EASA Part-IS explained: who it applies to, the deadlines, and what it means for aviation suppliers

EASA Part-IS is the EU’s information security rulebook for civil aviation. It requires aviation organisations to run an information security management system for risks with a potential impact on aviation safety. It has applied to design, production and aerodrome organisations since 16 October 2025, and to airlines, maintenance organisations and air navigation service providers since 22 February 2026.

This guide covers what Part-IS is, who it applies to, the deadlines, the requirements, the NIS2 overlap, what it means for suppliers, what to build, and a checklist.

Regulation	Who it covers	Applies from
Delegated Regulation (EU) 2022/1645	Part 21 design and production organisations, aerodrome operators, apron management service providers	16 October 2025
Implementing Regulation (EU) 2023/203	Part-145 maintenance organisations, CAMOs, air operators, training organisations, aero-medical centres, FSTD operators, air navigation and U-space service providers, competent authorities including EASA	22 February 2026
Implementing Regulation (EU) 2025/2293	Amends 2023/203 for declared organisations (no prior approval of the manual)	22 February 2026
Delegated Regulation (EU) 2025/22	Adds certain ground handling organisations	27 March 2031

What is EASA Part-IS?

Part-IS is the name of the annexes to two Commission regulations under the EASA Basic Regulation, (EU) 2018/1139. Part-IS.D.OR is in the Delegated Regulation; Part-IS.I.OR (organisations) and Part-IS.AR (authorities) are in the Implementing Regulation. Point numbers below are from Part-IS.I.OR, which shares its numbering with Part-IS.D.OR.

What separates it from a general-purpose standard is that Part-IS is a safety regulation: the risks that count are those that could reach aviation safety, not commercial confidentiality. Most organisations in scope have run safety management systems for years. Part-IS lands as a second management system on the same rails, and IS.I.OR.200(d) allows the two to be integrated.

Who does Part-IS apply to?

The exclusions matter as much as the table. Out of scope are organisations working solely on ELA2 aircraft or solely under Part-ML, and some operators of small aircraft flying VFR by day. So are ANSPs with a limited certificate and flight information service providers that declare their activities.

An organisation in scope can obtain a derogation from its authority under IS.I.OR.200(e) if a documented risk assessment shows its activities pose no information security risk with a potential impact on aviation safety. The approval is reviewed in each oversight audit cycle and whenever changes are made.

When does Part-IS apply?

Both regulations apply now:

• Since 16 October 2025: organisations under 2022/1645.
• Since 22 February 2026: organisations and authorities under 2023/203.
• From 27 March 2031: ground handling organisations that process data provided by third parties or give aircraft operators data for operational use (2025/22).

Joint EASA and national authority guidelines expect the ISMS to be “present” and “suitable” at the applicability date: a management manual, a change procedure, an initial risk assessment and a compliance monitoring activity. Reaching “operating” takes longer, and an organisation counts as compliant only once its authority concludes it has reached that level. In practice, oversight in 2026 is moving from documents to whether the system runs.

What does Part-IS require?

IS.I.OR.200 requires the organisation to “set up, implement and maintain” an ISMS, with processes that “correspond to the nature and complexity of its activities, based on an assessment of the information security risks inherent to those activities”.

Point	Requirement
IS.I.OR.200	ISMS, security policy, compliance monitoring reported to the accountable manager
IS.I.OR.205	Risk assessment of exposed elements and of interfaces with other organisations
IS.I.OR.210	Treatment of unacceptable risks, checked for continued effectiveness
IS.I.OR.215	Internal reporting scheme for information security events
IS.I.OR.220	Detection, response and recovery
IS.I.OR.230	External reporting to the competent authority
IS.I.OR.235	Control of contracted information security management activities
IS.I.OR.240	Accountable manager, responsible person or group, competence
IS.I.OR.225, 245 to 260	Response to findings, records, manual, changes, improvement

Three points set it apart from a general ISMS:

