---
title: "21.A.239A Information security management system — Annex I, Initial Airworthiness · Avioverse"
description: "In addition to the design management system required by point 21.A.239, the design organisation shall establish, implement and maintain an information…"
url: "https://avioverse.aero/regulations/easa/initial-airworthiness/annex-i/section-a-technical-requirements/21-a-239a"
---

# 21.A.239A Information security management system

Annex I · Regulation (EU) No 748/2012 · EAR revision 27 Nov 2025

IR Implementing rule

## 21.A.239A Information security management system

In addition to the design management system required by point 21.A.239, the design organisation shall establish, implement and maintain an information security management system in accordance with Commission Delegated Regulation (EU) 2022/1645 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

IR · 21.A.239A — Regulation (EU) No 748/2012 · Regulation (EU) 2022/1645 · Initial Airworthiness Easy Access Rules · EAR revision 27 Nov 2025

[All rules in SECTION A — TECHNICAL REQUIREMENTS](https://avioverse.aero/regulations/easa/initial-airworthiness/annex-i/section-a-technical-requirements)

Consolidated from the EASA Easy Access Rules (revision 27 Nov 2025, extracted 13 Oct 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.