
incident
Cooperate on
investigations withother organisations
that contribute to theinformation security of
its own activities
Implement measures
to recover frominformation security
incidents
Manage risks
associated with
contracted activities
with regard to the
management of
information security
Create and maintain aprocess to ensure that
there is sufficientpersonnel to perform

Management,Operational

Operational

Reference

Part-ISNIST CSF Version
1.1

ISO/IEC 27001

FunctionCategoryParagrap
h Clause

IDENTIFY

ID.RA-1

Annex A Control
:2013
:2022

A12.6.1
A16.1.1
A16.1.4

IS.D.OR.215(b)(1)-(b)(3)
DETECT

DE.AE-2
DE.AE-3DE.AE-5

DETECT

DE.AE
DE.CM
DE.DP

PROTECT

PR.PT-1

IS.D.OR.220(b)RESPONDManagementOperational

A8.8
A5.24
A5.25

A11.1.2
A12.4.1
A12.6.1
A16.1.1
A16.1.2
A16.1.3
A16.1.4
A16.1.5

A7.2
A8.8
A8.15
A8.16
A5.24
A5.25
A5.26
A6.8

RS.RP
RS.AN
RS.MI

A16.1.
5

A5.26

IS.D.OR.215(d)RESPOND

RS.AN-3
RS.AN-5

A15.1.
2
A15.1.3
A16.1.7

A5.20
A5.21
A5.28

IS.D.OR.220(c)RECOVER

RC.RP-1
RC.IM-1

A16.1.
5
A16.1.6

A5.26
A5.27

ManagementIS.D.OR.235

IDENTIFY

ID.SC-1
ID.SC-2

A15.1
A15.2

A5.19
A5.20
A5.21
A5.22

ManagementIS.D.OR.240(f)IDENTIFY

ID.AM-5
ID.AM-6
ID.GV-2

A6.1.1

A5.2

Operational

Operational

Powered by EASA eRules

IS.D.OR.220(a)7.1Page 275 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Activity typePart-IS main task

Management,Operational

Reference

Part-ISNIST CSF Version
1.1

ISO/IEC 27001

FunctionCategoryParagrap
h Clause

Annex A Control
:2013
:2022

IDENTIFY

ID.AM-5
ID.AM-6
7.2

A7.2.2

A6.3

all activities regarding
information security
management
Create and maintain aprocess to ensure thatthe personnel have thenecessary competence
for activities regarding
information security
management
Create and maintain aprocess to ensure thatthe personnel
acknowledge theresponsibilities
associated with theassigned roles andtasks
Verify the identity andtrustworthiness of
personnel who haveaccess to information
systems

ManagementIS.D.OR.240(g)PROTECT

PR.AT-1

ManagementIS.D.OR.240(h)IDENTIFY

ID.GV-2
ID.GV-3

7.3
7.4

A7.1.2

A6.2

ManagementIS.D.OR.240(i)PROTECT

PR.AC-6
PR.IP-11

7.1

A7.1.1

A6.1

IDENTIFY

ID.RA-4

PROTECT

PR.AC-2
PR.AC-3
PR.AC-4
PR.DS-1
PR.DS-4
PR.DS-5
PR.DS-6
PR.IP-4
PR.IP-6
PR.PT-1

7.5

A8.2.2A8.2.3
A11.1.3
A11.1.4
A12.1.3
A12.3.1
A12.4.1
A12.4.2
A12.4.3

A5.10
A5.13
A7.3
A7.5
A8.6
A8.10
A8.13
A8.15

10.1

A18.1.1
A18.2

A5.31
A5.35
A5.36

Archive, protect andretain records andensure they aretraceable for a
specified time

Operational

IS.D.OR.245

Correct noncompliance findings
upon notification by
the competentauthority within the
period agreed with thecompetent authority

Operational

IS.D.OR.225

Powered by EASA eRules

Page 276 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Activity typePart-IS main task

Implement an
information security
reporting system inaccordance with
Regulation (EU)No 376/2014

ReferenceManagement,Operational

Part-ISManagementIS.D.OR.230(a)Report information
security incidents orvulnerabilities to thecompetent authority
and, under certain
conditions, to others

