EUROPEAN

COMMISSION

Brussels, XXX
[…](2021) XXX draft

ANNEX II TO EASA OPINION 03 - 2021

COMMISSION IMPLEMENTING REGULATION (EU) …/...

of XXX

introducing requirements for the management of information security risks

with a potential impact on aviation safety for organisations covered by
Commission Regulations (EU) No 1321/2014, No 965/2012, No 1178/2011,
2015/340, 2017/373 and 2021/664, and for competent authorities covered by
Commission Regulations (EU) No 748/2012, No 1321/2014, No 965/2012, No
1178/2011, 2015/340, 2017/373, No 139/2014 and 2021/664

EN EN
 COMMISSION IMPLEMENTING REGULATION (EU) …/...

of XXX

introducing requirements for the management of information security risks with a

potential impact on aviation safety for organisations covered by Commission
Regulations (EU) No 1321/2014, No 965/2012, No 1178/2011, 2015/340, 2017/373 and
2021/664, and for competent authorities covered by Commission Regulations (EU) No
748/2012, No 1321/2014, No 965/2012, No 1178/2011, 2015/340, 2017/373, No 139/2014
and 2021/664

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2018/1139 of the European Parliament and of the Council of
4 July 2018 on common rules in the field of civil aviation and establishing a European Union
Aviation Safety Agency, and amending Regulations (EC) No 2111/2005, (EC) No 1008/2008,
(EU) No 996/2010, (EU) No 376/2014 and Directives 2014/30/EU and 2014/53/EU of the
European Parliament and of the Council, and repealing Regulations (EC) No 552/2004 and
(EC) No 216/2008 of the European Parliament and of the Council and Council Regulation
(EEC) No 3922/91 (1), and in particular Articles 17(1), 27(1), 31(1), 43(1), 53(1) and 62(15)(c)
thereof,
Whereas:
(1) In accordance with the essential requirements set out in Annex II to Regulation (EU)
2018/1139, continuing airworthiness management organisations and maintenance
organisations shall implement and maintain a management system to manage safety risks.
(2) In addition, in accordance with the essential requirements set out in Annex IV to
Regulation (EU) 2018/1139, pilot training organisations, cabin crew training
organisations, aero-medical centres for aircrew and operators of flight simulation training
devices shall implement and maintain a management system to manage safety risks.
(3) Furthermore, in accordance with the essential requirements set out in Annex V to
Regulation (EU) 2018/1139, aircraft operators shall implement and maintain a
management system to manage safety risks.
(4) Furthermore, in accordance with the essential requirements set out in Annex VIII to
Regulation (EU) 2018/1139, air traffic management and air navigation service providers,
U-space service providers and single common information service providers, and training
organisations and aero-medical centres for air traffic controllers shall implement and
maintain a management system to manage safety risks.
(5) Finally, in accordance Article 62(15)(c) of Regulation (EU) 2018/1139, the Commission
shall adopt implementing acts laying down the provisions concerning the rules and
procedures for the administration and management systems of the Agency and national
competent authorities relating to the exercise of the certification, oversight and
enforcement tasks.

( 1) OJ L 212, 22.8.2018, p. 1.

EN 1 EN
 (6) The management systems implemented by the Agency, national competent authorities
and organisations to manage safety risks need to take into account not only those risks
stemming for random events, but also those where existing flaws may be exploited by
individuals with a malicious intent.
(7) This type of risk is constantly increasing in the civil aviation environment as the current
information systems are becoming more and more interconnected, and increasingly
becoming the target of malicious actors.
(8) The risks associated with these information systems are not limited to possible attacks to
the cyberspace, but encompass threats which are both digital and analogue.
(9) A significant number of organisations already use international standards, such as ISO
27001, which deal with the management of information security risks.
(10) As a consequence, it is appropriate to introduce requirements for the management of
information security risks, without limiting them to cybersecurity risks.
(11) It is essential that these requirements cover all aviation domains and their interfaces since
aviation is a highly interconnected system of systems. As a consequence, they shall apply
to all the organisations and competent authorities that are already required to have a
management system in accordance with the existing aviation safety regulations.
(12) The measures provided for in this Regulation need to contribute to the creation of a
seamless and consistent regulatory framework where the interfaces between security and
safety are appropriately covered, and where special attention is paid at avoiding gaps,
loopholes and duplications with other information security and cybersecurity
requirements such as those contained in Commission Implementing Regulation (EU)
2015/1998 (2) and in the national requirements stemming from Directive (EU) 2016/1148
(NIS Directive) (3).
(13) The measures related to information security and cybersecurity stemming from the NIS
Directive, Commission Implementing Regulation (EU) 2015/1998 and this Regulation
should be coordinated at national levels to avoid gaps and duplications of obligations.
(14) It is therefore appropriate that, where organisations covered by this Regulation are subject
to cybersecurity or information security requirements arising from other EU or national
legislation, the competent authority defined according to this Regulation should have the
possibility to replace compliance with the requirements of this Regulation by compliance
with elements contained in other EU or national legislation, provided that such
requirements are at least equivalent in effect to the obligations laid down in this
Regulation. In such a case, the competent authority shall coordinate with any other
relevant authorities to ensure coordinated or compatible oversight regimes.
(15) In addition, in the particular case of airport operators, air carriers and entities as defined
in the national civil aviation security programmes of Member States, it is appropriate that
the competent authority responsible for the certification and oversight of the
organisation’s compliance with this Regulation should have the possibility to replace
compliance with the requirements contained in this Regulation, except those related to

( 2) Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed
measures for the implementation of the common basic standards on aviation security (OJ L 299, 14.11.2015,
p. 1).
( 3) Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning
measures for a high common level of security of network and information systems across the Union (OJ L
194, 19.7.2016, p. 1).

