---
title: "ATCO.OR.C.001A Information security management system — ANNEX III – PART ATCO.OR – REQUIREMENTS FOR AIR TRAFFIC CONTROLLER TRAINING ORGANISATIONS AND AERO-MEDICAL CENTRES, ATCO · Avioverse"
description: "In addition to the management system referred to in point ATCO.OR.C.001, the training organisation shall establish, implement and maintain an information…"
url: "https://avioverse.aero/regulations/easa/atco/part-atco-or-requirements-for-air-traffic/subpart-c/atco-or-c-001a"
---

# ATCO.OR.C.001A Information security management system

ANNEX III – PART ATCO.OR – REQUIREMENTS FOR AIR TRAFFIC CONTROLLER TRAINING ORGANISATIONS AND AERO-MEDICAL CENTRES · Regulation (EU) 2015/340 · EAR revision 14 Jun 2024

IR Implementing rule

## ATCO.OR.C.001A Information security management system

In addition to the management system referred to in point ATCO.OR.C.001, the [training organisation](https://avioverse.aero/glossary/easa/training-organisation) shall establish, implement and maintain an information security management system in accordance with Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

\[Applicable from 22 February 2026 – Regulation (EU) 2023/203]

IR · ATCO.OR.C.001A — Regulation (EU) 2015/340 · Regulation (EU) 2023/203 · ATCO Easy Access Rules · EAR revision 14 Jun 2024

[All rules in SUBPART C – MANAGEMENT OF AIR TRAFFIC CONTROLLER TRAINING ORGANISATIONS](https://avioverse.aero/regulations/easa/atco/part-atco-or-requirements-for-air-traffic/subpart-c)

Consolidated from the EASA Easy Access Rules (revision 14 Jun 2024, extracted 13 Oct 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.