EASA Part-IS - Information Security in Aviation IS.I.OR.205: IS.I.OR.205 Information security risk assessment

The organisation must identify every element exposed to information security risk (its activities, facilities, resources and the services it operates, provides, receives or maintains, and the equipment, systems, data and information those depend on) and its interfaces with other organisations that could expose both to risk; for those elements and interfaces it identifies the risks with a potential impact on aviation safety, assigns each a level on its own predefined classification that weighs the potential of occurrence of the threat scenario and the severity of the safety consequences (informed by information from the interfacing organisations so assessments are comparable), links each risk to its element or interface, and decides, taking into account whether it has a structured and repeatable operational risk management process, whether the risk is acceptable or must be treated under 210. The assessment is reviewed and updated when the elements change, when interfaces or the risks communicated by other organisations change, when the information or knowledge used to identify, analyse and classify risks changes, and when incidents yield lessons. Organisations under Subpart C of Part-ATM/ANS.OR replace the aviation-safety impact analysis with the impact on their services under the safety support assessment of ATM/ANS.OR.C.005, made available to the air traffic service providers they serve, who evaluate the safety impact.