Operational

Regularly assess theeffectiveness andmaturity of the ISMS

Operational

IS.D.OR.260(a)Operational

Take actions toimprove the ISMS if
required. Reassess the
ISMS elements
affected by the
implemented
measures.
Ensure accessibility of
the competentauthority to thecontractedorganisation
Top management
ensures that allnecessary resources
are available to comply
with the Regulation
Top management
establishes andpromotes theinformation security
policy anddemonstrates a basic
understanding of theRegulation

NIST CSF Version
1.1

ISO/IEC 27001

FunctionCategoryParagrap
h Clause

DETECT

DE.DP-3

RESPON
D

RS.CO-2
RS.CO-3
RS.CO-4
RS.CO-5

RECOVER

RC.CO-3Annex A Control
:2013
:2022

A16.1.1
A16.1.2
A16.1.3

A5.24
A6.8

9

A5.1.2
A12.7.1
A16.1.6

A5.1
A5.27
A8.34

IS.D.OR.260(b)10A5.1.2

A5.1

ManagementIS.D.OR.235(b)9.3

A6.1.3
A15.1
A15.2

A5.5
A5.20
A5.22

ManagementIS.D.OR.240(a)(1)

7.1

A6.1.1

A5.2

5.1
5.2
7.4

A5.1.1
A7.2.1
A7.2.2

A5.1
A5.4
A6.3

ManagementPowered by EASA eRules

IS.D.OR.230(b)IS.D.OR.230(c)IS.D.OR.240(a)(2)&(a)(3)

IDENTIFY

ID.AM-5
ID.AM-6

IDENTIFY

ID.GV-1

PROTECT

PR.AT-1
PR.AT-4

7.4

Page 277 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Activity typePart-IS main task

Appoint a responsible
person or a group of
persons withappropriate knowledge
to manage compliancewith the Regulation
Create and maintain an
information security
management manual(ISMM)Develop a procedureon how to notify thecompetent authority
upon changes to the
ISMSManage changes to the
ISMS and notify thecompetent authority
and/or request for
approval of changes

ReferenceManagement,Operational

Part-ISManagementIS.D.OR.240(b)IS.D.OR.240(c)IS.D.OR.240(d)ManagementIS.D.OR.250

NIST CSF Version
1.1

ISO/IEC 27001

FunctionCategoryParagrap
h Clause

Annex A Control
:2013
:2022

IDENTIFY

ID.AM-6
ID.GV-2

PROTECT

PR.AT-1
PR.AT-4

7.1
7.2

A6.1.1
A7.2.1
A7.2.2

ManagementIS.D.OR.255(a)IDENTIFYManagementIS.D.OR.255(a)IS.D.OR.255(b)IDENTIFYPowered by EASA eRules

ID.AM-3

ID.AM-3

A5.2
A5.4
A6.3

7.5.1

A6.1.3
A12.1.1

7.4
7.5.1

A6.1.3
A13.2.1
A13.2.2

A5.5
A5.14

A6.1.3
A13.2.1
A13.2.2

A5.5
A5.14

7.4

A5.5
A5.37

Page 278 of 279| Aug 2024

Easy Access Rules for Information Security(Regulations (EU) 2023/203 and 2022/1645)

Delegated Regulation (EU)2022/1645
ANNEX — INFORMATIONSECURITY — ORGANISATIONREQUIREMENTS [PART-IS.D.OR]

Appendix III — Examples of aviation services
ED Decision 2023/009/R

The following is a non-exhaustive and non-complete list of aviation services that can be used as a basis
to identify the scope of risk assessment for the organisation.

aerodrome ATM-MET services provider
aeronautical digital map service
AIM (external)
airportAPP ACC
ATC (external)
ATC superiorATM
ATM-MET services provider
civil AU operations centre
communication infrastructure
ER ACCFIS/TIS data integrator
national AIM
navigation infrastructure — ground-basednavigation Infrastructure — satellite-based
non-ATM-MET services provider
non-aviation users (external)
regional AIM
regional ASM
regional ATFCM
state AU operations centre
static aeronautical data service
sub-regional DCB common service provision
sub-regional/local ATFCM
sub-regional/national ASM
surveillance infrastructure airport
surveillance infrastructure en-routesurveillance infrastructure TMA
time reference (external)
tower (TWR)

Powered by EASA eRules

Page 279 of 279| Aug 2024