EASA PART-IS INFORMATION SECURITY · Aero Support Group FZCO · Updated 22 October 2026
What is EASA Part-IS?
Part-IS is the EU aviation safety rule on information security. It does not deal with data protection or general IT security for its own sake. It asks organisations to identify information and communication technology systems and data whose compromise could affect aviation safety, and to manage those risks through an ISMS.
- Commission Delegated Regulation (EU) 2022/1645 was adopted on 14 July 2022 and has applied since 16 October 2025. Its organisation requirements are Part-IS.D.OR.
- Commission Implementing Regulation (EU) 2023/203 was adopted on 27 October 2022, published on 2 February 2023, and has applied since 22 February 2026 (1 January 2026 for the EGNOS service provider). Annex I contains the authority requirements (Part-IS.AR) and Annex II the organisation requirements (Part-IS.I.OR).
EASA issued the AMC and GM in July 2023 (ED Decisions 2023/008/R to 2023/010/R) and amended them in July 2025 (ED Decisions 2025/013/R to 2025/015/R). The Easy Access Rules for Information Security were last revised in December 2025.
Who does Part-IS apply to?
Under Regulation (EU) 2023/203 (Article 2), with limited exclusions for small or simple operations:
- Part-145 maintenance organisations and CAMOs (except those working only under Part-ML);
- air operators certified under Part-ORO;
- approved training organisations, aero-medical centres and FSTD operators;
- ATCO training organisations and ATCO aero-medical centres;
- ATM/ANS providers, U-space service providers and single common information service providers;
- the competent authorities overseeing these organisations.
Under Regulation (EU) 2022/1645: Part 21 design and production organisations (except ELA2-only) and aerodrome operators and apron management service providers under Regulation (EU) No 139/2014.
Part-147 maintenance training organisations are not listed in either regulation. Ground handling organisations are not yet in scope: Delegated Regulation (EU) 2025/22 brings them in under 2022/1645 from 27 March 2031, under a declaration regime. A third country operator’s TCO authorisation is outside Part-IS, but any EASA Part-145, ATO or FSTD approval the same company holds is in scope.
What does the ISMS have to include?
The organisation requirements in Part-IS.I.OR (and the equivalent IS.D.OR points) set out the system:
- IS.I.OR.200 the ISMS itself, including policy, scope and the interfaces with other organisations;
- IS.I.OR.205 and .210 information security risk assessment and risk treatment, with the link to aviation safety made explicit;
- IS.I.OR.215 an internal reporting scheme;
- IS.I.OR.220 detection of incidents, response and recovery;
- IS.I.OR.225 response to findings notified by the competent authority;
- IS.I.OR.230 external reporting;
- IS.I.OR.235 contracting of information security management activities;
- IS.I.OR.240 personnel requirements;
- IS.I.OR.245 record-keeping;
- IS.I.OR.250 the information security management manual (ISMM);
- IS.I.OR.255 changes to the ISMS;
- IS.I.OR.260 continuous improvement, including assessment of ISMS effectiveness on a calendar the organisation defines.
Under IS.I.OR.240 the accountable manager remains responsible for resourcing the ISMS and setting the information security policy. A person or group reporting directly to the accountable manager ensures compliance, and compliance monitoring covers the ISMS. Where an organisation holds several approvals, structures can be shared and a common responsible person appointed.
Derogation, NIS2 and ISO/IEC 27001
Derogation. Under IS.I.OR.200(e) the competent authority may approve an organisation not to implement most of the ISMS requirements if a documented risk assessment shows its activities pose no information security risk with a potential impact on aviation safety. The approval is reviewed in each oversight cycle and whenever the scope of work changes. Occurrence reporting and the confidentiality of information received from other organisations still apply.
NIS2. EASA’s position is that Part-IS is not lex specialis under Article 4 of the NIS2 Directive (EU) 2022/2555, so an organisation in scope of both must comply with both. Article 5 of Regulation (EU) 2023/203 allows compliance with equivalent NIS requirements to count towards Part-IS, except for external reporting under IS.I.OR.230.