EN 2 EN
 the information security external reporting schemes, by compliance with elements of the
cybersecurity requirements contained in the Annex to Commission Implementing
Regulation (EU) 2015/1998. In such a case, the competent authority shall coordinate with
any other relevant authorities to ensure coordinated or compatible oversight regimes.
(16) Furthermore, it is also appropriate that even if the competent authority decides not to use
the options described in the previous two recitals, the affected organisations should still
have the possibility to use compliance methods developed under the cybersecurity or
information security requirements of those EU or national legislations as a means to
comply with the requirements of this Regulation, In such a case, the organisation shall
demonstrate to their competent authority that with those compliance methods the
organisation fully meets the requirements and objectives of this Regulation.
(17) The measures provided for in this Regulation need to ensure a consistent implementation
across all aviation domains, while creating a minimal impact on the existing rules already
applicable to those domains.
(18) The measures provided for in this Regulation need to be proportional to the risks incurred
by the different organisations.
(19) The measures provided for in this Regulation need to follow a performance- and risk-
based approach.
(20) The measures provided for in this Regulation need to ensure that organisations and
authorities can integrate any new management system requirements with other existing
management systems they may have.
(21) A sufficient transition period should be provided for organisations and authorities to
ensure their compliance with the new rules and procedures introduced by this Regulation.
(22) The measures provided for in this Regulation are based on Opinion No 03/2021(4), issued
by the European Union Aviation Safety Agency in accordance with Article 75(2)(b) and
(c) and Article 76(1) of Regulation (EU) 2018/1139.
(23) The measures provided for in this Regulation are in accordance with the opinion of the
committee established by Article 127 of Regulation (EU) 2018/1139,

HAS ADOPTED THIS REGULATION:

Article 1
Objectives
This Regulation establishes the requirements to be met by the organisations and competent
authorities referred to in Article 2 in order to:
— identify and manage information security risks which could affect information and
communication technology systems and data used for civil aviation purposes,
— detect information security events, identifying those which are considered information
security incidents, and
— respond to, and recover from, those information security incidents,

( 4) https://www.easa.europa.eu/document-library/opinions

EN 3 EN
 to a level commensurate with their impact on aviation safety.

Article 2
Scope
1. This Regulation applies to:
(a) maintenance organisations subject to Section A of Annex II (Part-145) to
Regulation (EU) No 1321/2014 (5);
(b) continuing airworthiness management organisations (CAMOs) subject to Section A
of Annex Vc (Part-CAMO) to Regulation (EU) No 1321/2014;
(c) air operators subject to Annex III (Part-ORO) to Regulation (EU) No 965/2012 (6),
except those solely involved in the operation of ELA 2 aircraft;
(d) aircrew training organisations (ATOs) subject to Annex VII (Part-ORA) to
Regulation (EU) No 1178/2011 (7), except those solely involved in training
activities of ELA2 aircraft or solely involved in theoretical training;
(e) aircrew aero-medical centres subject to Annex VII (Part-ORA) to Regulation (EU)
No 1178/2011;
(f) flight simulation training device (FSTD) operators subject to Annex VII (Part-
ORA) to Regulation (EU) No 1178/2011, except those solely involved in the
operation of FSTDs for ELA2 aircraft;
(g) air traffic controller training organisations (ATCO TOs) and ATCO aero-medical
centres subject to Annex III (Part ATCO.OR) to Regulation (EU) 2015/340 (8);
(h) organisations subject to Annex III (Part-ATM/ANS.OR) to Regulation (EU)
2017/373 (9), except the following service providers:
— air navigation service providers holding a limited certificate in accordance
with point ATM/ANS.OR.A.010;

( 5) Commission Regulation (EU) No 1321/2014 of 26 November 2014 on the continuing airworthiness of

aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel
involved in these tasks (OJ L 362, 17.12.2014, p. 1).
( 6) Commission Regulation (EU) No 965/2012 of 5 October 2012 laying down technical requirements and
administrative procedures related to air operations pursuant to Regulation (EC) No 216/2008 of the
European Parliament and of the Council (OJ L 296, 25.10.2012, p. 1).
( 7) Commission Regulation (EU) No 1178/2011 of 3 November 2011 laying down technical requirements and
administrative procedures related to civil aviation aircrew pursuant to Regulation (EC) No 216/2008 of the
European Parliament and of the Council (OJ L 311, 25.11.2011, p. 1).
( 8) Commission Regulation (EU) 2015/340 of 20 February 2015 laying down technical requirements and
administrative procedures relating to air traffic controllers' licences and certificates pursuant to Regulation
(EC) No 216/2008 of the European Parliament and of the Council, amending Commission Implementing
Regulation (EU) No 923/2012 and repealing Commission Regulation (EU) No 805/2011 (OJ L 63,
6.3.2015, p. 1).
( 9) Commission Implementing Regulation (EU) 2017/373 of 1 March 2017 laying down common requirements
for providers of air traffic management/air navigation services and other air traffic management network
functions and their oversight, repealing Regulation (EC) No 482/2008, Implementing Regulations (EU) No
1034/2011, (EU) No 1035/2011 and (EU) 2016/1377 and amending Regulation (EU) No 677/2011 (OJ L
62, 8.3.2017, p. 1).

EN 4 EN
 — flight information service providers declaring their activities in accordance
with point ATM/ANS.OR.A.015;
(i) U-space service providers and single common information service providers subject
to Regulation (EU) 2021/664 (10).
This Regulation is referenced in the Regulations listed in points (1)(a) through (1)(i) of
this Article, and compliance with its requirements shall be an integral part of the
organisation approval or declaration required by those Regulations.
2. This Regulation applies to the authorities, including the Agency, that are responsible for
the certification and oversight of the organisations listed in points (1)(a) through (1)(i) of
Article 2 of this Regulation, as well as to the authorities that are responsible for the
certification and oversight of the organisations listed in points (1)(a) and (1)(b) of Article
2 of Delegated Regulation (EU) 202X/XXXX.
NOTE: Delegated Regulation (EU) 202X/XXXX is the corresponding Delegated Act for
production and design organisations and for aerodrome operators and apron
management service providers.
This Regulation shall also apply to the competent authority responsible for the issuance,
continuation, change, suspension or revocation of aircraft maintenance licences as per
Annex III (Part-66) to Regulation (EU) No 1321/2014.
3. Organisations within the scope of Article 2(1) shall comply with the requirements of
Annex II (Part-IS.OR) to this Regulation.
4. Authorities within the scope of Article 2(2) shall comply with the requirements of Annex
I (Part-IS.AR) to this Regulation.

