EASA Part-IS - Information Security in Aviation IS.AR.215: IS.AR.215 Information security incidents: detection, response and recovery by the competent authority

Based on its assessment and treatment, the competent authority must implement detection measures that identify deviations from predetermined functional performance baselines and trigger warnings; response measures that initiate its own reaction with predefined resources and courses of action, contain the spread of an attack and control the failure mode of the affected elements; and recovery measures, including emergency measures, that remove or constrain the causing condition and restore a safe state of the affected elements within a recovery time it has defined.