EASA Part-IS — Information Security Regulation (EU) 2023/203

Why does it matter?

Aviation has treated cyber risk as a separate IT matter. Part-IS ties information security to safety: an organization must show that failures of its information systems cannot weaken the safety barriers it relies on, and must prove it to its authority. The rule gives one set of requirements across design, production, maintenance, operation, air traffic services and aerodromes.

Key benefits include:

• One ISMS requirement across the sector

Annex II (Part-IS.I.OR) applies to most organizations, with Part-IS.D.OR in Regulation 2022/1645 for design, production and aerodrome organizations, so the sector shares one standard.

• Risk is measured by safety impact

Risks are classified by the chance of the threat scenario and the severity of its safety consequences (IS.I.OR.205(c)).

• A fixed reporting clock

Reportable incidents and vulnerabilities go to the competent authority within 72 hours of the organization knowing about them (IS.I.OR.230(c)(2)).

• Top management is accountable

The accountable manager must have the corporate authority to resource compliance and promote the policy (IS.I.OR.240(a)).

• Authorities are covered too

Annex I (Part-IS.AR) sets requirements for competent authorities so oversight is consistent across Member States.

How does it work?

Regulation 2023/203 has two annexes. Annex I, Part-IS.AR, sets requirements for competent authorities. Annex II, Part-IS.I.OR, sets requirements for organizations. Part-IS.D.OR in Delegated Regulation 2022/1645 gives equivalent organization requirements for design, production and aerodrome organizations. Requirements are tailored to the nature and complexity of each organization (IS.I.OR.200(d)).

The core is the ISMS. The organization sets a policy, identifies the elements and interfaces exposed to risk (IS.I.OR.205), treats unacceptable risks (IS.I.OR.210), runs internal reporting (IS.I.OR.215), detects, responds to and recovers from incidents (IS.I.OR.220), and addresses authority findings (IS.I.OR.225). It also reports externally (IS.I.OR.230), manages contracted activities (IS.I.OR.235) and keeps a manual (IS.I.OR.250).

An organization can ask its authority to approve it not to implement the ISMS requirements if its activities pose no information security risk with a potential impact on aviation safety, based on a documented risk assessment (IS.I.OR.200(e)).

Key Elements

• Information security management system (IS.I.OR.200)

Thirteen duties in paragraph (a), including the policy, risk assessment, treatment, internal and external reporting, incident response, findings, contracted activities, personnel, records, compliance monitoring and confidentiality of information received from others.

• Risk assessment and treatment (IS.I.OR.205 and .210)

Identify exposed elements and interfaces with other organizations, assign a risk level from a predefined classification and update the assessment when elements, interfaces or knowledge change, or after incident lessons.

• Incident detection, response and recovery (IS.I.OR.220)

Detect deviations from functional performance baselines, activate predefined response resources, contain the attack and reach a safe state within a recovery time.

• External reporting (IS.I.OR.230)

Notify as soon as the condition is known, report within 72 hours, and send a follow-up report with recovery and prevention actions. Also report to the design approval holder where relevant.

• Personnel and records (IS.I.OR.240 and .245)

Accountable manager duties, a responsible person or group, a compliance monitoring function, and records kept for five years, with staff qualification records kept at least three years after departure.

• Continuous improvement and change (IS.I.OR.255 and .260)

Manage changes to the ISMS and run a continuous improvement process so the system remains effective.

What does it cover?

Regulation 2023/203 applies to maintenance organizations (Part-145), continuing airworthiness management organizations, air operators (Part-ORO), approved training organizations, aero-medical centers, flight simulation training device operators, air traffic controller training organizations, air traffic management and air navigation service organizations, U-space service providers and organizations designing or producing ATM/ANS systems. Regulation 2022/1645 covers Part 21 design and production organizations, aerodrome operators and apron management service providers, and ground handling organizations from March 27, 2031. The smallest operators and ELA2 aircraft work are excluded.

What are its objectives?

Part-IS protects aviation safety against the consequences of information security failures.

Identify and manage information security risks that could affect aviation safety.

Detect information security events and identify those that are incidents with a potential safety impact.

Respond to and recover from incidents, reaching a safe state.

Report incidents and vulnerabilities to the competent authority within 72 hours.

Make top management accountable and keep evidence for oversight.

Framework in Context

Part-IS is sector-specific and sits beside general cybersecurity law. Competent authorities pass relevant incident notifications to the national network and information security single point of contact (Article 7), and EASA's guidance states that it does not require any particular framework, though ISO/IEC 27005 and EUROCAE ED-201A are cited as sources of guidance on risk management. It is not a privacy rule: personal data duties come separately.

Common Framework Mappings

Organizations map EASA Part IS to widely adopted security, privacy, and operational frameworks to ensure regulatory alignment, risk-based controls, data protection, and cross-border interoperability.

Mapped frameworks include:

CIS Critical Security Controls

General Data Protection Regulation (GDPR)

ISO/IEC 27001

ISO/IEC 27002

ISO/IEC 27701

NIS2 Directive

NIST Cybersecurity Framework

NIST SP 800-53