EASA Part-IS - Information Security in Aviation IS.I.OR.240: IS.I.OR.240 Personnel requirements

The accountable manager designated under the domain regulation must have corporate authority to finance and carry out all Part-IS activities, ensure the resources, establish and promote the information security policy and show a basic understanding of the Regulation; must appoint a person or group, reporting directly to the accountable manager with defined authority and appropriate knowledge, background and experience, to ensure compliance, with deputies determined for lengthy absence; and must appoint a person or group to manage the compliance monitoring function. Where structures, policies, processes and procedures are shared with other organisations or with parts of the same organisation outside the approval or declaration, the accountable manager may delegate to a common responsible person with coordination measures; the accountable manager or common responsible person has corporate authority to establish the structures needed to implement 200. The organisation must have processes ensuring sufficient personnel on duty, their competence, their acknowledgement of assigned responsibilities, and the appropriate establishment of the identity and trustworthiness of personnel with access to systems and data in scope.