--- title: "IS.I.OR.100 – IS.I.OR.260: ANNEX II — INFORMATION SECURITY — ORGANISATION REQUIREMENTS [PART-IS.I.OR] (Implementing Regulation (EU) 2023/203, Part-IS) — rule index · Avioverse" description: "IS.I.OR.100 – IS.I.OR.260, Regulations (EU) 2023/203 and 2022/1645. This Part establishes the requirements to be met by the organisations referred to in…" url: "https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation" --- # ANNEX II — INFORMATION SECURITY — ORGANISATION REQUIREMENTS \[PART-IS.I.OR] Implementing Regulation (EU) 2023/203 · Information Security (Part-IS) · Regulations (EU) 2023/203 and 2022/1645 · IS.I.OR.100 – IS.I.OR.260 On this page 1. ## [IS.I.OR.100 Scope](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-100) This Part establishes the requirements to be met by the organisations referred to in Article 2(1) of this Regulation. 2. ## [IS.I.OR.200 Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200) In order to achieve the objectives set out in Article 1, the organisation shall set up, implement and maintain an information security management system… [GM1 IS.I.OR.200 Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#gm1-is-i-or-200) [AMC1 IS.I.OR.200(a)(1) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#amc1-is-i-or-200-a-1) [GM1 IS.I.OR.200(a)(1) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#gm1-is-i-or-200-a-1) [AMC1 IS.I.OR.200(a)(12) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#amc1-is-i-or-200-a-12) [GM1 IS.I.OR.200(a)(12) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#gm1-is-i-or-200-a-12) [AMC1 IS.I.OR.200(a)(13) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#amc1-is-i-or-200-a-13) [AMC1 IS.I.OR.200(c) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#amc1-is-i-or-200-c) [GM1 IS.I.OR.200(c) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#gm1-is-i-or-200-c) [GM1 IS.I.OR.200(d) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#gm1-is-i-or-200-d) [AMC1 IS.I.OR.200(e) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#amc1-is-i-or-200-e) [GM1 IS.I.OR.200(e) Information security management system (ISMS)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-200#gm1-is-i-or-200-e) 3. ## [IS.I.OR.205 Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205) The organisation shall identify all its elements which could be exposed to information security risks. [GM1 IS.I.OR.205 Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#gm1-is-i-or-205) [AMC1 IS.I.OR.205(a) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#amc1-is-i-or-205-a) [GM1 IS.I.OR.205(a) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#gm1-is-i-or-205-a) [AMC1 IS.I.OR.205(b) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#amc1-is-i-or-205-b) [GM1 IS.I.OR.205(b) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#gm1-is-i-or-205-b) [GM2 IS.I.OR.205(b) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#gm2-is-i-or-205-b) [AMC1 IS.I.OR.205(c) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#amc1-is-i-or-205-c) [GM1 IS.I.OR.205(c) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#gm1-is-i-or-205-c) [AMC1 IS.I.OR.205(d) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#amc1-is-i-or-205-d) [GM1 IS.I.OR.205(d) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#gm1-is-i-or-205-d) [GM2 IS.I.OR.205(d) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#gm2-is-i-or-205-d) [AMC1 IS.I.OR.205(e) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#amc1-is-i-or-205-e) [GM1 IS.I.OR.205(e) Information security risk assessment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-205#gm1-is-i-or-205-e) 4. ## [IS.I.OR.210 Information security risk treatment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-210) The organisation shall develop measures to address unacceptable risks identified in accordance with point IS.I.OR.205, implement them in a timely manner… [GM1 IS.I.OR.210 Information security risk treatment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-210#gm1-is-i-or-210) [AMC1 IS.I.OR.210(a) Information security risk treatment](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-210#amc1-is-i-or-210-a) 5. ## [IS.I.OR.215 Information security internal reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-215) The organisation shall establish an internal reporting scheme to enable the collection and evaluation of information security events, including those to… [AMC1 IS.I.OR.215(a) &(b) Information security internal reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-215#amc1-is-i-or-215-a) [GM1 IS.I.OR.215(a) &(b) Information security internal reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-215#gm1-is-i-or-215-a) [GM2 IS.I.OR.215(a) &(b) Information security internal reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-215#gm2-is-i-or-215-a) [GM3 IS.I.OR.215(a) &(b) Information security internal reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-215#gm3-is-i-or-215-a) [GM1 IS.I.OR.215(c) Information security internal reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-215#gm1-is-i-or-215-c) [GM1 IS.I.OR.215(d) Information security internal reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-215#gm1-is-i-or-215-d) 6. ## [IS.I.OR.220 Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-220) Based on the outcome of the risk assessment carried out in accordance with point IS.I.OR.205 and the outcome of the risk treatment performed in… [GM1 IS.I.OR.220 Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-220#gm1-is-i-or-220) [AMC1 IS.I.OR.220(a) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-220#amc1-is-i-or-220-a) [GM1 IS.I.OR.220(a) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-220#gm1-is-i-or-220-a) [AMC1 IS.I.OR.220(b) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-220#amc1-is-i-or-220-b) [GM1 IS.I.OR.220(b) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-220#gm1-is-i-or-220-b) [AMC1 IS.I.OR.220(c) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-220#amc1-is-i-or-220-c) [GM1 IS.I.OR.220(b) &(c) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-220#gm1-is-i-or-220-b-2) [GM1 IS.I.OR.220(c) Information security incidents — detection, response and recovery](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-220#gm1-is-i-or-220-c) 7. ## [IS.I.OR.225 Response to findings notified by the competent authority](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-225) After receipt of the notification of findings submitted by the competent authority, the organisation shall: [AMC1 IS.I.OR.225 Response to findings notified by the competent authority](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-225#amc1-is-i-or-225) [GM1 IS.I.OR.225 Response to findings notified by the competent authority](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-225#gm1-is-i-or-225) 8. ## [IS.I.OR.230 Information security external reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-230) The organisation shall implement an information security reporting system that complies with the requirements laid down in Regulation (EU) No 376/2014… [GM1 IS.I.OR.230 Information security external reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-230#gm1-is-i-or-230) [AMC1 IS.I.OR.230(a) &(b) Information security external reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-230#amc1-is-i-or-230-a) [GM1 IS.I.OR.230(a) &(b) Information security external reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-230#gm1-is-i-or-230-a) [AMC1 IS.I.OR.230(c) Information security external reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-230#amc1-is-i-or-230-c) [GM1 IS.I.OR.230(c) Information security external reporting scheme](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-230#gm1-is-i-or-230-c) 9. ## [IS.I.OR.235 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235) The organisation shall ensure that when contracting any part of the activities referred to in point IS.I.OR.200 to other organisations, the contracted… [GM1 IS.I.OR.235 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235#gm1-is-i-or-235) [GM2 IS.I.OR.235 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235#gm2-is-i-or-235) [GM3 IS.I.OR.235 Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235#gm3-is-i-or-235) [AMC1 IS.I.OR.235(a) Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235#amc1-is-i-or-235-a) [GM1 IS.I.OR.235(a) Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235#gm1-is-i-or-235-a) [GM2 IS.I.OR.235(a) Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235#gm2-is-i-or-235-a) [AMC1 IS.I.OR.235(b) Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235#amc1-is-i-or-235-b) [GM1 IS.I.OR.235(b) Contracting of information security management activities](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-235#gm1-is-i-or-235-b) 10. ## [IS.I.OR.240 Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240) The accountable manager of the organisation designated in accordance with Regulations (EU) No 1321/2014, (EU) No 965/2012, (EU) No 1178/2011, (EU)… [GM1 IS.I.OR.240 Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240) [AMC1 IS.I.OR.240(a)(2) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#amc1-is-i-or-240-a-2) [AMC1 IS.I.OR.240(a)(3) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#amc1-is-i-or-240-a-3) [GM1 IS.I.OR.240(a)(3) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240-a-3) [AMC1 IS.I.OR.240(b) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#amc1-is-i-or-240-b) [GM1 IS.I.OR.240(b) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240-b) [GM1 IS.I.OR.240(b) &(c) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240-b-2) [GM1 IS.I.OR.240(c) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240-c) [AMC1 IS.I.OR.240(d) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#amc1-is-i-or-240-d) [GM1 IS.I.OR.240(e) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240-e) [AMC1 IS.I.OR.240(f) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#amc1-is-i-or-240-f) [GM1 IS.I.OR.240(f) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240-f) [AMC1 IS.I.OR.240(g) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#amc1-is-i-or-240-g) [GM1 IS.I.OR.240(g) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240-g) [AMC1 IS.I.OR.240(h) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#amc1-is-i-or-240-h) [GM1 IS.I.OR.240(h) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240-h) [AMC1 IS.I.OR.240(i) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#amc1-is-i-or-240-i) [GM1 IS.I.OR.240(i) Personnel