Overview

EASA Part-IS — Information Security for Aviation is a European Union Aviation Safety Agency regulation establishing information security requirements for civil aviation organizations. Part-IS creates a systematic, risk-based approach to managing information security risks that could affect aviation safety.

Published by the European Union Aviation Safety Agency (EASA), Part-IS applies to aviation organizations regulated by EASA including airlines, maintenance organizations, design organizations, and air navigation service providers. It requires organizations to implement information security management systems addressing cybersecurity risks that could impact aviation safety.

Organizations implement Part-IS by establishing information security management frameworks, conducting risk assessments of safety-relevant information systems, implementing appropriate controls, and integrating information security into their existing safety management systems.

Why it Matters

EASA Part-IS establishes mandatory information security requirements protecting aviation safety systems from cybersecurity threats that could compromise flight safety.

Key benefits include:

• Meet EASA regulatory requirements

Comply with mandatory EU aviation information security regulations maintaining operational authorization.

• Protect aviation safety systems

Implement security controls protecting information systems whose compromise could affect aviation safety.

• Integrate security with safety

Connect information security management with existing safety management systems in aviation organizations.

• Demonstrate security governance

Show EASA and national aviation authorities organized information security management aligned with regulatory requirements.

• Support international operations

Meet EU aviation security requirements supporting authorization for operations across European airspace.

How it Works

Part-IS requires aviation organizations to establish information security management systems covering risk assessment, risk mitigation, monitoring, and continuous improvement. Organizations must identify information systems whose compromise could affect aviation safety and implement proportionate security controls.

Implementation involves integrating Part-IS requirements into existing safety management systems, conducting information security risk assessments, implementing controls, and establishing processes for monitoring effectiveness and responding to information security incidents.

Within SmartSuite, aviation organizations track Part-IS requirement implementation, manage information security risk assessments, coordinate audit activities, and maintain documentation supporting EASA regulatory compliance.

Key Elements

• Information Security Management System

Requires formal ISMS addressing safety-relevant information security risks across aviation operations.

• Risk-Based Approach

Mandates risk assessment and proportionate controls based on safety impact of information system compromise.

• Safety-Security Integration

Connects information security management with existing aviation safety management systems.

• Monitoring and Continuous Improvement

Requires ongoing monitoring of control effectiveness and continuous improvement of information security.

Framework Scope

EASA Part-IS applies to EASA-regulated aviation organizations including airlines, maintenance organizations, design organizations, and air navigation service providers operating in EU airspace.

Framework Objectives

EASA Part-IS establishes information security management requirements protecting aviation safety systems from cybersecurity threats.

• Protect aviation safety systems from information security threats and vulnerabilities
• Integrate information security management with aviation safety management
• Meet EASA regulatory requirements for aviation information security
• Implement risk-proportionate controls protecting safety-relevant systems
• Support continuous improvement of aviation information security practices

Common Framework Mappings

Mapped frameworks include:

ISO/IEC 27001

NIST Cybersecurity Framework

NIS2 Directive

UK CAP 1850