---
title: "ORO.GEN.200A Information security management system — Part-ORO · Avioverse"
description: "In addition to the management system referred to in point ORO.GEN.200, the operator shall establish, implement and maintain an information security…"
url: "https://avioverse.aero/regulations/easa/air-ops/part-oro/subpart-gen/oro-gen-200a"
---

# ORO.GEN.200A Information security management system

ANNEX III (Part-ORO) · Regulation (EU) No 965/2012 · EAR revision 27 Mar 2026

Official sources: [EASA Easy Access Rules (opens in a new tab)](https://www.easa.europa.eu/en/document-library/easy-access-rules/easy-access-rules-air-operations) · [EUR-Lex 2012/965 (opens in a new tab)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32012R0965)

IR Implementing rule

## ORO.GEN.200A Information security management system

In addition to the management system referred to in point ORO.GEN.200, the operator shall establish, implement and maintain an information security management system in accordance with Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

IR · ORO.GEN.200A — Regulation (EU) No 965/2012 · Regulation (EU) 2023/203 · Air OPS Easy Access Rules · EAR revision 27 Mar 2026

[All rules in SUBPART GEN: GENERAL REQUIREMENTS](https://avioverse.aero/regulations/easa/air-ops/part-oro/subpart-gen)

Consolidated from the EASA Easy Access Rules (revision 27 Mar 2026, extracted 2 Nov 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.