EASA Part-IS
Aviation information-security compliance under EASA Part-IS (Regulations (EU) 2022/1645 and 2023/203) for aerospace manufacturers, MROs, and suppliers — implemented on the same control set as your federal CUI program. One implementation, both regulators satisfied. Explore EASA Part-IS →
ISO/IEC 27001
Full ISMS implementation to ISO/IEC 27001:2022 — certification support, internal audits, and ongoing managed compliance. Controls map once against your NIST SP 800-171 implementation; dual or triple certification runs on shared evidence, not duplicated work. For many contractors, ISO 27001 is the commercial-market credential that rides free on the federal program they already had to build. Explore ISO/IEC 27001 → · ISO/IEC 27002 →
Export Control Program Implementation (ITAR/EAR)
ITAR (22 CFR Parts 120–130) and EAR (15 CFR Parts 730–774) program design: classification, technology control plans, training, and monitoring — enforced inside your CUI boundary. Controlled technical data protected by configuration, not a binder. Export-control requirements are also the most common trigger for GCC High, which is why we scope the two together. Explore Export Control →
Also on the same control set
AI governance (NIST AI RMF, ISO/IEC 42001), cyber supply chain risk management (NIST SP 800-161, CMMC flowdown), and GDPR programs reuse the same inventory, access control, incident response, and evidence discipline.
The economics: every framework added to a shared control set costs a mapping exercise and a delta — not a second program. That's only true if the first implementation was built with evidence discipline, which is what the Factory Model produces by default.
Questions contractors ask us
Do we really need separate programs for CMMC, ISO 27001, and Part-IS?
No — that's the point. The control substance overlaps heavily: access control, incident response, configuration management, and evidence discipline satisfy requirements in all three. We map controls once against your NIST SP 800-171 implementation and run dual or triple certification on shared evidence, not duplicated work.
What is EASA Part-IS and who does it apply to?
EASA Part-IS (Regulations (EU) 2022/1645 and 2023/203) is the European aviation information-security regime for manufacturers, MROs, and suppliers. If you sell into European aerospace, it's your 800-171-shaped obligation on that side of the Atlantic — and it can run on the same control set.
Can export-control (ITAR/EAR) requirements be enforced technically?
Largely, yes. Classification and technology control plans are policy work, but enforcement — who can access controlled technical data, from where, on what device — lives in the same Conditional Access, Purview, and segmentation architecture your CUI boundary already uses. Controlled data protected by configuration, not a binder.
Bring us the frameworks. Leave with one program.
Tell us which regimes your contracts carry — CMMC, Part-IS, ISO 27001, ITAR/EAR — and we'll map the shared control architecture. Or email rj@indirectit.com directly.