---
title: "IS.D.OR.225 Response to findings notified by the competent authority — Delegated Regulation (EU) 2022/1645, Part-IS · Avioverse"
description: "After receipt of the notification of findings submitted by the competent authority, the organisation shall:"
url: "https://avioverse.aero/regulations/easa/part-is/delegated-regulation-eu-2022-1645/annex-information-security-organisation/is-d-or-225"
---

# IS.D.OR.225 Response to findings notified by the competent authority

Delegated Regulation (EU) 2022/1645 · Regulations (EU) 2023/203 and 2022/1645 · EAR revision 5 Dec 2025

IR Implementing rule

## IS.D.OR.225 Response to findings notified by the competent authority

(a) After receipt of the notification of findings submitted by the competent authority, the organisation shall:

(1) identify the root cause or causes of, and contributing factors to, the non-compliance;

(2) define a corrective action plan;

(3) demonstrate the correction of the non-compliance to the satisfaction of the competent authority.

(b) The actions referred to in point (a) shall be carried out within the period agreed with the competent authority.

IR · IS.D.OR.225 — Regulations (EU) 2023/203 and 2022/1645 · Regulation (EU) 2022/1645 · Part-IS Easy Access Rules · EAR revision 5 Dec 2025

AMC Acceptable means of compliance

## AMC1 IS.D.OR.225 Response to findings notified by the competent authority

The compliance with IS.D.OR.225 should be managed as required for each organisation in the corresponding implementing regulation for the domain as identified in point Article 2(1) of Regulation (EU) 2022/1645 concerning the response to findings notified by the competent authority. The domain regulation may require the organisation to respond to the findings in accordance with their categorisation.

AMC · AMC1 IS.D.OR.225 — Regulations (EU) 2023/203 and 2022/1645 · ED Decision 2023/009/R · Part-IS Easy Access Rules · EAR revision 5 Dec 2025

GM Guidance material

## GM1 IS.D.OR.225 Response to findings notified by the competent authority

The requirement for the categorisation of findings and the period within which the actions in IS.D.OR.225(a) should be performed can be found in the corresponding implementing regulation for the domain, under the authority requirements. For the opening of findings related to this Regulation, the competent authority will follow the above-mentioned requirement.

GM · GM1 IS.D.OR.225 — Regulations (EU) 2023/203 and 2022/1645 · ED Decision 2023/009/R · Part-IS Easy Access Rules · EAR revision 5 Dec 2025

[All rules in ANNEX — INFORMATION SECURITY — ORGANISATION REQUIREMENTS \[PART-IS.D.OR\]](https://avioverse.aero/regulations/easa/part-is/delegated-regulation-eu-2022-1645/annex-information-security-organisation)

Consolidated from the EASA Easy Access Rules (revision 5 Dec 2025, extracted 13 Oct 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.