Since 22 February 2026 most approved organisations in EU civil aviation must run an information security management system that manages risks with a potential impact on aviation safety, and report significant incidents to their competent authority within 72 hours. These obligations come from Part-IS, two EU regulations prepared by EASA: Commission Delegated Regulation (EU) 2022/1645, applicable since 16 October 2025 to design and production organisations and aerodrome operators, and Commission Implementing Regulation (EU) 2023/203, which completed full applicability across the sector. This guide sets out who is covered, every organisation requirement from IS.I.OR.200 to IS.I.OR.260, the dates, how compliance is enforced through oversight, and how to implement it, with attention to the machine accounts and supplier access that sit behind most aviation IT. It is written for compliance monitoring managers, CISOs and accountable managers at airlines, maintenance and training organisations, air navigation service providers and aerodromes. For the wider aviation threat picture see the Aviation Cybersecurity Guide.
Status line: checked 27 October 2026 against the EUR-Lex texts of Regulations (EU) 2023/203 and 2022/1645 and EASA's notice that Part-IS is now fully applicable. EASA publishes Acceptable Means of Compliance and Guidance Material (AMC and GM) and FAQs that are updated over time; check the current versions before relying on them.
Key takeaways
- Safety impact is the test. Part-IS is not a general data protection or IT security law: it covers information security risks that could affect aviation safety, across information and communication technology systems and data.
- Two regulations, one rulebook. 2022/1645 (requirements IS.D.OR) applies from 16 October 2025 and 2023/203 (requirements IS.I.OR, plus authority requirements IS.AR) from 22 February 2026, with near-identical organisation requirements.
- An ISMS with a manual, not a certificate. Organisations must set up an ISMS (IS.I.OR.200), document it in an ISMS manual (IS.I.OR.250) and show it to their competent authority; ISO/IEC 27001 can be the engine but its scope must follow aviation safety.
- 72 hours to report. IS.I.OR.230 requires a report to the competent authority no later than 72 hours after the organisation becomes aware of a significant incident or vulnerability, unless exceptional circumstances prevent it.
- Contractors do not move the duty. IS.I.OR.235 keeps the organisation responsible for contracted information security activities and requires that the authority can reach contractors on request.
Scope: who and what is covered
Article 1 of Regulation 2023/203 states the purpose: organisations and authorities must identify and manage information security risks with a potential impact on aviation safety, detect information security events and identify those that are incidents, and respond to and recover from them.
| Regulation and requirement set | Organisations in scope | Main exclusions noted in the text | Applies from |
|---|---|---|---|
| Delegated Regulation (EU) 2022/1645, Part-IS.D.OR | Design and production organisations under Part 21 Subparts G and J; aerodrome operators and apron management service providers under Part-ADR.OR | Organisations solely designing or producing ELA2 aircraft | 16 October 2025 |
| Implementing Regulation (EU) 2023/203, Part-IS.I.OR | Part-145 maintenance organisations; CAMOs; air operators; approved training organisations; aircrew aero-medical centres; FSTD operators; ATCO training organisations and ATCO aero-medical centres; ATM/ANS providers; U-space service providers and single common information service providers | Organisations solely maintaining or managing Part-ML aircraft; certain ELA2 and small VFR day operators; ELA2-only or theory-only training; limited-certificate ANSPs and some flight information service providers | 22 February 2026 (EGNOS provider from 1 January 2026) |
| Implementing Regulation (EU) 2023/203, Part-IS.AR | Competent authorities, including EASA and the authorities for aircraft maintenance licences | None for authorities | 22 February 2026 |
The derogation in IS.I.OR.200(e)
An organisation can ask its competent authority to approve that it does not apply most ISMS requirements, if it shows that its activities, facilities and resources, and the services it operates, provides, receives and maintains, pose no information security risk with a potential impact on aviation safety for itself or other organisations. The case rests on a documented risk assessment that the authority reviews and approves, its validity is rechecked during oversight and after changes of scope, and the organisation must still meet occurrence reporting duties under Regulation (EU) No 376/2014 and protect confidential information. In practice it suits small organisations with no safety-relevant systems or interfaces; most approved organisations will not qualify.
