--- title: "Part-IS Requirements, Deadlines and Checklist · Avioverse" description: "Check Part-IS applicability, the 2025 and 2026 deadlines, scope exceptions, approved derogations and the evidence an aviation ISMS needs." url: "https://avioverse.aero/guides/part-is-requirements-deadlines" --- # Part-IS Requirements: Scope, Deadlines and Checklist Check Part-IS applicability, the 2025 and 2026 deadlines, scope exceptions, approved derogations and the evidence an aviation ISMS needs. [Dionysis Kefalas](https://avioverse.aero/articles/author/dennis-kefalas) 11 Jun 2026 Updated 8 Oct 2026 8 min read For Part-145, CAMO and Air Ops staff Part 1 of 4 in Part-IS Implementation Show parts Hide parts 1. 1 Part-IS Requirements, Deadlines and Checklist 2. 2 [Aviation Information Security, Explained](https://avioverse.aero/guides/aviation-information-security-fundamentals) 3. 3 [Aviation Cyber Incidents and Their Lessons](https://avioverse.aero/guides/aviation-cyber-incidents-lessons) 4. 4 [Part-IS Shop-Floor Practice and Reporting](https://avioverse.aero/guides/part-is-best-practices-reporting) Quotes checked on 8 Oct 2026 against EASA Easy Access Rules for Information Security (Regulations (EU) 2022/1645 and (EU) 2023/203) — 5 Dec 2025 revision. On this page ## Who is in scope, and from when? Part-IS requires covered aviation organisations to manage information-security risks that could affect aviation safety, including detecting, responding to and recovering from incidents. Start with your regulated activities and approvals: the company’s size or an IT supplier’s certificate does not decide applicability. **As of 8 October 2026, the principal 16 October 2025 and 22 February 2026 application dates have passed.** An in-scope organisation should now be able to demonstrate its applicable arrangements, or an approved derogation. In the table, **D** means Delegated Regulation (EU) 2022/1645 and its Part-IS.D.OR organisation requirements; **I** means Implementing Regulation (EU) 2023/203 and Part-IS.I.OR. The scope comes from their respective [D Article 2](https://avioverse.aero/regulations/easa/part-is/delegated-regulation-eu-2022-1645/cover-regulation-to-delegated-regulation-eu-2022/article-2) and [I Article 2](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/cover-regulation-to-implementing-regulation-eu/article-2); dates come from [D Article 8](https://avioverse.aero/regulations/easa/part-is/delegated-regulation-eu-2022-1645/cover-regulation-to-delegated-regulation-eu-2022/article-8) and [I Article 16](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/cover-regulation-to-implementing-regulation-eu/article-16). Keep each row’s exception with the activity it limits. | Organisation or regulated activity | Regime and application date | Scope boundary or exception | | ------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Part-21 Subpart G production and Subpart J design organisations | D — 16 October 2025 | Except those solely designing and/or producing ELA2 aircraft, as defined in Regulation 748/2012 Article 1(2)(j). This is not a general small-supplier exception. | | Aerodrome operators and apron management service providers | D — 16 October 2025 | Those subject to Part-ADR.OR. Operating under a declaration does not by itself exclude an organisation. | | Part-145 maintenance organisations | I — 22 February 2026 | Except those solely maintaining aircraft in accordance with Part-ML. Small size or component maintenance alone does not establish this exception. | | Part-CAMO organisations | I — 22 February 2026 | Except those solely managing aircraft in accordance with Part-ML. A mixed Part-M/Part-ML portfolio does not qualify. | | Part-ORO air operators | I — 22 February 2026 | Except operators solely operating the Article 2(1)(c) categories: ELA2 aircraft; or single-engine propeller aeroplanes/single-engine helicopters with maximum operational passenger seating configuration of five or fewer, non-complex, taking off and landing at the same aerodrome/site, under visual flight rules by day. All conditions of the relevant category matter. | | Part-ORA approved training organisations (ATOs) | I — 22 February 2026 | Except those solely training on ELA2 aircraft or solely providing theoretical training. | | Part-ORA aircrew aero-medical centres; Part-ATCO.OR air traffic controller training organisations and aero-medical centres | I — 22 February 2026 | The named regulated organisations. The ATO theory-only exception does not extend to these categories. | | Part-ORA flight simulation training device (FSTD) operators | I — 22 February 2026 | Except