• Risk is ranked by safety consequence. The classification must consider the likelihood of the threat scenario and “the severity of its safety consequences” (IS.I.OR.205(c)). EASA’s FAQ rules out risk transfer, for example to an insurer, as a treatment.
• Interfaces are named. The organisation “shall identify the interfaces that it has with other organisations, and which could result in the mutual exposure to information security risks” (IS.I.OR.205(b)). Risk levels take account of information coordinated with those organisations.
• ISO/IEC 27001 is not enough on its own. EASA says an ISO 27001 system can be adapted and extended through an analysis of scope and gaps, because Part-IS adds provisions specific to aviation safety.

How does Part-IS incident reporting work?

Any information security incident or vulnerability “which may represent a significant risk to aviation safety” goes to the competent authority (IS.I.OR.230):

1. Notify as soon as the condition is known.
2. Report as soon as possible, within 72 hours of the condition becoming known, unless exceptional circumstances prevent this.
3. Follow up with recovery and prevention actions once identified.

The design approval holder is also told when an aircraft or its systems or components are affected. This sits alongside occurrence reporting under Regulation (EU) No 376/2014.

How does Part-IS relate to NIS2?

Many organisations are in both. NIS2 Annex I lists commercial air carriers, airport managing bodies and airports, entities operating ancillary installations within airports, and air traffic control operators. Annex II covers manufacture of other transport equipment (NACE C30), which includes aircraft.

Part-IS does not displace NIS2. The Commission’s 2023 guidelines on Article 4 of NIS2 name only DORA as a sector-specific act, and EASA confirms Part-IS is not lex specialis. The credit runs the other way: Article 4(1) of 2022/1645 and Article 5(1) of 2023/203 treat compliance with equivalent NIS security requirements, now read as NIS2, as Part-IS compliance. The competent authority checks “equivalence in effect”; it is not automatic.

In practice an airline or airport runs one ISMS and reports twice. For a significant incident, NIS2 requires an early warning within 24 hours and a notification within 72 hours to the CSIRT or authority. Part-IS requires a report within 72 hours to the aviation authority. Different recipients, different thresholds, one incident procedure. The NIS2 side is in NIS2 for aviation, rail, maritime and road.

Does Part-IS apply to suppliers?

There is a widespread claim that Part-IS flows down to every supplier. It does not, and EASA has answered this directly. IS.I.OR.235 “is applicable only to those suppliers/subcontractors that perform tasks pertinent to information security management activities”. All other suppliers are covered by the customer’s risk assessment under IS.I.OR.205.

If you run part of your customer’s ISMS, such as monitoring, incident response or compliance monitoring, IS.I.OR.235 applies. Your work must meet Part-IS, you work under your customer’s oversight, and the competent authority can have access to you on request. Responsibility can be contracted out; accountability stays with the approved organisation.

If you supply anything else, such as components, software, hosted services or equipment, you sit inside your customer’s interface risk assessment. EASA says the customer can mitigate that risk within its own boundary or by contract, requiring the supplier to implement measures.

So you are still assessed, through questionnaires, contract clauses and sometimes audits. One requirement reaches you almost word for word: under IS.I.OR.215(c), a contracted organisation that may expose the customer to such risks “shall be required to report information security events to the organisation”.

But the legal obligation is theirs. You do not need a Part-IS ISMS unless you are in scope yourself. When a contract amendment says you must be “Part-IS compliant”, the honest answer is usually that you will evidence appropriate information security for the interfaces you touch, and report events. That is a more manageable commitment; the security annex, clause by clause shows how to negotiate it.

Which suppliers get the hardest questions?

Pressure concentrates where a supplier failure could plausibly reach a safety outcome. That means software that touches operations (flight operations, crew scheduling, maintenance records, load and balance), anything with a data interface, design and production data, and connected ground and test equipment. A corrupted maintenance record is a safety question, not an IT question. A fastener supplier with no data interface sees a lighter version.

What should an aviation supplier build?

