EASA Part-IS
EASA Part-IS (Regulations (EU) 2022/1645 and 2023/203) sets the aviation information-security requirements. We implement them for aerospace manufacturers, MROs, and suppliers on the same control set as your federal CUI program, so one implementation answers to both regulators. Explore EASA Part-IS →
ISO/IEC 27001
A full ISMS implementation to ISO/IEC 27001:2022 includes certification support, internal audits, and ongoing managed compliance. Controls map once against your NIST SP 800-171 implementation, and dual or triple certification runs on the same evidence. For many contractors, ISO 27001 is the commercial-market credential that rides free on the federal program they already had to build. Explore ISO/IEC 27001 → · ISO/IEC 27002 →
Export control program implementation (ITAR/EAR)
We design ITAR (22 CFR Parts 120 through 130) and EAR (15 CFR Parts 730 through 774) programs covering classification, technology control plans, training, and monitoring, and we enforce them inside your CUI boundary, where access to controlled technical data is set in configuration. Export-control requirements are also the most common trigger for GCC High, which is why we scope the two together. Explore Export Control →
Also on the same control set
AI governance (NIST AI RMF, ISO/IEC 42001), cyber supply chain risk management (NIST SP 800-161, CMMC flowdown), and GDPR programs reuse the same inventory, access control, incident response, and evidence discipline.
The economics: each framework you add to a shared control set costs a mapping exercise and a delta, and you don't build a second program. That only holds if the first implementation was built with evidence discipline, and the Factory Model builds it that way by default.
Questions contractors ask us
Do we really need separate programs for CMMC, ISO 27001, and Part-IS?
No. The control substance overlaps heavily: access control, incident response, configuration management, and evidence discipline satisfy requirements in all three. We map controls once against your NIST SP 800-171 implementation and run dual or triple certification on shared evidence, so nothing is done twice.
What is EASA Part-IS and who does it apply to?
EASA Part-IS (Regulations (EU) 2022/1645 and 2023/203) is the European aviation information-security regime for EASA-approved organizations such as manufacturers and MROs, and it reaches suppliers through contract terms when they do information security work for those organizations. If you sell into European aerospace, it is the 800-171-shaped obligation on that side of the Atlantic, and it can run on the same control set.
Can export-control (ITAR/EAR) requirements be enforced technically?
Largely, yes. Classification and technology control plans are policy work, but enforcement (who can access controlled technical data, from where, and on what device) lives in the same Conditional Access, Purview, and segmentation architecture your CUI boundary already uses.
Bring us your frameworks and leave with one program.
Tell us which regimes your contracts carry (CMMC, Part-IS, ISO 27001, ITAR/EAR) and we'll map the shared control architecture. Or email rj@indirectit.com directly.