those solely operating FSTDs for ELA2 aircraft. | | Part-ATM/ANS.OR air traffic management/air navigation service organisations | I — 22 February 2026; EGNOS provider — **1 January 2026** | Except limited-certificate providers under ATM/ANS.OR.A.010 and flight information service providers declaring under .A.015. | | U-space and single common information service providers; approved ATM/ANS system or constituent design/production organisations | I — 22 February 2026 | The respective categories under Regulations 2021/664 and 2023/1769. Check the actual regulated activity. | | Listed competent authorities, including EASA and the specified Part-66 and Part-AR.UAS authorities | I — 22 February 2026 | Article 2(2), (3) and (3a); **Part-IS.AR** applies to authorities, rather than the organisation annex. | | Ground-handling organisations under Regulation 2025/20 | D addition — **27 March 2031, future** | Those needing to process third-party data to provide their services, or directly supplying aircraft operators with operational data. Another approval/activity may already bring the organisation into scope. | The ground-handling row comes from [Regulation (EU) 2025/22](https://eur-lex.europa.eu/eli/reg_del/2025/22/oj/eng/pdf). It is not an active trigger solely on that basis in October 2026. The authorities’ 2026 date also did not postpone the delegated organisations’ 2025 date. EASA publishes the [implementing scope and dates together](https://www.easa.europa.eu/en/document-library/easy-access-rules/online-publications/easy-access-rules-information-security?erules-id=ERULES-1963177438-19948). ## A practical applicability check Use this sequence to build a traceable decision; it is a working method, not an additional prescribed approval process. 1. **List every approval and declared activity.** Match each to the two Article 2 lists. A trading description such as “training company” is too broad. 2. **Test the exact exception.** Record the aircraft and operational limits. “Mostly Part-ML” cannot demonstrate “solely Part-ML”. 3. **Record the applicable regime, date and authority.** Authority allocation is in [I Article 6](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/cover-regulation-to-implementing-regulation-eu/article-6) and [D Article 5](https://avioverse.aero/regulations/easa/part-is/delegated-regulation-eu-2022-1645/cover-regulation-to-delegated-regulation-eu-2022/article-5). Check additional activities even where one qualifies for an exception. 4. **Document the outcome and next action.** In scope: establish the applicable information security management system (ISMS), or pursue the approval route below. Outside a listed category: retain the reasoning and reconsider it when activities change. A CAO-only or Part-147-only approval is not itself named in either scope list. This follows from the enumerated categories; it is not a blanket statutory exemption for every organisation holding one of those approvals. ## Scope exception, derogation and ISO 27001 These answer different questions. A **scope exception** means the activity meets an exclusion written into Article 2. A **derogation** gives an in-scope organisation authority-approved relief from specified requirements. **ISO/IEC 27001 certification** can provide useful implementation evidence but does not decide either question. Under [IS.I.OR.200(e)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200) and [IS.D.OR.200(e)](https://avioverse.aero/regulations/easa/part-is/delegated-regulation-eu-2022-1645/annex-information-security-organisation/is-d-or-200), the derogation test covers the organisation’s activities, facilities, resources and services: they must pose no information-security risk with potential aviation-safety impact to itself **or other organisations**. A documented assessment under the applicable .205 must be reviewed and approved by the competent authority. Low risk, small size or a pending application is not that approval. The relief covers the requirements specified in .200(e). Regulation 376/2014 reporting obligations and the .200(a)(13) confidentiality duty remain. The authority reviews continued validity through its oversight audit cycle and when the organisation’s scope of work changes. For an existing ISO system, compare the certified scope with the aviation activities, data and interfaces now assessed. Identify missing Part-IS processes and aviation-safety risk acceptance criteria. This approach follows the guidance in [GM1 IS.I.OR.200](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#gm1-is-i-or-200) and [EASA’s ISO/IEC 27001 FAQ](https://www.easa.europa.eu/en/faq/139288); it