EASA Part-IS - Information Security in Aviation IS.I.OR.200: IS.I.OR.200 Information security management system (ISMS)

The organisation must set up, implement and maintain an ISMS that establishes an information security policy on the potential impact of information security risks on aviation safety; identifies and reviews risks (205); defines and implements treatment measures (210); runs an internal reporting scheme (215); detects events, identifies incidents with a potential safety impact and responds to and recovers from them (220); implements measures the competent authority notifies as an immediate reaction to an incident or vulnerability; addresses authority findings (225); runs an external reporting scheme (230); applies the contracting requirements (235), the personnel requirements (240) and the record-keeping requirements (245); monitors its own compliance with feedback of findings to the accountable manager; and protects the confidentiality of information received from other organisations according to its sensitivity. It must run a continuous improvement process (260), document all key processes, procedures, roles and responsibilities with an amendment process (250) and manage changes to them (255); the ISMS must correspond to the nature and complexity of the activities on a risk assessment and may be integrated with existing management systems. An organisation may be approved by its competent authority not to implement points (a) to (d) and 205 to 260 (the confidentiality duty and Regulation (EU) No 376/2014 reporting still apply) if a documented risk assessment under 205, reviewed and approved by the authority, shows that its activities, facilities, resources and services pose no information security risk with a potential impact on aviation safety to itself or others; the approval is reviewed each oversight cycle and on any change of scope.