Article 3
Organisations subject to cybersecurity or information security requirements arising
from other EU or national legislation
1. Without prejudice to paragraph 2, where organisations listed in points (1)(a) through (1)(i)
of Article 2 of this Regulation are subject to cybersecurity or information security
requirements arising from other EU or national legislation, the competent authority
responsible for the certification and oversight of the organisation’s compliance with this
Regulation may replace compliance with the requirements of this Regulation by
compliance with elements contained in other EU or national legislation, provided that
such requirements are at least equivalent in effect to the obligations laid down in this
Regulation. In such a case, this competent authority shall coordinate with any other
relevant authorities to ensure coordinated or compatible oversight regimes.
2. In the case of airport operators, air carriers and entities as defined in the national civil
aviation security programmes of Member States, the competent authority responsible for
the certification and oversight of the organisation’s compliance with this Regulation may
replace compliance with the requirements contained in this Regulation, except those
related to the information security external reporting scheme required by point IS.OR.230
of Annex II to this Regulation, by compliance with elements of the cybersecurity

(10) Commission Implementing Regulation (EU) No 2021/664 of 22 April 2021 on a regulatory framework for
the U-space (OJ L 139, 23.4.2021, p. 161).

EN 5 EN
 requirements contained in the Annex to Commission Implementing Regulation (EU)
2015/1998. In such a case, this competent authority shall coordinate with any other
relevant authorities to ensure coordinated or compatible oversight regimes.
3. For those requirements contained in this Regulation where the competent authority has
not used the provisions of paragraph 1 or 2, the organisation may use compliance methods
developed under the cybersecurity or information security requirements of those EU or
national legislation as a means to comply with the requirements of this Regulation,
provided that the organisation demonstrates to their competent authority that with those
compliance methods the organisation fully meets the requirements and objectives of this
Regulation.

Article 4
Definitions
For the purpose of this Regulation, the following definitions shall apply:
(a) ‘ELA2 aircraft’ means a manned European Light Aircraft as defined in Article 1(2)(j) of
Regulation (EU) No 748/2012 (11);
(b) ‘information security’ means the preservation of confidentiality, integrity and availability
of information;
(c) ‘information security event’ means an identified occurrence of a system, service or
network state indicating a possible breach of the information security policy or failure of
information security controls, or a previously unknown situation that can be relevant for
information security;
(d) ‘information security incident’ means a single or a series of unwanted or unexpected
events having an actual adverse effect on information security;
(e) ‘information security risk’ means the risk to organisational civil aviation operations,
assets, individuals, and other organisations due to the potential of an information security
event. Information security risks are associated with the potential that threats will exploit
vulnerabilities of an information asset or group of information assets;
(f) ‘threat’ means a potential violation of information security which exists when there is an
entity, circumstance, action or event that could cause harm;
(g) ‘vulnerability’ means a flaw or weakness in systems, procedures, design, implementation,
or information security measures that could be exploited and results in a breach or
violation of the information security policy.

(11) Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules for the
airworthiness and environmental certification of aircraft and related products, parts and appliances, as well
as for the certification of design and production organisations (OJ L 224, 21.8.2012, p. 1).

EN 6 EN
 Article 5
Competent authority
Without prejudice to the tasks entrusted to the Security Accreditation Board (SAB) defined in
Article 37 of Regulation (EU) 2021/XXXX establishing the space programme of the Union and
the European Union Agency for the Space Programme and repealing Regulations (EU) No
912/2010, (EU) No 1285/2013, (EU) No 377/2014 and 541/2014/EU (Space Programme
Regulation), in those cases where the competent authority is not the Agency, Member States
may designate as the competent authority responsible for the certification and oversight of each
organisation’s compliance with this Regulation the same competent authority designated in
each one of the Regulations listed in points (1)(a) through (1)(i) of Article 2 of this Regulation.
Member States may also designate as competent authority for the purposes of this Regulation a
stand-alone entity, independent and autonomous from other competent authorities, in which
case coordination measures shall be established between the different entities, in order to ensure
effective oversight of all the requirements to be met by the organisation.

Article 6
Coordination between competent authorities listed in Article 2(2) of this Regulation
For organisations holding more than one approval or declaration according to the Regulations
detailed in points (1)(a) through (1)(i) of Article 2 of this Regulation and points (1)(a) and (1)(b)
of Article 2 of Delegated Regulation (EU) 202X/XXXX, the respective competent authorities
shall coordinate with each other in order to reduce the duplication of oversight activities and
increase the consistency of findings related to those facilities, systems, processes and
procedures shared by the organisation across several approvals or declarations.

Article 7
Coordination between the competent authorities listed in Article 2(2) of this Regulation
and other relevant authorities responsible for information security or cybersecurity
within their Member State
The competent authorities listed in Article 2(2) of this Regulation shall coordinate with any
other relevant authorities responsible for information security or cybersecurity within their
Member State in order to ensure an effective coordination of policies, oversight regimes and
reporting schemes.

Article 8
Coordination between the Agency, the European Commission, the European Union
Agency for the Space Programme (EUSPA) and its Security Accreditation Board (SAB)
with regard to the European Geostationary Navigation Overlay Service (EGNOS)

1. In order to avoid duplication of oversight activities, the Agency, as the competent

authority defined in Regulation (EU) 2017/373 and in Article 80 of Regulation (EU)
2018/1139 for the certification, oversight and enforcement of the EGNOS provider and
EGNOS system, shall coordinate with:

EN 7 EN
 (a) the European Commission, having the overall responsibility for the implementation
of EGNOS, including in the field of security, in accordance with Article 29 of the
Space Programme Regulation,
(b) the European Union Agency for the Space Programme (EUSPA), responsible of the
management of the exploitation of EGNOS and for its operational security, in
accordance with Article 30(2)(a) and Article 34(2) respectively of the Space
Programme Regulation, and
(c) the Security Accreditation Board (SAB), as the security accreditation authority for
EGNOS in accordance with Article 35 of Space Programme Regulation.
2. The coordination mechanism shall comply with the following requirements:
(a) The Agency shall deem as met any requirement contained in this Regulation and
applicable to EGNOS:
(1) which is already covered by the security requirements established for EGNOS
in accordance with the Space Programme Regulation; and
(2) for which appropriate traceability between such requirement and the
applicable security requirement has been established by mutual coordination
between the Agency and the Space Programme of the European Union; and
(3) when the SAB, in accordance with its established procedures including the
Security Accreditation Strategy, has issued an authorisation to the EGNOS
provider to operate the EGNOS system and its services based on the
applicable security requirements established for EGNOS and after a security
risk assessment.
(b) The European Commission shall share the security accreditation decision issued by
the SAB and the necessary evidence of the security accreditation file with the
Agency.
(c) In the particular case of changes to the functional system, the Agency shall consider
the information provided in point 2(b) when proceeding with the approval of the
argument of the safety support assessment required by point ATM/ANS.OR.C.005
of Subpart C of Annex III (Part-ATM/ANS.OR) to Regulation (EU) 2017/373.
(d) Any requirement of this Regulation not meeting the conditions contained in points
2(a) and 2(b) shall be assessed and overseen by the Agency.