is not automatic recognition of the certificate as Part-IS compliance. ## What implementation evidence should show For an organisation implementing an ISMS, use the following as an evidence review checklist. The anchors below use Part-IS.I.OR; delegated organisations should use their applicable Part-IS.D.OR provisions. | Check | Evidence to look for | Implementing rule | | ------------------------ | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Ownership and competence | Information-security policy, assigned responsibilities, competent personnel and compliance-monitoring arrangements | [IS.I.OR.200(a)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200), .250(a) | | Scope and interfaces | Activities, resources, systems, data and connections to other organisations | [IS.I.OR.205(a)–(b)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205) | | Risk decisions | Classified risks, treatment decisions and reviews following changes, new knowledge or incident lessons | [IS.I.OR.205(c)–(d)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205), .200(a)(3) | | Incident arrangements | Internal reporting, detection, response, recovery and external reporting procedures | [IS.I.OR.200(a)(4), (5), (8)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200) | | Contracted activities | Oversight, management of associated risks and authority access to contracted information-security activities | [IS.I.OR.235](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235) | | Controlled documentation | Current manual or clear cross-references, applicable amendment/change procedure, and effectiveness reviews | [IS.I.OR.250](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-250), [.255](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-255), [.260](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-260) | | Records | Traceable records protected against damage, alteration and theft, with retention rules assigned by record category | [IS.I.OR.245](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-245) | Interfaces deserve attention even where the supplier itself is outside direct scope: [IS.I.OR.205 (full rule text)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205) Information security risk assessment > \[…] > > (b) The organisation shall identify the interfaces that it has with other organisations, and which could result in the mutual exposure to information security risks. > > \[…] Quoted word for word from Implementing Regulation (EU) 2023/203, Easy Access Rules for Information Security, 5 Dec 2025 revision. For example, a CAMO exchanging records with ExampleMRO should examine access, data integrity and service interruption at that connection. Recording only the CAMO’s own computers would miss the shared exposure. This is an illustrative assessment prompt, not a finding that the connection is unacceptable. ## Integrate the work and control changes Existing management processes can provide a home for Part-IS: [IS.I.OR.200 (full rule text)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200) Information security management system (ISMS) > \[…] > > (d) The processes, procedures, roles and responsibilities established by the organisation in order to comply with point IS.I.OR.200(a) shall correspond to the nature and complexity of its activities, based on an assessment of the information security risks inherent to those activities, and may be integrated within other existing management systems already implemented by the organisation. > > \[…] Quoted word for word from Implementing Regulation (EU) 2023/203, Easy Access Rules for Information Security, 5 Dec 2025 revision. An integrated information security management manual (ISMM) needs clear cross-references under [.250(d)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-250). The evidence should show who acts, which procedures apply and how effectiveness is reviewed, without making readers search unrelated manuals. **Not every manual amendment or ISMS change requires a separate approval.