---
title: "IS.AR.100 – IS.AR.235: ANNEX I — INFORMATION SECURITY — AUTHORITY REQUIREMENTS [PART-IS.AR] (Implementing Regulation (EU) 2023/203, Part-IS) — rule index · Avioverse"
description: "IS.AR.100 – IS.AR.235, Regulations (EU) 2023/203 and 2022/1645. This Part establishes the management requirements to be met by the competent authorities…"
url: "https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority"
---

# ANNEX I — INFORMATION SECURITY — AUTHORITY REQUIREMENTS \[PART-IS.AR]

Implementing Regulation (EU) 2023/203 · Information Security (Part-IS) · Regulations (EU) 2023/203 and 2022/1645 · IS.AR.100 – IS.AR.235

On this page

1. ## [IS.AR.100 Scope](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-100)

   This Part establishes the management requirements to be met by the competent authorities referred to in Article 2(2) of this Regulation.

2. ## [IS.AR.200 Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200)

   In order to achieve the objectives set out in Article 1, the competent authority shall set up, implement and maintain an information security management…

   [GM1 IS.AR.200 Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#gm1-is-ar-200)

   [AMC1 IS.AR.200(a)(1) Information security management system](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#amc1-is-ar-200-a-1)

   [GM1 IS.AR.200(a)(1) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#gm1-is-ar-200-a-1)

   [AMC1 IS.AR.200(a)(8) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#amc1-is-ar-200-a-8)

   [GM1 IS.AR.200(a)(8) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#gm1-is-ar-200-a-8)

   [AMC1 IS.AR.200(a)(9) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#amc1-is-ar-200-a-9)

   [AMC1 IS.AR.200(a)(11) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#amc1-is-ar-200-a-11)

   [AMC1 IS.AR.200(c) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#amc1-is-ar-200-c)

   [GM1 IS.AR.200(c) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#gm1-is-ar-200-c)

   [GM1 IS.AR.200(d) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-200#gm1-is-ar-200-d)

3. ## [IS.AR.205 Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205)

   The competent authority shall identify all the elements of its own organisation which could be exposed to information security risks.

   [GM1 IS.AR.205 Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#gm1-is-ar-205)

   [AMC1 IS.AR.205(a) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#amc1-is-ar-205-a)

   [GM1 IS.AR.205(a) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#gm1-is-ar-205-a)

   [AMC1 IS.AR.205(b) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#amc1-is-ar-205-b)

   [GM1 IS.AR.205(b) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#gm1-is-ar-205-b)

   [GM2 IS.AR.205(b) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#gm2-is-ar-205-b)

   [AMC1 IS.AR.205(c) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#amc1-is-ar-205-c)

   [GM1 IS.AR.205(c) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#gm1-is-ar-205-c)

   [AMC1 IS.AR.205(d) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#amc1-is-ar-205-d)

   [GM1 IS.AR.205(d) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#gm1-is-ar-205-d)

   [GM2 IS.AR.205(d) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-205#gm2-is-ar-205-d)

4. ## [IS.AR.210 Information security risk treatment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-210)

   The competent authority shall develop measures to address unacceptable risks identified in accordance with point IS.AR.205, shall implement them in a…

   [GM1 IS.AR.210 Information security risk treatment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-210#gm1-is-ar-210)

   [AMC1 IS.AR.210(a) Information security risk treatment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-210#amc1-is-ar-210-a)

5. ## [IS.AR.215 Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-215)

   Based on the outcome of the risk assessment carried out in accordance with point IS.AR.205 and the outcome of the risk treatment performed in accordance…

   [GM1 IS.AR.215 Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-215#gm1-is-ar-215)

   [AMC1 IS.AR.215(a) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-215#amc1-is-ar-215-a)

   [GM1 IS.AR.215(a) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-215#gm1-is-ar-215-a)

   [AMC1 IS.AR.215(b) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-215#amc1-is-ar-215-b)

   [GM1 IS.AR.215(b) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-215#gm1-is-ar-215-b)

   [AMC1 IS.AR.215(c) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-215#amc1-is-ar-215-c)

   [GM1 IS.AR.215(b) &(c) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-215#gm1-is-ar-215-b-2)

   [GM1 IS.AR.215(c) Information security incidents— detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-215#gm1-is-ar-215-c)

6. ## [IS.AR.220 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-220)

   The competent authority shall ensure that when contracting any part of the activities referred to in point IS.AR.200 to other organisations, the…