Article 9
This Regulation shall enter into force on the twentieth day following that of its publication in
the Official Journal of the European Union.
It shall apply from [OP please insert date: 1 year after the date of entry into force].
Organisations within the scope of Article 2 may correct any findings of non-compliance related
to this Regulation until [OP please insert date: 2 years after the date of entry into force] or until
the date established by the competent authority for the correction of the finding, whichever
comes later.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

EN 8 EN
 Done at Brussels,

For the Commission

The President
Ursula VON DER LEYEN

EN 9 EN
 ANNEX I
INFORMATION SECURITY — AUTHORITY REQUIREMENTS
[PART-IS.AR]

IS.AR.100 Scope
IS.AR.200 Information security management system (ISMS)
IS.AR.205 Information security risk assessment
IS.AR.210 Information security risk treatment
IS.AR.215 Information security incidents — detection, response, and recovery
IS.AR.220 Contracting of information security management activities
IS.AR.225 Personnel requirements
IS.AR.230 Record-keeping
IS.AR.235 Continuous improvement

IS.AR.100 Scope
This Part establishes the management requirements to be met by the competent authorities listed
in Article 2(2) of this Regulation.
The requirements to be met by those competent authorities for the performance of their
certification, oversight and enforcement activities are contained in the Regulations listed in
points (1)(a) through (1)(i) of Article 2 of this Regulation and in points (1)(a) and (1)(b) of
Article 2 of Delegated Regulation (EU) 202X/XXXX.

IS.AR.200 Information security management system (ISMS)

(a) In order to achieve the objectives described in Article 1, the competent authority shall
establish, implement and maintain an information security management system (ISMS)
which ensures that the competent authority:
(1) establishes a policy on information security describing the overall principles of the
competent authority with regard to the potential impact of information security risks
on aviation safety;
(2) identifies and reviews information security risks in accordance with point
IS.AR.205;
(3) defines and implements information security risk treatment measures in accordance
with point IS.AR.210;
(4) defines and implements, in accordance with point IS.AR.215, the measures required
to detect information security events, identifies those which are considered
incidents with a potential impact on aviation safety, and responds to, and recovers
from, those information security incidents;
(5) complies with the requirements contained in point IS.AR.220 when contracting any
part of the activities described in point IS.AR.200 to other organisations;

EN 10 EN
 (6) complies with the personnel requirements contained in point IS.AR.225;
(7) complies with the record-keeping requirements contained in point IS.AR.230;
(8) monitors the compliance of its own organisation with the requirements of this
Regulation and provides feedback on findings to the top management to ensure
effective implementation of corrective actions;
(9) protects the confidentiality of any information that the competent authority may
have related to organisations under its oversight, as well as the information received
through the organisation’s external reporting schemes established in accordance
with point IS.OR.230 of Annex II (Part-IS.OR) to this Regulation and point
IS.OR.230 of Annex I (Part-IS-OR) to Delegated Regulation (EU) 202X/XXXX);
(10) notifies the Agency of changes that affect the capability of the competent authority
to perform its tasks and discharge its responsibilities as defined in this Regulation;
(11) defines and implements procedures to share, as appropriate and in a practical and
timely manner, relevant information to assist other competent authorities and
agencies, as well as organisations affected by this Regulation, to conduct effective
security risk assessments relating to their activities.
(b) In order to continuously meet the objectives described in Article 1, the competent
authority shall implement a continuous improvement process in accordance with point
IS.AR.235.
(c) The competent authority shall document all key processes, procedures, roles and
responsibilities required to comply with point IS.AR.200(a) and establish a process for
amending this documentation.
(d) The processes, procedures, roles and responsibilities established by the competent
authority in order to comply with point IS.AR.200(a) shall correspond to the size of the
competent authority and the nature and complexity of its activities, taking into account
the risks inherent in these activities, and may be integrated within other existing
management systems already implemented by the competent authority.

IS.AR.205 Information security risk assessment

(a) The competent authority shall identify all the elements of its own organisation which
could be exposed to information security risks. This shall include:
(1) the competent authority’s activities, facilities and resources, as well as the services
the competent authority operates, provides, receives or maintains; and
(2) the equipment, systems, data and information that contribute to the functioning of
the elements listed in point (a)(1)
(b) The competent authority shall identify the interfaces that its own organisation has with
other organisations, and which could result in the mutual exposure to information security
risks.
(c) For the elements and interfaces identified in points (a) and (b), the competent authority
shall identify the information security risks which may have a potential impact on aviation
safety. For each identified risk, the competent authority shall:
(1) assign a risk level according to a predefined classification established by the
competent authority; and

EN 11 EN
 (2) associate each risk and its level with the corresponding element or interface
identified under points (a) and (b).
The predefined classification referred to in point (c)(1) shall take into account the
potential of occurrence of the threat scenario and the severity of its safety consequences.
Through this classification, and taking into account whether the competent authority has
a structured and repeatable risk management process for operations, the competent
authority shall be able to establish whether the risk is acceptable or needs to be treated in
accordance with point IS.AR.210.
In order to facilitate the mutual comparability of risks assessments, the assignment of the
risk level per point (c)(1) shall take into account relevant information acquired in
coordination with the organisations identified under point (b).
(d) The competent authority shall review and update the risk assessment performed under
points (a), (b) and (c) when:
(1) there is a change in the elements subject to information security risks;
(2) there is a change in the interfaces between the competent authority’s organisation
and other organisations, or in the risks communicated by the other organisations; or
(3) there is a change in the information or knowledge used for the identification,
analysis and classification of risks; or
(4) there are lessons learnt from the analysis of information security incidents.