Relationship with other security laws
Article 4 of 2022/1645 states that where an organisation meets the security requirements of Article 14 of the NIS Directive (EU) 2016/1148 that are equivalent to the regulation, that compliance counts. Entities covered by a national civil aviation security programme can treat the cybersecurity requirements of point 1.7 of Implementing Regulation (EU) 2015/1998 as equivalent, except for external reporting (IS.D.OR.230), which they must still meet. NIS2 has since replaced the NIS Directive, so organisations in both regimes should map Part-IS evidence to NIS2 measures deliberately rather than assume equivalence. See the NIS2 Directive Guide.
Key obligations
| Requirement | Title | What it requires | Typical evidence |
|---|---|---|---|
| IS.I.OR.200 | Information security management system | Set up and maintain an ISMS covering policy, risk management, internal reporting, incident handling, contracting, personnel and records | Information security policy signed by the accountable manager, ISMS scope tied to safety |
| IS.I.OR.205 | Information security risk assessment | Identify all elements and interfaces exposed to information security risks, classify risks by likelihood and safety severity, review when conditions change | Asset and interface register, risk register with safety severity scale |
| IS.I.OR.210 | Information security risk treatment | Treat unacceptable risks, implement measures in time, verify effectiveness, inform affected personnel | Treatment plan with owners and dates, effectiveness checks |
| IS.I.OR.215 | Information security internal reporting scheme | Collect and evaluate events, identify incidents and vulnerabilities, distribute findings internally | Reporting channel, event log, triage records |
| IS.I.OR.220 | Information security incidents: detection, response and recovery | Detect incidents and vulnerabilities, respond, and recover to a safe state within a defined time | Detection use cases, response and recovery procedures, exercise reports |
| IS.I.OR.225 | Response to findings notified by the competent authority | Root cause analysis, corrective action plan, demonstrate correction within the agreed period | Finding closure records |
| IS.I.OR.230 | Information security external reporting scheme | Report significant incidents and vulnerabilities to the competent authority and, where relevant, to design organisations | Reporting procedure with 72-hour clock, submitted reports, follow-ups |
| IS.I.OR.235 | Contracting of information security management activities | Ensure contracted activities meet the regulation and the authority can access the contractor | Contract clauses, contractor oversight records |
| IS.I.OR.240 | Personnel requirements | Accountable manager, common responsible person for information security, compliance monitoring, competent and trustworthy staff | Nominations, training and competence records, background checks where applicable |
| IS.I.OR.245 | Record-keeping | Keep records of approvals, contracts, key processes, risks, incidents and events | Records retained at least 5 years (staff qualification records while employed plus 3 years) |
| IS.I.OR.250 | Information security management manual (ISMM) | A manual with the accountable manager's statement, roles, policy, staffing, procedures and organisation charts | Approved ISMM, change history |
| IS.I.OR.255 | Changes to the ISMS | Manage and, where required, notify changes to the ISMS | Change log, authority notifications |
| IS.I.OR.260 | Continuous improvement | Assess ISMS effectiveness and maturity and improve it | Internal audits, maturity assessments, improvement plan |
The IS.D.OR points in 2022/1645 follow the same numbering and content for design and production organisations and aerodromes. Organisations can integrate the ISMS with their existing management system (for example the safety management system and compliance monitoring), which is the approach most airlines and maintenance organisations take.
The reporting clock
- Notify: as soon as the organisation becomes aware of the condition.
- Report: as soon as possible, and no later than 72 hours after becoming aware, unless exceptional circumstances prevent it.
- Follow up: as soon as recovery and prevention actions have been identified.
Reports go to the competent authority and, where the incident or vulnerability concerns a product, to the relevant design approval holder, which is how a weakness in an aircraft system found by an operator reaches the manufacturer. See the Cyber Incident Reporting Requirements Map for how this clock sits beside NIS2 and other regimes.