requirements](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-240#gm1-is-i-or-240-i) 11. ## [IS.I.OR.245 Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-245) The organisation shall keep records of its information security management activities (1) The organisation shall ensure that the following records are… [GM1 IS.I.OR.245 Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-245#gm1-is-i-or-245) [AMC1 IS.I.OR.245(a)(1)(vi) &(a)(5) Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-245#amc1-is-i-or-245-a-1-vi) [GM1 IS.I.OR.245(a)(1)(vi) &(a)(5) Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-245#gm1-is-i-or-245-a-1-vi) [AMC1 IS.I.OR.245(c) &(d) Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-245#amc1-is-i-or-245-c) [GM1 IS.I.OR.245(c) &(d) Record-keeping](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-245#gm1-is-i-or-245-c) 12. ## [IS.I.OR.250 Information security management manual (ISMM)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-250) The organisation shall make available to the competent authority an information security management manual (ISMM) and, where applicable, any referenced… [GM1 IS.I.OR.250(a) Information security management manual (ISMM)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-250#gm1-is-i-or-250-a) 13. ## [IS.I.OR.255 Changes to the information security management system](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-255) Changes to the ISMS may be managed and notified to the competent authority in a procedure developed by the organisation. [AMC1 IS.I.OR.255 Changes to the information security management system](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-255#amc1-is-i-or-255) [GM1 IS.I.OR.255 Changes to the information security management system](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-255#gm1-is-i-or-255) [GM2 IS.I.OR.255 Changes to the information security management system](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-255#gm2-is-i-or-255) 14. ## [IS.I.OR.260 Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-260) The organisation shall assess, using adequate performance indicators, the effectiveness and maturity of the ISMS. [AMC1 IS.I.OR.260 Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-260#amc1-is-i-or-260) [GM1 IS.I.OR.260 Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-260#gm1-is-i-or-260) [AMC1 IS.I.OR.260(a) Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-260#amc1-is-i-or-260-a) [GM1 IS.I.OR.260(a) Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-260#gm1-is-i-or-260-a) [AMC1 IS.I.OR.260(b) Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-260#amc1-is-i-or-260-b) [GM1 IS.I.OR.260(b) Continuous improvement](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/is-i-or-260#gm1-is-i-or-260-b) 15. ## [Appendix I Examples of threat scenarios with a potential harmful impact on safety](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/appendix-i) The following is a non-exhaustive list of examples of information security threat scenarios with a potential harmful impact on safety that may be… 16. ## [Appendix II Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and NIST CSF 2.0](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/appendix-ii) Part-IS main task Activity type Reference Management, Operational Part-IS EU e-CF NIST CSF 2.0 Competence areas \& 17. ## [Appendix III Examples of aviation services and interfaces](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/appendix-iii) AVIATION SERVICES The following is a non-exhaustive and non-complete list of aviation services that can be used as a basis to identify the scope of the… 18. ## [Appendix IV Part-IS requirements mapping to ISO/IEC 27001:2022 clauses and controls, and considerations on differences](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/appendix-iv) Although Part-IS does not credit ISO/IEC 27001 certification, the practices and methods typically adopted for implementing and maintaining an ISMS under… 19. ## [Appendix V Proportionality considerations related to indicators of complexity](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/appendix-v) The following is a non-exhaustive, non-binding, list of activities related to the implementation of the ISMS under this Regulation. 20. ## [Appendix VI Adaptation of the EU Cybersecurity Skills Framework (ECSF)](https://avioverse.aero/regulations/easa/part-is/implementing-regulation-eu-2023-203/annex-ii-information-security-organisation/appendix-vi) \[Figure or form omitted from this preview — available in the Avioverse workspace library.] Consolidated from the EASA Easy Access Rules (revision 5 Dec 2025, extracted 13 Oct 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use. Share [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Favioverse.aero%2Fregulations%2Feasa%2Fpart-is%2Fimplementing-regulation-eu-2023-203%2Fannex-ii-information-security-organisation)[X](https://twitter.com/intent/tweet?url=https%3A%2F%2Favioverse.aero%2Fregulations%2Feasa%2Fpart-is%2Fimplementing-regulation-eu-2023-203%2Fannex-ii-information-security-organisation\&text=ANNEX%20II%20%E2%80%94%20INFORMATION%20SECURITY%20%E2%80%94%20ORGANISATION%20REQUIREMENTS%20%5BPART-IS.I.OR%5D%20%E2%80%94%20Part-IS)