IS.AR.210 Information security risk treatment

(a) The competent authority shall develop measures to address unacceptable risks identified
under point IS.AR.205, shall implement them in a timely manner and shall verify their
continued effectiveness. Through these measures the competent authority shall be able
to:
(1) control those circumstances that contribute to the effective occurrence of the threat
scenario; and/or
(2) reduce the consequences to aviation safety associated with the materialisation of
the threat scenario; or
(3) avoid the risks.
These measures shall not introduce any new potential unacceptable risks to aviation
safety.
(b) The management and other affected personnel of the competent authority shall be
informed about the outcome of the risk assessment performed under point IS.AR.205, the
corresponding threat scenarios and the measures to be implemented.
The competent authority shall also inform those organisations with whom they have an
interface in accordance with point IS.AR.205(b) about any risk shared.

IS.AR.215 Information security incidents — detection, response and recovery

(a) Based on the outcome of the risk assessment performed in accordance with point
IS.AR.205 and the outcome of the risk treatment performed in accordance with point
IS.AR.210, the competent authority shall implement measures to detect events that

EN 12 EN
 indicate the potential materialisation of unacceptable risks and which may have a
potential impact on aviation safety. Through these detection measures the competent
authority shall be able to:
(1) identify deviations from predetermined functional performance baselines; and
(2) trigger warnings to activate proper response measures, in case of any deviation.
(b) The competent authority shall implement measures to respond to any event conditions
identified under point (a) that may develop or have developed into an information security
incident. Through these response measures the competent authority shall be able to:
(1) initiate the reaction of its own organisation to the warnings specified under point
(a)(2) by activating predefined resources and course of actions;
(2) contain the spread of an attack and avoid the full materialisation of a threat scenario;
and
(3) control the failure mode of the items in scope.
(c) The competent authority shall implement measures aimed at recovering from information
security incidents, including emergency measures, if needed. Through these recovery
measures the competent authority shall be able to:
(1) remove the condition that caused the incident, or constrain it to a tolerable level;
and
(2) restore a safe state of items in scope within a recovery time previously defined by
its own organisation.

IS.AR.220 Contracting of information security management activities

The competent authority shall ensure that when contracting any part of the activities required
by point IS.AR.200 to other organisations, the contracted activities conform to the requirements
of this Regulation and the contracted organisation works under its oversight. The competent
authority shall ensure that the risks associated with the contracted activities are appropriately
managed.

IS.AR.225 Personnel requirements

The competent authority shall:
(a) have a person who has the authority to establish and maintain the organisational
structures, policies, processes, and procedures necessary to implement this Regulation.
This person shall:
(1) have authority to fully access the resources necessary for the competent authority
to perform all the tasks required by this Regulation;
(2) possess the delegation of power required to perform the assigned duties;
(b) have a process in place to ensure that they have sufficient personnel on duty to perform
the activities related to Annex I (Part-IS.AR) to this Regulation;
(c) have a process in place to ensure that the personnel required in (b) have the necessary
competence to perform their tasks;
(d) have a process in place to ensure that personnel acknowledge the responsibilities

EN 13 EN
 associated with the assigned roles and tasks;
(e) ensure that the identity and trustworthiness of the personnel who have access to
information systems and data subject to the requirements of this Regulation are
appropriately established.

IS.AR.230 Record-keeping
(a) Records of the competent authority’s information security management activities
(1) The competent authority shall ensure that the following records are archived and
traceable:
(i) contracts for activities defined in point IS.AR.200(a)(5);
(ii) records of the key processes defined in point IS.AR.200(d);
(iii) records of the risks identified in the risk assessment defined in point
IS.AR.205 along with the associated risk treatment measures defined in point
IS.AR.210;
(iv) records of those information security events which may need to be reassessed
to reveal undetected information security incidents or vulnerabilities.
(2) The records specified under point (a)(1)(i) shall be retained at least until 5 years
after the contract has been amended or terminated.
(3) The records specified under points (a)(1)(ii) and (iii) shall be retained at least for a
period of 5 years.
(4) The records specified under point (a)(1)(iv) shall be retained until those information
security events have been reassessed in accordance with a periodicity defined in a
procedure established by the competent authority.
(b) Personnel records
(1) The competent authority shall ensure that the records of qualification and
experience of its own personnel involved in information security management are
retained.
(2) The records specified under (b)(1) shall be retained for as long as the person works
for the competent authority, and for at least 3 years after the person has left the
competent authority.
(3) The staff referred to in points (b)(1) and (b)(2) shall, upon their request, be given
access to their personnel records as detailed above. In addition, upon their request,
the competent authority shall furnish them with a copy of their personnel records
on leaving the competent authority.
(c) The format of the records shall be specified in the competent authority’s procedures.
(d) Records shall be stored in a manner that ensures protection from damage, alteration and
theft, with information being identified, when required, according to its security
classification level. The competent authority shall ensure that the records are stored using
means to ensure integrity, authenticity and authorised access.

IS.AR.235 Continuous improvement

EN 14 EN
 (a) The competent authority shall assess, using adequate performance indicators, the
effectiveness and maturity of its own ISMS. This assessment shall be performed on a
predefined calendar basis or following an information security incident.
(b) If deficiencies are found as a result of the assessment performed under point (a), the
competent authority shall take the necessary improvement measures to ensure that the
ISMS stays aligned with the applicable requirements and maintains the information
security risks at an acceptable level. In addition, the competent authority shall reassess
those elements of the ISMS affected by the measures introduced.

ANNEX II
INFORMATION SECURITY — ORGANISATION REQUIREMENTS
[PART-IS.OR]

IS.OR.100 Scope
IS.OR.200 Information security management system (ISMS)
IS.OR.205 Information security risk assessment
IS.OR.210 Information security risk treatment
IS.OR.215 Information security internal reporting scheme
IS.OR.220 Information security incidents — detection, response, and recovery
IS.OR.225 Response to findings notified by the competent authority
IS.OR.230 Information security external reporting scheme
IS.OR.235 Contracting of information security management activities
IS.OR.240 Personnel requirements
IS.OR.245 Record-keeping
IS.OR.250 Information security management manual (ISMM)
IS.OR.255 Changes to the information security management system
IS.OR.260 Continuous improvement

IS.OR.100 Scope
This Part establishes the requirements to be met by the organisations listed in Article 2 of this
Regulation.

