Expansion of the management systems in the implementing regulations of the EASA Basic Regulation to include information security (Part-IS)
Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203 on information security in civil aviation, known as Part IS (Information Security), establish mandatory security standards aimed at strengthening information security in aviation and protecting aviation operators against the growing threat of cyberattacks. These regulations are aimed at organisations in the aviation industry as well as aviation authorities.
What does Part-IS include?
The regulation requires the affected organizations in the aviation industry to have elements of an information security management system (ISMS) to identify and minimize information security risks that have an impact on aviation security. This ISMS is designed to help organizations systematically and proactively address security threats, i.e., detect, prevent, and respond to security incidents, and restore integrity and availability after an incident. This includes defining responsibilities and accountabilities, identifying and assessing information security risks, developing appropriate measures, training staff, and monitoring compliance.
The implementation of the ISMS is to be carried out in compliance with proportionality (an EASA Guidance Material (GM) provides detailed information on this) and in integration with existing management systems.
Who is affected by Part-IS and when do the provisions come into force?
On 16 October 2025, the EU provisions on information security (Part-IS) will come into force for airport operators, apron control services, production organisations and design organisations. In a second step, it applies starting 22 February 2026 for air carriers, maintenance organisations, continuing airworthiness management organisations (CAMO), approved training organisations (ATO), aeromedical centres for aircrew and air traffic controllers, operators of flight simulation training equipment, training organisations for air traffic controllers (ATCO TO), air navigation service providers, providers of U-space services as well as the competent authorities, including EASA.
Note: The organisations underlined do not fall within the area of responsibility of Austro Control GmbH.
