EASA Part-IS - Information Security in Aviation IS.I.OR.235: IS.I.OR.235 Contracting of information security management activities

When contracting any part of the ISMS activities to other organisations, the organisation must ensure the contracted activities comply with the Regulation and the contractor works under its oversight, must manage the risks associated with the contracted activities, and must ensure the competent authority can access the contractor on request to determine continued compliance.