Timeline and current status
| Date | Event |
|---|---|
| 16 October 2025 | Delegated Regulation (EU) 2022/1645 applies (design and production organisations, aerodrome operators, apron management) |
| 1 January 2026 | Regulation (EU) 2023/203 applies to the EGNOS air navigation service provider |
| 22 February 2026 | Regulation (EU) 2023/203 applies to all other organisations and authorities in scope; EASA declares Part-IS fully applicable |
| Ongoing | Competent authorities run initial and recurrent oversight of ISMS implementation; EASA publishes AMC, GM and FAQs |
The regulation is now in force for the whole in-scope sector, so the question for most organisations is no longer the deadline but the maturity of what they have built. Authorities generally expect the ISMS to mature over successive oversight cycles, which is why IS.I.OR.260 asks for maturity assessment rather than a single pass or fail.
Enforcement and penalties
- Oversight findings: Part-IS is enforced through the same oversight system as other EASA rules. Findings require root cause analysis and a corrective action plan under IS.I.OR.225, closed within the period agreed with the authority.
- Approval consequences: because Part-IS is part of the conditions of an organisation's approval, persistent or serious non-compliance can lead to limitation, suspension or revocation of the approval under the relevant domain rules, which for an airline or maintenance organisation is an existential sanction.
- National penalties: penalties for infringements of EU aviation safety rules are set at national level; amounts and procedures are national.
- Reporting failures: failure to report a significant incident within 72 hours is a discrete, easily evidenced non-compliance, separate from any weakness that caused it.
What it means for AI agents and non-human identities
IS.I.OR.205 asks organisations to identify all elements and interfaces exposed to information security risk. In a modern airline or maintenance organisation, many of those interfaces are authenticated by machines: integrations between maintenance information systems and aircraft data, electronic flight bag synchronisation, crew scheduling feeds, airport collaborative decision-making data exchanges, and supplier portals.
| Machine credential | Why Part-IS cares | Control |
|---|---|---|
| Integration service accounts between maintenance, engineering and planning systems | Tampered maintenance records or task cards have a direct airworthiness impact | Per-integration accounts, least privilege, write logging, owner per account |
| API keys and certificates for electronic flight bag and aircraft data loading | Integrity of navigation databases, performance data and software parts | Signed data, certificate lifecycle, key storage in HSMs |
| Contractor and MRO partner remote access accounts | IS.I.OR.235 keeps responsibility with the organisation | Brokered remote access, expiry, session recording. See the Third-Party Access Guide. |
| OT and ground system accounts at aerodromes and ANSPs | Baggage, lighting, surveillance and communication systems support safe operations | Segmented zones, vaulted shared accounts. See the OT and ICS Identity and Access Guide. |
| AI agents and automation used in operations control or maintenance planning | An agent that can change schedules, rosters or work orders is an element exposed to risk under IS.I.OR.205 | Inventory each agent, scope its tools and data, require human approval for safety-relevant actions, log all actions |
Two practical rules follow. First, every machine credential that can change safety-relevant data should have an owner, a documented purpose and an expiry, and appear in the IS.I.OR.205 register. Second, AI tools that summarise technical logs or draft maintenance actions should be treated as an interface in the risk assessment: who reviews their output, what data they can read, and what they can write.
Compliance steps
- Confirm applicability. Check each approval held against Article 2 of 2023/203 or 2022/1645 and the exclusions, and decide whether a derogation under IS.I.OR.200(e) is credible. Most will not be.
- Appoint the roles. Confirm the accountable manager's responsibility, nominate the common responsible person for information security and integrate Part-IS into compliance monitoring (IS.I.OR.240).
- Define the safety-driven scope. Start from operational processes and safety functions, then identify the information systems, data and interfaces that support them, including suppliers and machine-to-machine links.
- Run the risk assessment. Classify risks by likelihood and safety severity using a scale aligned to the safety management system, so the same severity language is used for both.
- Treat and verify. Implement measures (access control, segmentation, backup, logging, secure configuration), record owners and dates, and check effectiveness.
- Build detection and response. Define detection use cases for the systems in scope, response and recovery procedures with a target time to a safe state, and exercise them.
