How do you become EASA Part-IS compliant?

Becoming Part-IS compliant follows a fairly logical path, even if the detail differs from one organisation to the next. Most begin with a gap analysis to see how their current setup measures against the regulation. From there, the typical steps are: Define the scope and decide who is accountable for information security. Carry out an information security risk assessment, with a clear focus on risks that could affect aviation safety. Document everything in an Information Security Management Manual, often shortened to ISMM. Put detection, reporting and incident response processes in place. Train your staff so everyone involved understands their responsibilities. Review and audit the system so you can show it works in practice. Because Part-IS is an ongoing system rather than a one off task, many organisations bring in specialist support. Aero Compliance Solutions works with aviation operators through each of these stages, from the first gap analysis to a working ISMS.

Does EASA Part-IS apply to operators based outside the EU?

It can. Part-IS is an EU regulation, so it applies directly to organisations operating under the EASA system. If you are based outside the EU but hold an EASA approval, for example a maintenance organisation working under a bilateral agreement, you may still be expected to meet Part-IS or an equivalent standard. The exact position depends on the terms of the bilateral agreement between your country and the EU, so it is worth confirming which EASA regulations are recognised for your specific approval. As a general rule, if your business touches the European aviation system through a certificate or approval, it is safer to assume Part-IS is relevant until you have confirmed otherwise.

What were the EASA Part-IS deadlines?

There were two applicability dates. The first, 16 October 2025, applied to aerodrome operators and to design and production organisations under Delegated Regulation (EU) 2022/1645. The second, 22 February 2026, applied to the wider aviation population, including AOC holders, CAMOs, Part-145 maintenance organisations, training organisations and air navigation service providers under Implementing Regulation (EU) 2023/203. Both dates have now passed, so Part-IS is enforceable. It is worth knowing that EASA expects compliance to mature over time using its Present, Suitable, Operational and Effective model. Organisations are generally given an 18 month window from their applicability date to reach the operational and effective levels, so many businesses still have work to do even though the headline deadline is behind them.

Is ISO 27001 certification enough for Part-IS compliance?

This is one of the most common questions, and the short answer is no, not on its own. ISO 27001 is a strong starting point because much of it aligns with what Part-IS expects from an ISMS. The key difference is focus. ISO 27001 is built around protecting information in general, while Part-IS is built around aviation safety, which means you have to show how an information security risk could affect the safe operation of aircraft. If you already hold ISO 27001, you can take credit for a lot of the groundwork, but you still need to fold aviation safety into your risk management and meet the specific Part-IS requirements that ISO 27001 does not cover. EASA has published mapping guidance to help organisations bridge the gap between the two.

What happens if you do not comply with EASA Part-IS?

Because Part-IS is now in force, non-compliance is treated as a regulatory matter. During an audit, a national aviation authority can raise findings and require a corrective action plan. Continued failure to address those findings can lead to increased oversight, financial penalties depending on the jurisdiction, and in serious cases restrictions or suspension of your approvals, which can affect your ability to operate. There is also the reputational side. If a security incident happens alongside weak governance, the damage to trust can outlast any fine. The practical takeaway is to keep your ISMS active and auditable rather than treating it as a one off project. Tools such as AeroScan can help by scanning your IT infrastructure and producing a clear list of action items, which makes ongoing compliance much easier to demonstrate.

An Information Security Management System (ISMS) is a structured framework that helps aviation organisations protect their information, systems, digital assets, and operational data from security threats. It ensures confidentiality, integrity, and availability of critical information through policies, risk management, processes, monitoring, and continuous improvement.

FAQs

Aero Compliance Solutions

5.0 Stars - Based on 2 User Reviews

FAQs

How do you become EASA Part-IS compliant?
Does EASA Part-IS apply to operators based outside the EU?
What were the EASA Part-IS deadlines?
Is ISO 27001 certification enough for Part-IS compliance?
What happens if you do not comply with EASA Part-IS?
What Is ISMS

Get in Touch

Have a question or need more info? Fill out the form below and we’ll get back to you shortly.

+353 872 822 603+353 872 822 603

office@aerocompliancesolutions.comoffice@aerocompliancesolutions.com

The Compliance Experts You Can Trust

Trusted guidance for every stage of the Part-IS Approval Process.

5.0 Stars - Based on 2 User Reviews

Aero Compliance Solutions

Contact Info

Kells Business Park, Riverbank, Kells, Co. Meath, A82 KP94, Ireland
+353872822603
office@aerocompliancesolutions.com

Aviation ComplianceAviation Compliance

This website uses cookies and third party services. Settings

OK Reject

Tracking Cookies & Third Party Embeds

Third-Party Cookies & Embeds: Our site may include content or features from third-party services (such as YouTube, Google Maps, or social media). These services may set cookies and collect information about your interaction with their content.

FAQs

FAQs

How do you become EASA Part-IS compliant?

Does EASA Part-IS apply to operators based outside the EU?

What were the EASA Part-IS deadlines?

Is ISO 27001 certification enough for Part-IS compliance?

What happens if you do not comply with EASA Part-IS?

What Is ISMS

Get in Touch

The Compliance Experts You Can Trust

Aero Compliance Solutions

Contact Info

Tracking Cookies & Third Party Embeds