Applicability

This Regulation applies to the following organisations (Article 2 of Regulation (EU) 2023/203):

1. maintenance organisations subject to Section A of Annex II (Part-145) to Regulation (EU) No 1321/2014, except those solely involved in the maintenance of aircraft in accordance with Annex Vb (Part-ML) to Regulation (EU) No 1321/2014;
2. continuing airworthiness management organisations (CAMOs) subject to Section A of Annex Vc (Part-CAMO) to Regulation (EU) No 1321/2014, except those solely involved in the continuing airworthiness management of aircraft in accordance with Annex Vb (Part-ML) to Regulation (EU) No 1321/2014;
3. air operators subject to Annex III (Part-ORO) to Regulation (EU) No 965/2012, except those solely involved in the operation of any of the following:
   • ELA 2 aircraft as defined in Article 1(2), point (j) of Regulation (EU) No 748/2012;
   • single-engine propeller-driven aeroplanes with a maximum operational passenger seating configuration (MOPSC) of 5 or less that are not classified as complex motor-powered aircraft, when taking off and landing at the same aerodrome or operating site and operating under visual flight rules (VFR) by day;
   • single-engine helicopters with an MOPSC of 5 or less that are not classified as complex motor-powered aircraft, when taking off and landing at the same aerodrome or operating site and operating under VFR by day.
4. approved training organisations (ATOs) subject to Annex VII (Part-ORA) to Regulation (EU) No 1178/2011, except those solely involved in training activities of ELA2 aircraft as defined in Article 1(2), point (j) of Regulation (EU) No 748/2012, or solely involved in theoretical training;
5. aircrew aero-medical centres subject to Annex VII (Part-ORA) to Regulation (EU) No 1178/2011;
6. flight simulation training device (FSTD) operators subject to Annex VII (Part-ORA) to Regulation (EU) No 1178/2011, except those solely involved in the operation of FSTDs for ELA2 aircraft as defined in Article 1(2), point (j) of Regulation (EU) No 748/2012;
7. air traffic controller training organisations (ATCO TOs) and ATCO aero-medical centres subject to Annex III (Part ATCO.OR) to Regulation (EU) 2015/340;
8. organisations subject to Annex III (Part-ATM/ANS.OR) to Implementing Regulation (EU) 2017/373, except the following service providers:
   • air navigation service providers holding a limited certificate in accordance with point ATM/ANS.OR.A.010 of that Annex;
   • flight information service providers declaring their activities in accordance with point ATM/ANS.OR.A.015 of that Annex;
9. U-space service providers and single common information service providers subject to Implementing Regulation (EU) 2021/664; and
10. approved organisations involved in the design or production of air traffic management/air navigation services (ATM/ANS) systems and ATM/ANS constituents subject to Implementing Regulation (EU) 2023/1769.

Moreover, this Regulation applies to the following organisations (Article 2 of Delegated Regulation (EU) 2022/1645):

1. production organisations and design organisations subject to Subparts G and J of Section A of Annex I (Part 21) to Regulation (EU) No 748/2012, except design and production organisations that are solely involved in the design and/or production of ELA2 aircraft as defined in Article 1(2), point (j) of Regulation (EU) No 748/2012; and
2. aerodrome operators and apron management service providers subject to Annex III ‘Part Organisation Requirements (Part-ADR.OR)’ to Regulation (EU) No 139/2014.

No. The rationale for requiring Part-66 competent authorities to comply with Part-IS is that there is a risk that, for example, information relating to approved Part-66 licences held by competent authorities could be compromised. This would have a potential impact on the availability and/or integrity of the information held, a risk that needs to be considered.

Part-IS applies to organisations holding an approval according to any of the domain-specific regulations.

If an organisation provides services under an approval, that organisation has to comply with Part-IS requirements.

If an organisation does not hold an approval, it does not need to comply with Part-IS. However, if that organisation provides services to approved organisations, the organisation should be considered part of the functional chain to be risk-assessed as required by point IS.I.OR.205. Please refer to GM.IS.OR.205(a) for more information. Non-approved organisations must fulfill specific contractual requirements agreed with the (approved) organisation that has to comply with Part-IS. Please refer to GM1 IS.OR.205(b) for more information.