For a supplier of 20 to 250 people, the efficient answer is not a Part-IS ISMS. It is an ISO 27001 management system scoped to the interfaces your aviation customers care about, with three additions:

1. Assess risk against safety impact, not only business impact. Your customer’s register asks what could hurt someone. Yours should answer in the same terms.
2. Treat your interfaces as the scope boundary, recorded in a register like the one below.
3. Be able to report. Your customer’s 72-hour clock starts when they learn of the incident, so your notice sets their pace. Agree the path before you need it.

AVIATION CUSTOMER INTERFACE REGISTER

Customer and approval  : e.g. Part-145, CAMO, air operator, POA
Interface              : system, data flow or service you provide
Data crossing it       : what data, which direction, how often
Access into customer   : accounts, remote access, API keys, VPN
Safety relevance       : what goes wrong for them if the data is wrong,
                         late or unavailable
Controls               : access, logging, backup, change control
Recovery time          : committed time, last tested (date)
Event reporting        : who you notify, how, within what time
Last reviewed          : date, by whom

The same system answers other customers’ questionnaires and maps onto NIS2. If you make software or connected devices, a separate duty applies to you directly: Cyber Resilience Act reporting has applied to manufacturers since 11 September 2026.

What Part-IS leaves open

Part-IS, like every management system regulation, asks for a process and an assessment. It does not test whether your controls work.

Your customer will ask whether you have access control, logging, vulnerability management and backup. Documented answers satisfy the assessment. They are equally true where nobody has queried a log, a critical vulnerability has been open since spring, and no restore has ever been timed.

That gap matters more here, because the organisation on your interface is judged on safety outcomes. If an integrity failure in your data reaches their operation, nobody will ask afterwards whether you had a policy. They will ask how long the problem was there before anyone noticed.

The useful investment is not a thicker questionnaire response. It is detection and exposure management on the systems that touch your customer’s, findings with an owner and a deadline, and evidence collected from those systems as it happens, with a person reviewing the exceptions. That is how the CloudSoul platform works: automated, with human-in-the-loop expertise. A security audit shows how far you are from what customers will ask.

Part-IS checklist for aviation suppliers

• Confirm whether you are an organisation in scope yourself, or only a supplier.
• If you do information security management work for a customer, plan for IS.I.OR.235 oversight.
• List every interface with each aviation customer and rate it by safety impact.
• Agree an event reporting path and timeline with each customer.
• Replace “Part-IS compliant” clauses with specific, evidenced commitments.
• Test and time the recovery of the systems behind each interface.

Sources

• Commission Delegated Regulation (EU) 2022/1645, Articles 1, 2, 4 and 8 and Annex (Part-IS.D.OR), EUR-Lex.
• Commission Implementing Regulation (EU) 2023/203, Articles 1, 2, 5 and 16 and Annex II (Part-IS.I.OR), EUR-Lex.
• Commission Delegated Regulation (EU) 2025/22 (ground handling), EUR-Lex.
• Commission Implementing Regulation (EU) 2025/2293 (declared organisations), EUR-Lex.
• EASA, Easy Access Rules for Information Security, revision December 2025, with AMC and GM (ED Decisions 2023/008/R to 2023/010/R, updated in 2025), EASA.
• EASA, Information Security (Part-IS) FAQs, including FAQ 142369 on IS.I.OR.235, FAQ 142374 on the applicability date, FAQ 139288 on ISO/IEC 27001 and FAQ 139289 on NIS2, EASA.
• EASA and national authorities, Part-IS oversight approach guidelines, revision August 2025, EASA.
• Directive (EU) 2022/2555 (NIS2), Articles 2, 23 and 44 and Annexes I and II, EUR-Lex.
• Commission Guidelines on the application of Article 4(1) and (2) of NIS2 (2023/C 328/02), EUR-Lex.
• European Commission, Cyber Resilience Act reporting obligations, Shaping Europe’s digital future.

Frequently asked questions