Part-IS Requirements: Scope, Deadlines and Checklist

Who is in scope, and from when?

Part-IS requires covered aviation organisations to manage information-security risks that could affect aviation safety, including detecting, responding to and recovering from incidents. Start with your regulated activities and approvals: the company’s size or an IT supplier’s certificate does not decide applicability.

As of 8 October 2026, the principal 16 October 2025 and 22 February 2026 application dates have passed. An in-scope organisation should now be able to demonstrate its applicable arrangements, or an approved derogation.

In the table, D means Delegated Regulation (EU) 2022/1645 and its Part-IS.D.OR organisation requirements; I means Implementing Regulation (EU) 2023/203 and Part-IS.I.OR. The scope comes from their respective D Article 2 and I Article 2; dates come from D Article 8 and I Article 16. Keep each row’s exception with the activity it limits.

The ground-handling row comes from Regulation (EU) 2025/22. It is not an active trigger solely on that basis in October 2026. The authorities’ 2026 date also did not postpone the delegated organisations’ 2025 date. EASA publishes the implementing scope and dates together.

A practical applicability check

Use this sequence to build a traceable decision; it is a working method, not an additional prescribed approval process.

1. List every approval and declared activity. Match each to the two Article 2 lists. A trading description such as “training company” is too broad.
2. Test the exact exception. Record the aircraft and operational limits. “Mostly Part-ML” cannot demonstrate “solely Part-ML”.
3. Record the applicable regime, date and authority. Authority allocation is in I Article 6 and D Article 5. Check additional activities even where one qualifies for an exception.
4. Document the outcome and next action. In scope: establish the applicable information security management system (ISMS), or pursue the approval route below. Outside a listed category: retain the reasoning and reconsider it when activities change.

A CAO-only or Part-147-only approval is not itself named in either scope list. This follows from the enumerated categories; it is not a blanket statutory exemption for every organisation holding one of those approvals.

Scope exception, derogation and ISO 27001

These answer different questions. A scope exception means the activity meets an exclusion written into Article 2. A derogation gives an in-scope organisation authority-approved relief from specified requirements. ISO/IEC 27001 certification can provide useful implementation evidence but does not decide either question.

Under IS.I.OR.200(e) and IS.D.OR.200(e), the derogation test covers the organisation’s activities, facilities, resources and services: they must pose no information-security risk with potential aviation-safety impact to itself or other organisations. A documented assessment under the applicable .205 must be reviewed and approved by the competent authority. Low risk, small size or a pending application is not that approval.

The relief covers the requirements specified in .200(e). Regulation 376/2014 reporting obligations and the .200(a)(13) confidentiality duty remain. The authority reviews continued validity through its oversight audit cycle and when the organisation’s scope of work changes.

For an existing ISO system, compare the certified scope with the aviation activities, data and interfaces now assessed. Identify missing Part-IS processes and aviation-safety risk acceptance criteria. This approach follows the guidance in GM1 IS.I.OR.200 and EASA’s ISO/IEC 27001 FAQ; it is not automatic recognition of the certificate as Part-IS compliance.

What implementation evidence should show

For an organisation implementing an ISMS, use the following as an evidence review checklist. The anchors below use Part-IS.I.OR; delegated organisations should use their applicable Part-IS.D.OR provisions.

Interfaces deserve attention even where the supplier itself is outside direct scope:

For example, a CAMO exchanging records with ExampleMRO should examine access, data integrity and service interruption at that connection. Recording only the CAMO’s own computers would miss the shared exposure. This is an illustrative assessment prompt, not a finding that the connection is unacceptable.

Integrate the work and control changes

Existing management processes can provide a home for Part-IS:

An integrated information security management manual (ISMM) needs clear cross-references under .250(d). The evidence should show who acts, which procedures apply and how effectiveness is reviewed, without making readers search unrelated manuals.

Not every manual amendment or ISMS change requires a separate approval. Under current Part-IS.I.OR, initial ISMM approval is required except for declared organisations; manual amendments and ISMS changes follow the applicable .250/.255 procedures and approval routes. Regulation (EU) 2025/2293, applicable from 22 February 2026, includes the declared-organisation exceptions. These do not remove the duty to maintain the manual or supply its amendments to the authority.

Avoid one blanket retention period: .245 distinguishes approvals, contracts, process/risk/incident records, events awaiting reassessment and personnel records.

For the vocabulary and practical examples, continue with aviation information-security fundamentals, then the incident lessons. The shop-floor practice and reporting guide explains the reporting sequence and clocks.

The source baseline is EASA’s December 2025 Information Security Easy Access Rules, which incorporates 2025/2293 and 2025/22. The latter’s future ground-handling applicability remains separate from today’s obligations.