IS.OR.200 Information security management system (ISMS)

EN 15 EN
 (a) In order to achieve the objectives described in Article 1, the organisation shall establish,
implement and maintain an information security management system (ISMS) which
ensures that the organisation:
(1) establishes a policy on information security describing the overall principles of the
organisation with regard to the potential impact of information security risks on
aviation safety;
(2) identifies and reviews information security risks in accordance with point
IS.OR.205;
(3) defines and implements information security risk treatment measures in accordance
with point IS.OR.210;
(4) implements an information security internal reporting scheme in accordance with
point IS.OR.215;
(5) defines and implements, in accordance with point IS.OR.220, the measures required
to detect information security events, identifies those which are considered
incidents with a potential impact on aviation safety except as permitted by point
IS.OR.205(e), and responds to, and recovers from, those information security
incidents;
(6) implements the measures that have been notified by the competent authority as an
immediate reaction to an information security incident or vulnerability with an
impact on aviation safety;
(7) takes appropriate action, in accordance with point IS.OR.225, to address findings
notified by the competent authority;
(8) implements an external reporting scheme in accordance with point IS.OR.230 in
order to allow the competent authority to take appropriate actions;
(9) complies with the requirements contained in point IS.OR.235 when contracting any
part of the activities described in point IS.OR.200 to other organisations;
(10) complies with the personnel requirements contained in point IS.OR.240;
(11) complies with the record-keeping requirements contained in point IS.OR.245;
(12) monitors compliance of the organisation with the requirements of this Regulation
and provides feedback on findings to the accountable manager to ensure effective
implementation of corrective actions;
(13) protects, without prejudice to applicable incident reporting requirements, the
confidentiality of any information that the organisation may have received from
other organisations, according to its level of sensitivity.
(b) In order to continuously meet the objectives described in Article 1, the organisation shall
implement a continuous improvement process in accordance with point IS.OR.260.
(c) The organisation shall document, in accordance with point IS.OR.250, all key processes,
procedures, roles and responsibilities required to comply with point IS.OR.200(a), and
shall establish a process for amending this documentation. Changes to those processes,
procedures, roles and responsibilities shall be managed in accordance with point
IS.OR.255.
(d) The processes, procedures, roles and responsibilities established by the organisation in
order to comply with point IS.OR.200(a) shall correspond to the size of the organisation
and the nature and complexity of its activities, taking into account the risks inherent in

EN 16 EN
 these activities, and may be integrated within other existing management systems already
implemented by the organisation.
(e) Without prejudice to the obligation to comply with the reporting requirements contained
in Regulation EU) No 376/2014(12), the organisation may be approved by the competent
authority not to implement the requirements contained in points (a) through (d) if it
demonstrates to the satisfaction of such authority that its activities, facilities and
resources, as well as the services it operates, provides, receives and maintains, do not pose
any information security risks with a potential impact on aviation safety neither to itself
nor to other organisations. This approval shall be based on a documented information
security risk assessment performed by the organisation in accordance with point
IS.OR.205 and reviewed and approved by its competent authority.
The continued validity of this approval shall be reviewed by the competent authority
following the applicable oversight audit cycle and whenever changes are implemented in
the scope of work of the organisation.

IS.OR.205 Information security risk assessment

(a) The organisation shall identify all the elements of the organisation which could be
exposed to information security risks. This shall include:
(1) the organisation’s activities, facilities and resources, as well as the services the
organisation operates, provides, receives or maintains; and
(2) the equipment, systems, data and information that contribute to the functioning of
the elements listed in point (a)(1).
(b) The organisation shall identify the interfaces that its own organisation has with other
organisations, and which could result in the mutual exposure to information security risks.
(c) For the elements and interfaces identified in points (a) and (b), the organisation shall
identify the information security risks which may have a potential impact on aviation
safety. For each identified risk, the organisation shall:
(1) assign a risk level according to a predefined classification established by the
organisation; and
(2) associate each risk and its level with the corresponding element or interface
identified under points (a) and (b).
The predefined classification referred to in point (c)(1) shall take into account the
potential of occurrence of the threat scenario and the severity of its safety consequences.
Through this classification, and taking into account whether the organisation has a
structured and repeatable risk management process for operations, the organisation shall
be able to establish whether the risk is acceptable or needs to be treated in accordance
with point IS.OR.210.
In order to facilitate the mutual comparability of risks assessments, the assignment of the
risk level per point (c)(1) shall take into account relevant information acquired in

(12) Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on the
reporting, analysis and follow-up of occurrences in civil aviation, amending Regulation (EU) No 996/2010
of the European Parliament and of the Council and repealing Directive 2003/42/EC of the European
Parliament and of the Council and Commission Regulations (EC) No 1321/2007 and (EC) No 1330/2007
(OJ L 122, 24.4.2014, p. 18).

EN 17 EN
 coordination with the organisations identified under point (b).
(d) The organisation shall review and update the risk assessment performed under points (a),
(b) and, as applicable, in points (c) or (e), when:
(1) there is a change in the elements subject to information security risks;
(2) there is a change in the interfaces between the organisation and other organisations,
or in the risks communicated by the other organisations; or
(3) there is a change in the information or knowledge used for the identification,
analysis and classification of risks; or
(4) there are lessons learnt from the analysis of information security incidents.
(e) By derogation from point (c), organisations required to comply with Subpart C of Annex
III (Part-ATM/ANS.OR) to Regulation (EU) 2017/373 shall replace the analysis of the
impact on aviation safety by an analysis of the impact on their services as per the safety
support assessment required by point ATM/ANS.OR.C.005. This safety support
assessment shall be shared with the air traffic service providers to whom they provide
services, being the responsibility of these air traffic service providers to evaluate the
impact on aviation safety.

IS.OR.210 Information security risk treatment

(a) The organisation shall develop measures to address unacceptable risks identified under
point IS.OR.205, shall implement them in a timely manner and shall verify their
continued effectiveness. Through these measures the organisation shall be able to:
(1) control those circumstances that contribute to the effective occurrence of the threat
scenario; and/or
(2) reduce the consequences on aviation safety associated with the materialisation of
the threat scenario; or
(3) avoid the risks.
These measures shall not introduce any new potential unacceptable risks to aviation
safety.
(b) The management and other affected personnel of the organisation shall be informed about
the outcome of the risk assessment performed under point IS.OR.205, the corresponding
threat scenarios and the measures to be implemented.
The organisation shall also inform those organisations with whom they have an interface
in accordance with point IS.OR.205(b) about any shared risk.