   [AMC1 IS.AR.220 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-220#amc1-is-ar-220)

   [GM1 IS.AR.220 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-220#gm1-is-ar-220)

   [GM2 IS.AR.220 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-220#gm2-is-ar-220)

   [GM3 IS.AR.220 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-220#gm3-is-ar-220)

   [GM4 IS.AR.220 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-220#gm4-is-ar-220)

   [GM5 IS.AR.220 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-220#gm5-is-ar-220)

7. ## [IS.AR.225 Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225)

   The competent authority shall: have a person who has the authority to establish and maintain the organisational structures, policies, processes, and…

   [GM1 IS.AR.225 Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#gm1-is-ar-225)

   [AMC1 IS.AR.225(a) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#amc1-is-ar-225-a)

   [GM1 IS.AR.225(a) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#gm1-is-ar-225-a)

   [AMC1 IS.AR.225(b) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#amc1-is-ar-225-b)

   [GM1 IS.AR.225(b) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#gm1-is-ar-225-b)

   [AMC1 IS.AR.225(c) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#amc1-is-ar-225-c)

   [GM1 IS.AR.225(c) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#gm1-is-ar-225-c)

   [AMC1 IS.AR.225(d) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#amc1-is-ar-225-d)

   [GM1 IS.AR.225(d) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#gm1-is-ar-225-d)

   [AMC1 IS.AR.225(e) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#amc1-is-ar-225-e)

   [GM1 IS.AR.225(e) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-225#gm1-is-ar-225-e)

8. ## [IS.AR.230 Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-230)

   The competent authority shall keep records of its information security management activities (1) The competent authority shall ensure that the following…

   [GM1 IS.AR.230 Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-230#gm1-is-ar-230)

   [AMC1 IS.AR.230(a)(1)(iv) &(a)(4) Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-230#amc1-is-ar-230-a-1-iv)

   [GM1 IS.AR.230(a)(1)(iv) &(a)(4) Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-230#gm1-is-ar-230-a-1-iv)

   [AMC1 IS.AR.230(c) &(d) Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-230#amc1-is-ar-230-c)

   [GM1 IS.AR.230(c) &(d) Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-230#gm1-is-ar-230-c)

9. ## [IS.AR.235 Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-235)

   The competent authority shall assess, using adequate performance indicators, the effectiveness and maturity of its own ISMS.

   [AMC1 IS.AR.235 Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-235#amc1-is-ar-235)

   [GM1 IS.AR.235 Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-235#gm1-is-ar-235)

   [AMC1 IS.AR.235(a) Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-235#amc1-is-ar-235-a)

   [GM1 IS.AR.235(a) Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-235#gm1-is-ar-235-a)

   [AMC1 IS.AR.235(b) Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-235#amc1-is-ar-235-b)

   [GM1 IS.AR.235(b) Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/is-ar-235#gm1-is-ar-235-b)

10. ## [Appendix I Examples of threat scenarios with a potential harmful impact on safety](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/appendix-i)

    The following is a non-exhaustive list of examples of information security threat scenarios with a potential harmful impact on safety that may be…

11. ## [Appendix II Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and the NIST CSF 2.0](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/appendix-ii)

    Part-IS main task Activity type Reference Management, Operational Part-IS EU e-CF NIST CSF 2.0 Competence areas \&

12. ## [Appendix III Examples of aviation services and interfaces](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/appendix-iii)

    AVIATION SERVICES The following is a non-exhaustive and non-complete list of aviation services that can be used as a basis to identify the scope of risk…

13. ## [Appendix IV Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-i-information-security-authority/appendix-iv)

    Although Part-IS does not credit ISO/IEC 27001 certification, the practices and methods typically adopted for implementing and maintaining an ISMS under…

Consolidated from the EASA Easy Access Rules (revision 5 Dec 2025, extracted 2 Nov 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.

Share [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Favioverse.aero%2Fregulations%2Feasa%2Fpart-is%2Fimplementing-regulation-eu-2023-203%2Fannex-i-information-security-authority)[X](https://twitter.com/intent/tweet?url=https%3A%2F%2Favioverse.aero%2Fregulations%2Feasa%2Fpart-is%2Fimplementing-regulation-eu-2023-203%2Fannex-i-information-security-authority\&text=ANNEX%20I%20%E2%80%94%20INFORMATION%20SECURITY%20%E2%80%94%20AUTHORITY%20REQUIREMENTS%20%5BPART-IS.AR%5D%20%E2%80%94%20Part-IS)