---
title: "21.A.139A Information security management system — Annex I, Initial Airworthiness · Avioverse"
description: "In addition to the production management system required by point 21.A.139, the production organisation shall establish, implement and maintain an…"
url: "https://avioverse.aero/regulations/easa/initial-airworthiness/annex-i/section-a-technical-requirements/21-a-139a"
---

# 21.A.139A Information security management system

Annex I · Regulation (EU) No 748/2012 · EAR revision 27 Nov 2025

IR Implementing rule

## 21.A.139A Information security management system

In addition to the production management system required by point 21.A.139, the production organisation shall establish, implement and maintain an information security management system in accordance with Commission Delegated Regulation (EU) 2022/1645 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

IR · 21.A.139A — Regulation (EU) No 748/2012 · Regulation (EU) 2022/1645 · Initial Airworthiness Easy Access Rules · EAR revision 27 Nov 2025

[All rules in SECTION A — TECHNICAL REQUIREMENTS](https://avioverse.aero/regulations/easa/initial-airworthiness/annex-i/section-a-technical-requirements)

Consolidated from the EASA Easy Access Rules (revision 27 Nov 2025, extracted 13 Oct 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.