In today's digitally interconnected aviation environment, traditional safety and compliance measures are no longer sufficient on their own. The emergence of cyber threats, digital aircraft systems, and interconnected operational platforms has elevated information security to a strategic necessity. This article explores how aviation organisations can integrate their existing Management System, as required under EASA ORO.GEN.200, CAMO.A.200, and 145.A.200, with the Information Security Management System (ISMS) in accordance with EASA Part-IS.I.OR.
What is an Aviation Management System?
An aviation Management System is a structured framework that ensures safety, compliance, quality, and operational effectiveness. Per ORO.GEN.200, CAMO.A.200, and 145.A.200, organisations are required to implement and maintain a management system that includes:
- A Safety Management System (SMS)
- Compliance Monitoring
- Performance monitoring and continuous improvement
- Clearly defined responsibilities and communication
These components help aviation organisations maintain regulatory compliance and safety standards in a constantly evolving industry.
What is EASA Part IS ?
EASA Part-IS (Information Security) is a regulatory framework that introduces mandatory Information Security Management Systems (ISMS) for aviation organisations. Under Part-IS.I.OR, organisations are required to:
- Identify, assess, and mitigate risks to information and data
- Establish policies for data protection, access control, and system security
- Ensure coordination between safety and information security functions
- Conduct audits and reviews of information security effectiveness
EASA Part-IS was developed in response to the increasing threats posed by cyberattacks and data breaches in the aviation sector. The EASA Part-IS AMC (Acceptable Means of Compliance) provides further practical guidance for implementation, while the EASA Part-IS Easy Access Rules offer a consolidated and user-friendly reference.
The EASA Part-IS Implementation Date is set according to each organisation’s certification type. For most AOC holders, CAMOs, and Part-145 organisations, the regulation becomes mandatory either in October 2025 or February 2026. Preparing early is crucial.
Why Integration Matters ?
Managing safety, compliance, and security in silos leads to duplication, inefficiency, and gaps in oversight. Integration is not only encouraged by EASA but is also practical.
For example:
- Many processes in SMS and ISMS overlap: risk assessments, incident reporting, internal audits, and training.
- Compliance Monitoring systems already track deviations and corrective actions—these can be extended to include ISMS elements.
- Resource limitations in small to mid-sized organisations make integration a strategic necessity.
What are the Management System Requirements for EASA ?
The core requirements for aviation organisations under EASA Management System regulations are:
- Safety Risk Management (SMS)
- Compliance Monitoring
- Internal Safety Reporting
- Performance Monitoring and Review
Training and Competency
With the introduction of Part-IS, these now expand to include:
- Information Security Policy and Governance
- Risk Identification and Mitigation for Information Assets
- Data Breach Response and Reporting
Integration ensures that all eight areas are addressed holistically.
How to Integrate Information Security with Safety and Compliance
Here is a practical and detailed implementation roadmap to build an integrated management system that meets both traditional EASA requirements and EASA Part-IS:
1. Conduct a Detailed Gap Assessment
Start by reviewing your current compliance with ORO.GEN.200, CAMO.A.200, and 145.A.200. Then benchmark against the EASA Part-IS AMC guidance. Identify overlaps, redundancies, and gaps across:
- Risk management processes
- Incident reporting mechanisms
- Training and awareness programs
- Governance and accountability structures
Document the findings in a comprehensive report with actionable recommendations.
2. Establish or Expand Governance Structures
Appoint an Information Security Manager (ISM) or designate existing roles (e.g., Compliance Monitoring or Safety Manager) to include ISMS responsibilities. Update the organisational chart and ensure coordination between these roles.
Formalise the ISM’s scope, authority, and responsibilities in line with EASA Part-IS Easy Access Rules.
3. Integrate Risk Management Frameworks
Create a unified risk management system that combines:
- Operational hazards (SMS)
- Regulatory non-compliance (CMS)
- Information and cybersecurity threats (ISMS)
Use a shared risk register and classification methodology. Develop workflows that facilitate joint risk assessments and corrective action planning.
4. Extend the Internal Audit and Compliance Program
Update your annual audit program to include EASA Part-IS Implementation Date targets. Audit checklists should reflect:
- Data protection and handling
- Network and IT infrastructure controls
- Cyber incident response plans
Incorporate feedback loops from audits into management reviews and strategic planning.
5. Enhance Incident Reporting Systems
Adapt your existing safety reporting tools (e.g., ECCAIRS, internal portals) to also capture information security incidents. Develop incident classification and escalation protocols in alignment with Part-IS.I.OR.
Create clear definitions of what constitutes a security breach or vulnerability to ensure consistent reporting.
6. Develop and Deliver Integrated Training
Develop an organisation-wide training matrix that includes:
- Cyber hygiene and phishing awareness
- Data classification and handling
- IT security policies and acceptable use
- Combined safety-security scenarios (e.g., social engineering affecting operational safety)
Use interactive and scenario-based training methods to promote engagement.
7. Unify Documentation and Control Systems
Update manuals such as:
- Operations Manual (OM)
- Continuing Airworthiness Management Exposition (CAME)
- Maintenance Organisation Exposition (MOE)
Incorporate ISMS elements in alignment with EASA Part-IS AMC. Establish a central document control system that ensures version control and traceability for safety, compliance, and security-related documents.
8. Implement Technology and Tools
Deploy tools that support integration:
- Unified audit and reporting platforms
- Shared dashboards for compliance and ISMS metrics
- Automated threat detection and compliance tracking systems
Ensure secure access, data integrity, and audit logging across these systems
9. Conduct Regular Reviews and Management Evaluation
In accordance with EASA expectations, perform regular management reviews that include:
- Safety performance
- Compliance metrics
- Information security KPIs
Evaluate effectiveness, allocate resources, and update strategic goals.
How do you implement Information Security in Aviation ?
Successful implementation of information security in aviation requires:
- Strong leadership commitment
- Clear integration with safety and compliance roles
- A phased implementation aligned with the EASA Part-IS Implementation Date
- Continuous monitoring and adaptation to evolving threats
Leverage the EASA Part-IS Easy Access Rules to ensure your ISMS is comprehensive, practical, and regulator-approved.
Challenges and Considerations
- Cultural alignment: Bridging safety-first thinking with cybersecurity urgency
- Resource limitations: Especially in SMEs, one individual may handle multiple compliance domains
- Tool integration: Selecting platforms that allow combined monitoring of safety, compliance, and security
Conclusion
An integrated management system that aligns safety, compliance, and information security is the future of aviation oversight. EASA’s vision through ORO.GEN.200, CAMO.A.200, 145.A.200, and now Part-IS.I.OR reflects this holistic approach.
Organisations that proactively integrate their systems will be better prepared for audits, more resilient to threats, and more efficient in resource usage. Leverage the EASA Part-IS AMC and Easy Access Rules to guide your journey.
Aviathrust can support your organisation in bridging regulatory expectations and practical implementation through tailored ISMS and compliance integration services. Contact us for further details.