Under a Bilateral Agreement, the applicability of EASA regulations, including Part-IS, might be subject to the terms of that agreement. Bilateral Agreements often include provisions for mutual recognition of certain certification standards, but they may not automatically include all aspects of EASA regulations like Part-IS.

To determine whether Part-IS applies to your organization under the Bilateral Agreement, you should review the specific terms of the Bilateral Agreement to understand which EASA regulations are recognised and applicable.

No, as required by Article 4(2) of Delegated Regulation (EU) 2022/1645 and Article 5(2) of Implementing Regulation (EU) 2023/203 and in  addition to those requirements, point IS.OR.230 needs to be complied with in order to have legal compliance with the requirements stemming from Part-IS. Compliance with Part-IS will be verified by the competent authority that is identified in Article 6 of the Implementing Regulation and Article 5 of the Delegated Regulation.

The requirements for an information security management system (ISMS) that are specified by Part-IS are in most parts consistent and aligned with ISO/IEC 27001; however, Part-IS introduces provisions that are specific to the context of aviation safety. If an ISO/IEC 27001-based ISMS is already operated by an entity for a different scope and context, it can be adapted and extended to the scope and context of Part-IS based on an analysis of the scope and gaps. In order to take credit from ISO/IEC 27001 certifications to achieve compliance with Part-IS, aviation safety needs to be included in the organisational risk management, with the relevant risk acceptance level determined by the applicable requirement(s) (see figure below). Moreover, for a mapping between the main tasks required under Part-IS and the clauses and associated controls in ISO/IEC 27001, refer to Appendix II of the published Acceptable Means of Compliance and Guidance Material (AMC & GM) to Part-IS.

According to the Guidelines provided by the European Commission on ‘sector-specific Union legal acts’, Part-IS does not fall under the category of ‘Lex Specialis’ (refer to Article 4 of the NIS 2 Directive). This is mainly due to the specific scope of the information security management system (ISMS) legislation as compared to the broader approach of the NIS 2 Directive. However, EASA is working with the European Commission to have Part-IS compliance ‘credited’ in the context of NIS 2 compliance. This can be achieved either during the incorporation of the Directive into national legislation or during the implementation phase. Further guidance on this topic will be provided in 2024.

No. Compliance with NIS requirements does not imply compliance with all Part-IS requirements. Compliance with the security requirements of Article 14 of Directive 2016/1148 (the ‘NIS Directive’) or Article 21 of Directive (EU) 2022/2555 (the ‘NIS 2 Directive’) must be equivalent in effect with the corresponding requirements of Part-IS.OR. This equivalence in effect with Part-IS will be verified by the competent authority that is identified in Article 6 of Implementing Regulation (EU) 2023/203 and Article 5 of Delegated Regulation (EU) 2022/1645.

Yes, according to Article 44 of Directive (EU) 2022/2555 (the ‘NIS 2 Directive’):

‘Directive (EU) 2016/1148 is repealed with effect from 18 October 2024.

References to the repealed Directive shall be construed as references to this Directive and shall be read in accordance with the correlation table set out in Annex III.’

Regulatory deadlines cannot be disregarded. Therefore, organisations within the scope of Delegated Regulation (EU) 2022/1645 have to comply with it by 16 October 2025. However, as the ‘Authority Requirements’ (of Implementing Regulation (EU) 2023/203) will only be applicable as of 22 February 2026, it is possible that before that date, National Aviation Authorities (NAAs) might not be fully compliant with those Authority Requirements. NAAs must nevertheless enforce the Delegated Regulation during the four months between the two applicability dates as an oversight obligation stemming from Article 62 of Regulation (EU) 2018/1139 (the ‘Basic Regulation’). However, a lenient approach is advised to be followed until the Implementing Regulation becomes applicable.

At the same time, we would recommend that all affected parties, i.e. authorities and organisations, incorporate Part-IS into their processes as early as possible, as the objective is to ensure adequate protection of the aviation ecosystem and not merely compliance.

The use of the term ‘information security’ in Part-IS, as opposed to ‘cybersecurity’, is deliberate and significant. This terminology is chosen to encompass a broader range of risks associated with information systems. Unlike ‘cybersecurity’, which primarily focuses on protecting data from digital threats in cyberspace, ‘information security’ is extended beyond the digital realm to include analogue threats. This comprehensive approach acknowledges that vulnerabilities and threats to information systems can arise in both digital and physical formats, thereby necessitating a wider scope of protective measures and considerations.