Who this is for
Organisations holding EASA approvals, such as design and production organisations, maintenance organisations, continuing airworthiness management organisations, training organisations, and operators, and the suppliers those organisations contract information security activities to. A U.S. company is in scope when it holds an EASA approval, and Part-IS reaches it through contract terms when it performs information security work for an approved organisation. For organisations approved through bilateral arrangements, applicability should be confirmed with the competent authority, and we start every engagement with that analysis.
What we deliver
Applicability & scope
Which regulation applies to which approval, what is in scope, and whether a documented case for derogation is realistic, written for discussion with your competent authority.
ISMS design
An information security management system that runs inside your existing management system and safety management system.
Aviation-safety risk assessment
Identification of the elements whose compromise could affect aviation safety, and a risk assessment and treatment plan that measures each risk by its effect on aviation safety.
Incident detection & reporting
Internal reporting, detection, response, and recovery, plus the external reporting path to the competent authority, aligned with your existing incident process.
Contracted activities
Controls and agreements for information security activities that contractors and suppliers perform. Part-IS keeps the approved organisation accountable for that work.
ISMS manual & improvement
The ISMS manual (or its integration into your exposition), record-keeping, and a continuous improvement cycle with internal audit.
What carries over from your CMMC and ISO programs
| Part-IS area | Reusable from CMMC / NIST SP 800-171 | Part-IS delta |
|---|---|---|
| Information security management system | Policies, SSP, roles | Aviation-safety focus, integration with SMS |
| Risk assessment and treatment | Risk assessment (3.11.x) | Impact measured against aviation safety |
| Incident detection and response | Incident response (3.6.x), DFARS 7012 reporting | Reporting to the competent authority |
| Personnel | Awareness and training (3.2.x), personnel security | Competence for Part-IS roles |
| Contracted activities | Supplier flowdown | Accountability for contracted IS activities |
| Record-keeping | Audit logs and evidence retention | Part-IS record requirements |
What you already have: if you hold ISO/IEC 27001 certification or run a CMMC Level 2 program, most of the Part-IS management system already exists. What remains is the aviation-safety lens, the reporting path to the competent authority, and the documentation that ties it together. See ISO/IEC 27001.
How an engagement runs
- Scope (2 weeks): applicability by approval, ISMS scope, and a gap view against your existing programs.
- Assess (3 to 4 weeks): aviation-safety risk assessment and treatment plan with your safety and engineering leads.
- Build (4 to 8 weeks): ISMS documentation, incident and reporting procedures, contracted-activity controls.
- Operate: internal audits, management review, and authority-facing evidence as part of Managed Compliance.
Questions contractors ask us
What is EASA Part-IS?
Part-IS is the European Union's aviation information security requirement, set out in Commission Delegated Regulation (EU) 2022/1645 and Commission Implementing Regulation (EU) 2023/203. It requires in-scope organisations and authorities to identify and manage information security risks that could affect aviation safety, through an information security management system.
Does Part-IS apply to U.S. companies?
It can. Organisations holding EASA approvals are in scope under the regulation that covers their approval type. How the requirements apply to organisations approved through bilateral agreements depends on those arrangements, so we confirm applicability with you and your competent authority before scoping.
How is Part-IS different from ISO/IEC 27001?
ISO/IEC 27001 covers information security in general. Part-IS focuses on information security risks with a potential impact on aviation safety and adds reporting to the competent authority. Most of an ISO/IEC 27001 ISMS carries over; the new work is the aviation-safety lens and the reporting path to the authority.
Can we be exempted?
Part-IS allows a derogation where an organisation demonstrates that its activities, facilities, and resources pose no information security risk with a potential impact on aviation safety. The competent authority has to approve the derogation, and it bases that approval on a documented information security risk assessment.
Find out what Part-IS asks of your approvals.
Tell us which EASA approvals you hold or support, and which programs you already run, and we'll scope the applicability analysis. Or email rj@indirectit.com directly.