---
title: "ORGH.MGM.201 Information security management system — Commission Delegated Regulation (EU) 2025/20, Ground Handling · Avioverse"
description: "The ground handling organisation shall establish, implement and maintain an information security management system in accordance with the Annex…"
url: "https://avioverse.aero/regulations/easa/ground-handling/commission-delegated-regulation-eu-2025-20/annexes/orgh-mgm-201"
---

# ORGH.MGM.201 Information security management system

Commission Delegated Regulation (EU) 2025/20 · Regulations (EU) 2025/23 and 2025/24 · EAR revision 5 Nov 2025

IR Implementing rule

## ORGH.MGM.201 Information security management system

The [ground handling organisation](https://avioverse.aero/glossary/easa/ground-handling-organisation) shall establish, implement and maintain an information security management system in accordance with the Annex (Part-IS.D.OR) to Commission Delegated Regulation (EU) 2022/1645 to ensure the proper management of information security risks which may have an impact on aviation safety.

\[point ORGH.MGM.201 applicable from 27 March 2031 — Regulation (EU) 2025/20]

IR · ORGH.MGM.201 — Regulations (EU) 2025/23 and 2025/24 · Regulation (EU) 2025/20 · Ground Handling Easy Access Rules · EAR revision 5 Nov 2025

[All rules in Annexes](https://avioverse.aero/regulations/easa/ground-handling/commission-delegated-regulation-eu-2025-20/annexes)

Consolidated from the EASA Easy Access Rules (revision 5 Nov 2025, extracted 13 Oct 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.