ISO/IEC 27001. Certification is not required. An existing ISO 27001 ISMS can be extended to meet Part-IS after a scope and gap analysis, provided aviation safety is built into the risk assessment. Appendix II to the AMC and GM maps Part-IS to ISO 27001.
Where Part-IS implementations run into difficulty
- The ISMS is run by IT as a separate system, with no link to the safety risk register, the SMS or the compliance monitoring programme.
- The risk assessment lists IT assets but never states how their compromise could affect aviation safety, which is the test Part-IS applies.
- Interfaces with contractors and other organisations (software vendors, data providers, maintenance and flight-planning systems) are not identified or managed under IS.I.OR.235.
- The external reporting procedure does not distinguish the notification, the 72-hour report and the follow-up report.
- Organisations holding several approvals build several ISMSs instead of one shared structure.
- A derogation is requested without a documented risk assessment that the authority can accept.
How ASG supports Part-IS compliance
- Applicability assessment for each approval the organisation holds, including whether a derogation under IS.I.OR.200(e) is realistic.
- Gap analysis against Part-IS.I.OR or IS.D.OR, the AMC and GM, and where relevant ISO/IEC 27001 and NIS2.
- ISMS design integrated with the existing management system, SMS and compliance monitoring, so one accountable manager and one set of processes cover all approvals.
- Information security risk assessment workshops that trace each threat to its aviation safety consequence.
- Drafting of the information security management manual (ISMM) and the internal and external reporting procedures.
- Training for the accountable manager, compliance monitoring staff and personnel with access to relevant systems.
- Ongoing support through PART-IS RADAR: effectiveness reviews under IS.I.OR.260, change management, and tracking of EASA amendments and the 2031 extension to ground handling.
Conclusion
Part-IS is now applicable to almost every EASA-approved organisation. Authorities will look for an ISMS that is part of the management system, with risks traced to aviation safety and reporting that works within the 72-hour limit. ASG helps organisations build that system once and use it across all their approvals.
Frequently asked questions
Delegated Regulation (EU) 2022/1645 has applied since 16 October 2025 to design and production organisations and aerodrome operators. Implementing Regulation (EU) 2023/203 has applied since 22 February 2026 to air operators, CAMOs, Part-145 organisations, training organisations, ATM/ANS providers and competent authorities.
Not yet. Delegated Regulation (EU) 2025/22 brings ground handling organisations into the scope of Regulation (EU) 2022/1645 from 27 March 2031, under a declaration regime.
Under IS.I.OR.230, a significant incident or vulnerability is notified to the competent authority as soon as it is known. A report follows within 72 hours at most, and a follow-up report once recovery and preventive actions are identified.
No. An ISO 27001 ISMS can be extended to cover Part-IS after a gap analysis, as long as the risk assessment addresses aviation safety. EASA’s AMC and GM include a mapping between the two.
Not automatically. EASA does not treat Part-IS as lex specialis under NIS2, so organisations in scope of both must comply with both. Equivalent NIS measures can be credited towards Part-IS, except for the external reporting requirement.
The competent authority may approve a derogation under IS.I.OR.200(e) if a documented risk assessment shows the organisation’s activities pose no information security risk with a potential impact on aviation safety. The derogation is reviewed in each oversight cycle.
Key takeaways
- Part-IS has applied since 16 October 2025 (2022/1645) and 22 February 2026 (2023/203)
- It covers operators, CAMOs, Part-145, ATOs, ATM/ANS, aerodromes and design and production organisations
- Ground handlers come into scope from 27 March 2031
- Significant incidents are reported to the authority within 72 hours at most
- The ISMS should sit inside the existing management system, with risks traced to aviation safety
Is your ISMS ready for Part-IS oversight?
Tell us which approvals you hold. ASG will confirm what applies, assess your ISMS against Part-IS and plan the work to close the gaps.
References
- EUR-Lex, Commission Implementing Regulation (EU) 2023/203
- EUR-Lex, Commission Delegated Regulation (EU) 2022/1645
- EASA, Easy Access Rules for Information Security
- EASA, ED Decision 2025/014/R (AMC/GM to Part-IS.D.OR and Part-IS.I.OR)
- EUR-Lex, Commission Delegated Regulation (EU) 2025/22 (ground handling)