IS.OR.215 Information security internal reporting scheme

(a) The organisation shall establish an internal reporting scheme to enable the collection and
evaluation of information security events, including those to be reported under point
IS.OR.230.
(b) Through this scheme, and through the process described in point IS.OR.220, the
organisation shall:
(1) identify which of the events reported under point (a) are considered information
security incidents or vulnerabilities with a potential impact on aviation safety;

EN 18 EN
 (2) identify the causes of, and contributing factors to, the information security incidents
and vulnerabilities identified under point (b)(1), and address them as part of the
information security risk management process in accordance with points IS.OR.205
and IS.OR.220;
(3) ensure an evaluation of all known, relevant information relating to the information
security incidents and vulnerabilities identified under point (b)(1); and
(4) ensure the implementation of a method to distribute internally the information as
necessary.
(c) Any contracted organisation which may expose the organisation to information security
risks with a potential impact on aviation safety shall be required to report information
security events to the organisation. These reports shall be submitted using the procedures
established in the specific contractual arrangements and shall be evaluated in accordance
with point (b).
(d) The organisation shall cooperate on investigations with any other organisation that has a
significant contribution to the information security of its own activities.
(e) The organisation may integrate this reporting scheme with other reporting schemes it has
already implemented.

IS.OR.220 Information security incidents — detection, response and recovery

(a) Based on the outcome of the risk assessment performed in accordance with point
IS.OR.205 and the outcome of the risk treatment performed in accordance with point
IS.OR.210, the organisation shall implement measures to detect incidents and
vulnerabilities that indicate the potential materialisation of unacceptable risks and which
may have a potential impact on aviation safety. Through these detection measures the
organisation shall be able to:
(1) identify deviations from predetermined functional performance baselines; and
(2) trigger warnings to activate proper response measures, in case of any deviation.
(b) The organisation shall implement measures to respond to any event conditions identified
under point (a) that may develop or have developed into an information security incident.
Through these response measures the organisation shall be able to:
(1) initiate the reaction to the warnings specified under point (a)(2) by activating
predefined resources and course of actions;
(2) contain the spread of an attack and avoid the full materialisation of a threat scenario;
and
(3) control the failure mode of the items in scope.
(c) The organisation shall implement measures aimed at recovering from information
security incidents, including emergency measures, if needed. Through these recovery
measures the organisation shall be able to:
(1) remove the condition that caused the incident, or constrain it to a tolerable level;
and
(2) reach a safe state of items in scope within a recovery time previously defined by the
organisation.

EN 19 EN
 IS.OR.225 Response to findings notified by the competent authority
(a) After receipt of the notification of findings submitted by the competent authority, the
organisation shall:
(1) identify the root cause or causes of, and contributing factors to, the non-compliance;
(2) define a corrective action plan; and
(3) demonstrate the correction of the non-compliance to the satisfaction of the
competent authority.
(b) The actions required by point (a) shall be performed within the period agreed with the
competent authority.

IS.OR.230 Information security external reporting scheme

(a) The organisation shall implement an information security reporting system that meets the
requirements laid down in Regulation (EU) No 376/2014 and its delegated and
implementing acts if such Regulation is applicable to the organisation.
(b) Without prejudice to point (a), the organisation shall ensure that any information security
incident or vulnerability, which may represent a significant risk to aviation safety, is
reported to their competent authority. In addition:
(1) when such an incident or vulnerability affects an aircraft or associated system or
component, the organisation shall also report it to the design approval holder;
(2) when such an incident or vulnerability affects a system or constituent used by the
organisation, the organisation shall report it to the organisation responsible for the
design of the system or constituent.
(c) The organisation shall report the conditions identified in point (b) as follows:
(1) A notification shall be submitted to the competent authority and, if applicable, to
the design approval holder or to the organisation responsible for the design of the
system or constituent, as soon as the condition has been known to the organisation.
(2) A report shall be submitted to the competent authority and, if applicable, to the
design approval holder or to the organisation responsible for the design of the
system or constituent, as soon as possible, but not exceeding 72 hours from the time
the condition has been known to the organisation, unless exceptional circumstances
prevent this.
This report shall be made in a form and manner established by the competent
authority and shall contain all pertinent information about the condition known to
the organisation.
(3) A follow-up report shall be submitted to the competent authority and, if applicable,
to the design approval holder or to the organisation responsible for the design of the
system or constituent, providing details of the actions the organisation has taken or
intends to take to recover from the incident and the actions it intends to take to
prevent similar information security incidents in the future.
This follow-up report shall be submitted as soon as these actions have been
identified, and shall be produced in a form and manner established by the competent
authority.

EN 20 EN
 IS.OR.235 Contracting of information security management activities
(a) The organisation shall ensure that when contracting any part of the activities required by
point IS.OR.200 to other organisations, the contracted activities conform to the
requirements of this Regulation and the contracted organisation works under its oversight.
The organisation shall ensure that the risks associated with the contracted activities are
appropriately managed.
(b) The organisation shall ensure that the competent authority can have access upon request
to the contracted organisation to determine continued compliance with the applicable
requirements under this Regulation.

IS.OR.240 Personnel requirements

(a) The accountable manager of the organisation, as nominated in accordance with the
regulations detailed in points (1)(a) through (1)(i) of Article 2 of this Regulation, shall
have corporate authority to ensure that all activities required by this Regulation can be
financed and carried out. This person shall:
(1) ensure that all necessary resources are available to comply with the requirements of
this Regulation;
(2) establish and promote the information security policy specified in point
IS.OR.200(a)(1);
(3) demonstrate a basic understanding of this Regulation.
(b) The accountable manager shall nominate a person or group of persons to ensure that the
organisation is in compliance with the requirements of this Regulation, and shall define
the degree of their authority. Such person or group of persons shall be responsible and
have direct access to the accountable manager, and shall have the appropriate knowledge,
background and experience to discharge their responsibilities. It shall be made clear in
the procedures who deputises for a particular person in the case of lengthy absence of that
person.
(c) The accountable manager shall nominate a person or group of persons with the
responsibility to manage the compliance monitoring function required under point
IS.OR.200(a)(12).
(d) In the case where the organisation shares information security organisational structures,
policies, processes and procedures, with other organisations or with areas of their own
organisation which are not part of the approval or declaration, the accountable manager
may delegate its activities to a common responsible person.
In such a case, coordination measures shall be established between the accountable
manager of the organisation and the common responsible person to ensure adequate
integration of the information security management within the organisation.
(e) The accountable manager or the common responsible person described in (d), shall have
corporate authority to establish and maintain the organisational structures, policies,
processes and procedures necessary to implement point IS.OR.200.
(f) The organisation shall have a process in place to ensure that they have sufficient personnel
on duty to perform the activities related to Annex II (Part-IS.OR) to this Regulation.
(g) The organisation shall have a process in place to ensure that the personnel required by (f)
have the necessary competence to perform their tasks.

