EASA Part-IS - Information Security in Aviation IS.AR.210: IS.AR.210 Information security risk treatment by the competent authority

The competent authority must develop measures for its unacceptable risks, implement them in a timely manner and check their continued effectiveness; the measures control the circumstances of the threat scenario, reduce the safety consequences or avoid the risk and must not introduce new unacceptable safety risks; the 225(a) person and affected personnel are informed of the assessment, scenarios and measures, and interfacing organisations of any shared risk.