- Wire up reporting. Write the internal reporting scheme (IS.I.OR.215) and external reporting procedure with the 72-hour clock, and align it with occurrence reporting under Regulation 376/2014.
- Write the ISMM and contracts. Produce the manual (IS.I.OR.250) and update contracts with suppliers who perform information security activities (IS.I.OR.235).
- Measure and improve. Plan internal audits and a maturity assessment (IS.I.OR.260) before the first authority audit.
Metrics that show the ISMS works
- Interface coverage: share of safety-relevant systems and interfaces with an assessed risk entry.
- Treatment on time: share of risk treatment actions closed by their due date.
- Time to report: hours from awareness to authority report for significant incidents (must be under 72).
- Machine credential ownership: share of service accounts and keys on safety-relevant systems with a named owner and expiry.
- Exercise results: time to restore a safe state in recovery exercises against the defined target.
Framework mapping
| Part-IS requirement | ISO/IEC 27001:2022 | NIST CSF 2.0 |
|---|---|---|
| IS.I.OR.200, .250 ISMS and manual | Clauses 4 to 7 | GV.RM-01 |
| IS.I.OR.205, .210 risk assessment and treatment | Clauses 6.1.2, 6.1.3, 8.2, 8.3 | ID.RA-05 |
| IS.I.OR.215, .220 reporting, detection, response, recovery | Annex A 5.24 to 5.26, 8.16 | DE.CM-01, DE.AE-02 |
| IS.I.OR.230 external reporting | Annex A 5.5, 5.24 | RS.CO-02 |
| IS.I.OR.235 contracting | Annex A 5.19 to 5.22 | GV.SC-05, GV.SC-07 |
| IS.I.OR.240 personnel | Clause 7.2, Annex A 6.1, 6.3 | PR.AA-05 |
| IS.I.OR.260 continuous improvement | Clauses 9 and 10 | ID.IM-01 |
ISO/IEC 27001 certification is not required by Part-IS and does not automatically demonstrate compliance, because the risk criteria must be aviation safety, but an existing ISMS can be extended rather than duplicated. See the ISO 27001 Certification Guide.
Common failure patterns
- Copying the corporate ISO 27001 scope: the ISMS covers email and HR systems well but misses maintenance data flows and ground operational systems that matter for safety.
- Two severity scales: security and safety teams rate the same scenario differently, so risks with a safety impact are under-ranked.
- Supplier blind spots: outsourced IT and MRO partners hold privileged access but contracts lack Part-IS clauses or authority access rights.
- No 72-hour drill: the reporting procedure exists but nobody has practised deciding whether an incident is significant, so the clock runs out.
- Unowned machine accounts: integration accounts created during system projects remain with broad write access and no owner.
Practitioner checklist
- Map every approval held to Regulation 2023/203 or 2022/1645 and record the applicable date.
- Nominate the accountable manager's delegate roles under IS.I.OR.240 and brief them.
- Build an interface register that includes machine-to-machine links and supplier access.
- Use one severity scale for safety and information security risk.
- Write and exercise a 72-hour external reporting procedure aligned with Regulation 376/2014.
- Add Part-IS clauses and authority access rights to contracts with security-relevant suppliers.
- Give every service account, key and AI agent on safety-relevant systems an owner and expiry.
- Retain ISMS records for at least five years.
- Schedule an internal maturity assessment before the first authority audit.
Standards and references
- EUR-Lex: Commission Implementing Regulation (EU) 2023/203 (Part-IS)
- EUR-Lex: Commission Delegated Regulation (EU) 2022/1645 (Part-IS)
- EASA: Part-IS is now fully applicable
- EASA: EASA publishes FAQs on Information Security
- ISO: ISO/IEC 27001:2022 Information security management systems, Requirements
- NIST: Cybersecurity Framework (CSF) 2.0
Related NHI Mgmt Group resources: Aviation Cybersecurity Guide · ISO 27001 Certification Guide · Cyber Incident Reporting Requirements Map · Third-Party Access Guide. This guide summarises EASA Part-IS (Regulations (EU) 2022/1645 and 2023/203) and is not legal advice.