EASA Part-IS - Information Security in Aviation IS.AR.205: IS.AR.205 Information security risk assessment by the competent authority

The competent authority must identify all elements of its own organisation exposed to information security risk (activities, facilities, resources, the services it operates, provides, receives or maintains, and the supporting equipment, systems, data and information) and its interfaces with other organisations; identify the risks with a potential impact on aviation safety, assign each a level on its own classification weighing occurrence potential and safety severity (informed by interfacing organisations for comparability), link each risk to its element or interface, and decide whether it is acceptable or must be treated under 210; and review and update the assessment on changes to elements, interfaces or communicated risks, changes in the information or knowledge used, and lessons from incidents.