** Under current Part-IS.I.OR, initial ISMM approval is required except for declared organisations; manual amendments and ISMS changes follow the applicable .250/.255 procedures and approval routes. [Regulation (EU) 2025/2293](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX%3A32025R2293), applicable from 22 February 2026, includes the declared-organisation exceptions. These do not remove the duty to maintain the manual or supply its amendments to the authority. Avoid one blanket retention period: [.245](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-245) distinguishes approvals, contracts, process/risk/incident records, events awaiting reassessment and personnel records. For the vocabulary and practical examples, continue with [aviation information-security fundamentals](https://avioverse.aero/guides/aviation-information-security-fundamentals), then the [incident lessons](https://avioverse.aero/guides/aviation-cyber-incidents-lessons). The [shop-floor practice and reporting guide](https://avioverse.aero/guides/part-is-best-practices-reporting) explains the reporting sequence and clocks. The source baseline is EASA’s [December 2025 Information Security Easy Access Rules](https://www.easa.europa.eu/en/document-library/easy-access-rules/easy-access-rules-information-security-regulations-eu-2023203-and-20221645), which incorporates 2025/2293 and 2025/22. The latter’s future ground-handling applicability remains separate from today’s obligations. Educational content, not regulatory compliance advice. Verify against the current regulation text before relying on it. ## In this series ## Frequently asked questions ### Has the Part-IS deadline passed? As of 8 October 2026, the principal application dates of 16 October 2025 and 22 February 2026 have passed. The EGNOS provider date was 1 January 2026. The separate ground-handling addition applies from 27 March 2031; it is not a current trigger solely on that basis. ### Does every Part-145 organisation need a Part-IS ISMS? Article 2(1)(a) of Regulation (EU) 2023/203 excepts organisations solely maintaining aircraft in accordance with Part-ML. Small size or component maintenance alone is not that exception. An organisation otherwise in scope needs competent-authority approval for relief under IS.I.OR.200(e). ### Is a CAMO managing only Part-ML aircraft outside Part-IS? Article 2(1)(b) excepts that activity when the organisation solely manages aircraft in accordance with Part-ML. A mixed Part-M and Part-ML portfolio does not meet that condition. Check any other approvals or activities separately. ### Are CAOs and Part-147 organisations automatically covered? A CAO or Part-147 approval is not itself a listed trigger in either Article 2 scope list. That is a reading of the listed categories, not a blanket statutory exemption. Another approval or activity may bring the organisation into scope, and customers may need to assess its information-security interfaces. ### Can a small organisation declare itself exempt? An express scope exception is different from an IS.I.OR.200(e) or IS.D.OR.200(e) derogation. The derogation requires a documented risk assessment and competent-authority approval. A pending request does not grant relief, and an approved derogation remains subject to review. ### Does ISO 27001 certification establish Part-IS compliance? No. An existing ISO/IEC 27001 system can support implementation, but its scope and gaps need assessment against Part-IS. Aviation-safety risks and the applicable risk-acceptance requirements must be covered; the certificate is not a scope exception or an approved derogation. ### Can we integrate Part-IS with our existing management system? Yes. IS.I.OR.200(d) and IS.D.OR.200(d) permit integration with existing management systems. IS.I.OR.250(d) also permits an integrated manual with clear cross-references. Integration still needs to cover the applicable information-security processes, responsibilities and evidence. ### Does outsourcing IT transfer the Part-IS obligation? No. Applicability follows the regulated activity. Under IS.I.OR.235 and IS.D.OR.235, contracted information-security management activities must comply with the regulation, remain under the organisation’s oversight and allow competent-authority access on request. ## Related - [Information Security Fundamentals for Aviation Professionals Guide · 10 min](https://avioverse.aero/guides/aviation-information-security-fundamentals) - [What Aviation Learned the Hard Way: Real Information-Security Incidents Guide · 8 min](https://avioverse.aero/guides/aviation-cyber-incidents-lessons) - [Part-IS on the Shop Floor: Best Practices and Reporting Guide · 9 min](https://avioverse.aero/guides/part-is-best-practices-reporting) Written by Dionysis Kefalas. Retired Hellenic Air Force Captain and founder of Avioverse. [About the author](https://avioverse.aero/articles/author/dennis-kefalas) Share [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Favioverse.aero%2Fguides%2Fpart-is-requirements-deadlines)[X](https://twitter.com/intent/tweet?url=https%3A%2F%2Favioverse.aero%2Fguides%2Fpart-is-requirements-deadlines\&text=Part-IS%20Requirements%2C%20Deadlines%20and%20Checklist)