Part-IS for small organisations, in plain English

Are you in scope?

Part-IS is two regulations: Implementing Regulation (EU) 2023/203 for organisations overseen by national authorities, and Delegated Regulation (EU) 2022/1645 for design and production organisations. For operators and training organisations the one that matters is 2023/203. It applies from 22 February 2026 Art 16.

Article 2(1) lists who is in. The ones small organisations ask about:

• Air operators under Part-ORO, except those that only fly ELA2 aircraft, or only fly single-engine aeroplanes or helicopters with 5 passenger seats or fewer, not complex, taking off and landing at the same place, VFR by day Art 2(1)(c).
• ATOs, except those only training on ELA2 aircraft or only giving theoretical training Art 2(1)(d).
• CAMOs and Part-145 organisations, except those working only on Part-ML aircraft Art 2(1)(a), (b).
• Aero-medical centres and FSTD operators under Part-ORA Art 2(1)(e), (f).

DTOs are not on the list. If you run a declared training organisation and nothing else, Part-IS does not apply to you.

Declared organisations that are in scope still need an ISMS, but their manual and their changes to it do not need an approval IS.I.OR.250(b), IS.I.OR.255, as amended by Regulation (EU) 2025/2293.

What Part-IS asks for

The core is IS.I.OR.200(a): an information security management system (ISMS) that makes sure the organisation does thirteen things. In plain words:

Two points in IS.I.OR.200 help small organisations most. Point (d) says the processes "shall correspond to the nature and complexity" of your activities and "may be integrated within other existing management systems". Point (e) allows a derogation: the authority can approve you not to run an ISMS if a documented risk assessment shows your activities pose no information security risk with a potential impact on aviation safety. Reporting under Regulation (EU) 376/2014 still applies, and the approval is reviewed every oversight cycle.

Source: EASA Easy Access Rules for Information Security, revision of December 2025, and Regulation (EU) 2023/203 on EUR-Lex.

The simple-organisation route (EASA G-04, June 2026)

On 8 June 2026 the Part-IS Implementation Task Force of EASA and the national authorities issued guideline G-04, "Part-IS proportional implementation". It is written for authorities, but it says it "can be also used as guidance for those organisations". It tells inspectors what to accept from organisations that are simple from an information security point of view.

Being small is not enough on its own. G-04 uses three factors, which you agree with your authority:

• how safety-relevant your role is (your place in the chain, the aircraft, the organisations you connect to);
• how complex your organisation is (staff, departments, layers);
• how complex your IT and data are (and how connected to outside parties).

What G-04 accepts from a simple organisation:

• Short documents. Policies and procedures "can be concise, clear and easy to read". Templates are fine if tailored.
• Key policies first: management commitment, access control and incident response.
• Integration with the SMS. Put the information security policy inside the safety policy, use the same risk method, run internal reporting through the SMS report, and use the same auditors if they are qualified for both.
• Start from your SMS hazard list. Ask which existing safety risks could be caused by an information security threat, then list the assets and interfaces involved.
• A simple likelihood score. Appendix 1 scores opportunity, preparation and execution 1 to 3 each: 3 to 4 is low, 5 to 6 medium, 7 to 9 high.
• Playbooks. A predefined list of trigger events known to staff (an application stops responding, a suspicious message arrives) with a standard response for each.
• External reports through ECCAIRS 2, the same route you already use for safety occurrences.
• Few KPIs. A handful of relevant ones, such as training completion rate or Part-IS findings from audits.
• Scaled audits. Focus on the most critical areas, results to the accountable manager.

Source: Part-IS TF G-04, Part-IS proportional implementation, June 2026 (PDF).

Reporting: the 72-hour rule

Under IS.I.OR.230, any information security incident or vulnerability "which may represent a significant risk to aviation safety" goes to your competent authority, and to the design approval holder if it affects an aircraft system or component. The timing IS.I.OR.230(c):

1. Notification as soon as the condition is known to the organisation.
2. Report as soon as possible, and within 72 hours from the time it was known, unless exceptional circumstances prevent this.
3. Follow-up report on recovery and prevention, as soon as those actions have been identified.

This sits on top of Regulation (EU) 376/2014, not instead of it IS.I.OR.230(a). Regulation (EU) 2026/1821 also added information security items to the mandatory occurrence lists. Work out your dates with our occurrence reporting deadline calculator.

A 30-day plan for a small team

1. Week 1: scope. Take your SMS hazard list. Mark each hazard that a hacked, wrong or unavailable system could cause: flight planning, mass and balance, tech log, crew records, email, the maintenance system. List the systems and outside parties behind each one.
2. Week 2: risks and controls. Score likelihood with the G-04 three-question method. For every risk above your acceptance line, write the control and an owner. Fill the gaps first: access control, backups, multi-factor sign-in.
3. Week 3: reporting and response. Add an "information security" category to your SMS report form. Write a one-page playbook list of trigger events and responses. Add Part-IS to your occurrence procedure with the 72-hour report.
4. Week 4: manual and people. Write the policy into your safety policy, add an ISMM chapter (or a cross-referenced section), appoint the Part-IS responsible person and compliance monitoring, run a short awareness session, and add Part-IS to your audit plan.

If your risk assessment shows no safety-relevant information security risk at all, write it up and ask your authority about the IS.I.OR.200(e) derogation instead.