EN 21 EN
 (h) The organisation shall have a process in place to ensure that personnel acknowledge the
responsibilities associated with the assigned roles and tasks.
(i) The organisation shall ensure that the identity and trustworthiness of the personnel who
have access to information systems and data subject to the requirements of this Regulation
are appropriately established.

IS.OR.245 Record-keeping
(a) Records of the information security management activities
(1) The organisation shall ensure that the following records are archived and traceable:
(i) any approval received and any associated information security risk
assessment in accordance with point IS.OR.200(e);
(ii) contracts for activities defined in point IS.OR.200(a)(9);
(iii) records of the key processes defined in point IS.OR.200(d);
(iv) records of the risks identified in the risk assessment defined in point
IS.OR.205 along with the associated risk treatment measures defined in point
IS.OR.210;
(v) records of information security incidents and vulnerabilities reported under
the IS.OR.215 and IS.OR.230 internal and external reporting schemes;
(vi) records of those information security events which may need to be reassessed
to reveal undetected information security incidents or vulnerabilities.
(2) The records specified under point (a)(1)(i) shall be retained at least until 5 years
after the approval has lost its validity.
(3) The records specified under point (a)(1)(ii) shall be retained at least until 5 years
after the contract has been amended or terminated.
(4) The records specified under points (a)(1)(iii), (iv) and (v) shall be retained at least
for a period of 5 years.
(5) The records specified under point (a)(1)(vi) shall be retained until those information
security events have been reassessed in accordance with a periodicity defined in a
procedure established by the organisation.
(b) Personnel records
(1) The organisation shall ensure that the records of qualification and experience of
personnel involved in information security management and compliance
monitoring are retained.
(2) The records specified under (b)(1) shall be retained for as long as the person works
for the organisation, and for at least 3 years after the person has left the organisation.
(3) The staff referred to in points (b)(1) and (b)(2) shall, upon their request, be given
access to their personnel records as detailed above. In addition, upon their request,
the organisation shall furnish them with a copy of their personnel records on leaving
the organisation.
(c) The format of the records shall be specified in the organisation’s procedures.

EN 22 EN
 (d) Records shall be stored in a manner that ensures protection from damage, alteration and
theft, with information being identified, when required, according to its security
classification level. The organisation shall ensure that the records are stored using means
to ensure integrity, authenticity and authorised access.

IS.OR.250 Information security management manual (ISMM)

(a) The organisation shall make available to the competent authority an information security
management manual (ISMM) and, where applicable, any referenced associated manuals
and procedures, containing:
(1) a statement signed by the accountable manager confirming that the organisation will
at all times work in accordance with Annex II (Part-IS.OR) and with the ISMM.
When the accountable manager is not the chief executive officer (CEO) of the
organisation, then such CEO shall countersign the statement;
(2) the title(s), name(s), duties, accountabilities, responsibilities and authorities of the
person or persons defined in points IS.OR.240(b) and (c);
(3) the title, name, duties, accountabilities, responsibilities and authorities of the
common responsible person defined in point IS.OR.240(d), if applicable;
(4) the information security policy of the organisation as defined in point
IS.OR.200(a)(1);
(5) a general description of the number and categories of staff and of the system in place
to plan the availability of staff as required by point IS.OR.240;
(6) the title(s), name(s), duties, accountabilities, responsibilities and authorities of the
key persons responsible for the implementation of point IS.OR.200, including the
person or persons responsible for the compliance monitoring function as described
in point IS.OR.200(a)(12);
(7) an organisation chart showing the associated chains of accountability and
responsibility for the persons referred to in points (2) and (6);
(8) the description of the internal reporting scheme as required by point IS.OR.215;
(9) the procedures that specify how the organisation ensures compliance with this Part,
and in particular:
(i) the documentation required by point IS.OR.200(c);
(ii) the procedures that define how the organisation controls any contracted
activities as required by point IS.OR.200(a)(9);
(iii) the ISMM amendment procedure defined in point (c);
(10) the details of currently approved alternative means of compliance.
(b) The initial issue of the ISMM shall be approved and a copy shall be retained by the
competent authority. The ISMM shall be amended as necessary to remain an up-to-date
description of the ISMS of the organisation. A copy of any amendments to the ISMM
shall be provided to the competent authority.
(c) Amendments to the ISMM shall be managed as defined in a procedure established by the
organisation. Any amendments that are not included within the scope of this procedure,
as well as any amendments related to the changes listed in point IS.OR.255(b), shall be
approved by the competent authority.

EN 23 EN
 (d) The organisation may integrate the ISMM with other management expositions or manuals
it holds, provided there is a clear cross reference that indicates which portions of the
management exposition or manual correspond to the different requirements contained in
Annex II (Part-IS.OR) to this Regulation.

IS.OR.255 Changes to the information security management system

(a) Changes to the ISMS may be managed and notified to the competent authority as defined
in a procedure developed by the organisation. This procedure needs to be approved by
the competent authority.
(b) For changes to the ISMS not covered by the procedure defined in point (a), the
organisation shall apply for and obtain an approval issued by the competent authority.
For these changes:
(1) the application shall be submitted before any such change takes place, in order to
enable the competent authority to determine continued compliance with this
Regulation and to amend, if necessary, the organisation certificate and related terms
of approval attached to it;
(2) the organisation shall make available to the competent authority any information it
requests to evaluate the change;
(3) the change shall be implemented only upon receipt of a formal approval by the
competent authority; and
(4) the organisation shall operate under the conditions prescribed by the competent
authority during the implementation of such changes.

IS.OR.260 Continuous improvement

(a) The organisation shall assess, using adequate performance indicators, the effectiveness
and maturity of the ISMS. This assessment shall be performed on a predefined calendar
basis or following an information security incident.
(b) If deficiencies are found as a result of the assessment performed under point (a), the
organisation shall take the necessary improvement measures to ensure that the ISMS stays
aligned with the applicable requirements and maintains the information security risks at
an acceptable level. In addition, the organisation shall reassess those elements of the
ISMS affected by the measures introduced.

EN 24 EN