EASA Part-IS - Information Security in Aviation IS.I.OR.215: IS.I.OR.215 Information security internal reporting scheme

The organisation must run an internal reporting scheme to collect and evaluate information security events, including those to be reported externally under 230; the scheme and the 220 process must let it identify which events are incidents or vulnerabilities with a potential impact on aviation safety, identify their causes and contributing factors and feed them into risk management under 205 and 220, evaluate all known relevant information about them, and distribute the information internally as necessary. Contracted organisations that may expose it to such risks must be required, through the contract, to report events to it for evaluation; the organisation cooperates in investigations with any organisation that contributes significantly to the security of its activities; the scheme may be integrated with existing reporting schemes.