Who this is for
Organisations holding EASA approvals, such as design and production organisations, maintenance organisations, continuing airworthiness management organisations, training organisations, and operators, and the suppliers those organisations contract information security activities to. U.S. companies are in scope where they hold EASA approvals or support organisations that do; applicability for organisations approved through bilateral arrangements should be confirmed with the competent authority, and we start every engagement with that analysis.
What we deliver
Applicability & scope
Which regulation applies to which approval, what is in scope, and whether a documented case for derogation is realistic, written for discussion with your competent authority.
ISMS design
An information security management system integrated with your existing management system and safety management system, not a parallel bureaucracy.
Aviation-safety risk assessment
Identification of the elements whose compromise could affect aviation safety, and a risk assessment and treatment plan focused on that impact rather than on data alone.
Incident detection & reporting
Internal reporting, detection, response, and recovery, plus the external reporting path to the competent authority, aligned with your existing incident process.
Contracted activities
Controls and agreements for information security activities performed by contractors and suppliers, which Part-IS keeps the approved organisation accountable for.
ISMS manual & improvement
The ISMS manual (or its integration into your exposition), record-keeping, and a continuous improvement cycle with internal audit.
What carries over from your CMMC and ISO programs
| Part-IS area | Reusable from CMMC / NIST SP 800-171 | Part-IS delta |
|---|---|---|
| Information security management system | Policies, SSP, roles | Aviation-safety focus, integration with SMS |
| Risk assessment and treatment | Risk assessment (3.11.x) | Impact measured against aviation safety |
| Incident detection and response | Incident response (3.6.x), DFARS 7012 reporting | Reporting to the competent authority |
| Personnel | Awareness and training (3.2.x), personnel security | Competence for Part-IS roles |
| Contracted activities | Supplier flowdown | Accountability for contracted IS activities |
| Record-keeping | Audit logs and evidence retention | Part-IS record requirements |
The efficient path: if you already hold ISO/IEC 27001 certification or a CMMC Level 2 program, most of the Part-IS management system exists. The work is the aviation-safety lens, the authority reporting path, and the documentation that ties it together. See ISO/IEC 27001.
How an engagement runs
- Scope (2 weeks): applicability by approval, ISMS scope, and a gap view against your existing programs.
- Assess (3–4 weeks): aviation-safety risk assessment and treatment plan with your safety and engineering leads.
- Build (4–8 weeks): ISMS documentation, incident and reporting procedures, contracted-activity controls.
- Operate: internal audits, management review, and authority-facing evidence as part of Managed Compliance.
Questions contractors ask us
What is EASA Part-IS?
Part-IS is the European Union's aviation information security requirement, set out in Commission Delegated Regulation (EU) 2022/1645 and Commission Implementing Regulation (EU) 2023/203. It requires in-scope organisations and authorities to identify and manage information security risks that could affect aviation safety, through an information security management system.
Does Part-IS apply to U.S. companies?
It can. Organisations holding EASA approvals are in scope under the regulation that covers their approval type. How the requirements apply to organisations approved through bilateral agreements depends on those arrangements, so we confirm applicability with you and your competent authority before scoping.
How is Part-IS different from ISO/IEC 27001?
ISO/IEC 27001 protects information generally. Part-IS focuses on information security risks with a potential impact on aviation safety and adds reporting to the competent authority. An ISO/IEC 27001 ISMS is a strong foundation, and most of it carries over; the work is the aviation-safety lens and the authority reporting path.
Can we be exempted?
Part-IS allows a derogation where an organisation demonstrates that its activities, facilities, and resources pose no information security risk with a potential impact on aviation safety. That demonstration still needs a documented risk assessment approved by the competent authority.
Find out what Part-IS asks of your approvals.
Tell us which EASA approvals you hold or support, and which programs you already run, and we'll scope the applicability analysis. Or email rj@indirectit.com directly.