---
title: "GM3 IS.D.OR 215(a)&(b) Information security internal reporting scheme — Delegated Regulation (EU) 2022/1645, Part-IS · Avioverse"
description: "RELEVANT INFORMATION FOR INCIDENTS AND VULNERABILITIES Understanding the causes of, and contributing factors to, information security incidents and…"
url: "https://avioverse.aero/regulations/easa/part-is/delegated-regulation-eu-2022-1645/annex-information-security-organisation/gm3-is-d-or"
---

# GM3 IS.D.OR 215(a)&(b) Information security internal reporting scheme

Delegated Regulation (EU) 2022/1645 · Regulations (EU) 2023/203 and 2022/1645 · EAR revision 5 Dec 2025

GM Guidance material

## GM3 IS.D.OR 215(a)&(b) Information security internal reporting scheme

RELEVANT INFORMATION FOR INCIDENTS AND VULNERABILITIES

Understanding the causes of, and contributing factors to, [information security](https://avioverse.aero/glossary/easa/information-security) incidents and vulnerabilities relevant to Part-IS allows lessons learned to be gained and to introduce corrections to processes and asset design. However, understanding causes and contributing factors may not always be possible or may not aid in continuous improvement of aviation safety. Where vulnerabilities arise from assets developed solely or primarily for aviation, it is expected to be possible to perform the necessary investigation on the root causes. These root causes will inform the affected organisation(s) to improve processes and asset design to remediate [vulnerability](https://avioverse.aero/glossary/easa/vulnerability) and to ensure that such vulnerabilities are not introduced in other assets. Understanding the root causes of vulnerabilities also allows the aviation community to learn and thus avoid similar vulnerabilities in the future.

GM · GM3 IS.D.OR — Regulations (EU) 2023/203 and 2022/1645 · ED Decision 2023/009/R · Part-IS Easy Access Rules · EAR revision 5 Dec 2025

[All rules in ANNEX — INFORMATION SECURITY — ORGANISATION REQUIREMENTS \[PART-IS.D.OR\]](https://avioverse.aero/regulations/easa/part-is/delegated-regulation-eu-2022-1645/annex-information-security-organisation)

Consolidated from the EASA Easy Access Rules (revision 5 Dec 2025, extracted 13 Oct 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.