EASA Part-IS - Information Security in Aviation IS.AR.220: IS.AR.220 Contracting of information security management activities by the competent authority

When contracting any part of its ISMS activities to other organisations, the competent authority must ensure the contracted activities comply with the Regulation and the contractor works under its oversight, and must manage the risks associated with the contracted activities.