In a regulated industry where the stakes are as high as aviation, demonstrating compliance is as important as achieving it. Under Commission Implementing Regulation (EU) 2023/203, EASA Part-IS establishes a structured framework requiring aviation organisations to manage information security risks through a formal Information Security Management System. At the core of that framework sits a requirement that is often underestimated in its scope and significance: IS.I/D.OR.245, the record-keeping obligation.

Whether you hold an Air Operator Certificate, operate as a CAMO, or fall under Part-145 or Part-ORA, this requirement is not a background administrative task. With competent authority audits now underway following the February 2026 applicability deadline, the question is no longer whether your organisation has an ISMS in place. It is whether you can prove it.

If you are reviewing your organisation’s readiness following the applicability date, our article EASA Part-IS Compliance Due by 22 February 2026 explains which organisations are affected and how competent authority audits are expected to proceed. Furthermore, the full legal text of Commission Implementing Regulation (EU) 2023/203, which introduces the Part-IS framework, is available on the official EUR-Lex legislation portal.

IS.I/D.OR.245 mandates that organisations establish and maintain records that demonstrate compliance with the Part-IS framework. Those records must be accurate, complete, and protected from unauthorised access or alteration. They must be retained for defined periods and be readily retrievable whenever a competent authority requests them.

The scope is broad. It covers information security policies, risk assessments, risk treatment plans, incident reports, training records, internal audit findings, corrective actions, governance decisions, and any changes made to the ISMS itself. The principle that regulators apply during oversight is unambiguous: if it is not documented, it did not happen

The official regulatory text and supporting guidance for these requirements can be reviewed in the EASA Easy Access Rules for Information Security, which compile the regulation together with the associated Acceptable Means of Compliance and Guidance Material.

Many organisations treat documentation as a back-office function, something to tidy up before an audit rather than maintain as an operational discipline. Under Part-IS, that approach carries real risk. Authorities do not assess intent during inspections; they assess evidence. A well-maintained record system allows your organisation to respond quickly and confidently to any oversight request. A disorganised or incomplete one creates the impression of a compliance programme that exists on paper but not in practice.
There is also a practical dimension that goes beyond regulatory optics. When a security incident occurs, documented historical records are essential to producing a credible root cause analysis. Without traceability, corrective actions become guesswork, and the same vulnerabilities tend to reappear. Similarly, documented risk assessments and audit findings, reviewed consistently over time, reveal patterns that no single-event review can identify. This is how organisations shift from reactive compliance to genuine risk management.
From a governance perspective, the consequences of poor documentation extend to legal and liability exposure. An organisation that can demonstrate it followed a defined process, maintained appropriate records, and acted on identified risks is in a fundamentally stronger position if a serious incident ever occurs.

Understanding the requirement is the starting point. Building a system that meets it consistently under real operational conditions is where most organisations face the practical challenge.
The foundation is a formal record-keeping policy that defines which records are required, who is responsible for maintaining them, what format they must take, and where they are stored. Without that policy, record-keeping tends to depend on individual habits rather than process, and that inconsistency is exactly what auditors are trained to identify.
Storage needs to be controlled. Physical records are difficult to protect and harder to retrieve at speed. A digital system with appropriate access permissions and audit trail functionality gives your organisation the ability to demonstrate record integrity alongside record content, both of which IS.I/D.OR.245 requires. Retention rules need to be documented as well, with different schedules applied to different record types and a clear disposal process that is itself auditable.
Traceability matters at the individual record level too. Every document should carry identifiers showing who created it, when, what version it is, and who approved it. This is particularly important for risk registers and corrective action plans, where version control directly affects whether your organisation can demonstrate that it identified a risk and responded to it. Personnel with ISMS responsibilities also need to understand what records they are required to produce and to what standard, and your internal audit programme should be checking documentation quality, not just operational activity.

EASA’s oversight framework assesses ISMS implementation across three maturity levels: Present and Suitable, Operating, and Effective. An organisation cannot be considered Operating unless its ISMS is actively generating records that demonstrate it is functioning in practice. The Effective level, which represents the goal of continuous improvement, requires those records to be used to drive meaningful change.
IS.I/D.OR.245 is not simply a supporting obligation within the framework. It is one of the clearest indicators of whether an ISMS is real or theoretical. Organisations with strong, consistent record-keeping are, almost by definition, operating a more mature compliance programme, and that maturity is exactly what competent authorities are looking for.

At Aero Compliance Solutions, we work with aviation organisations across Europe to build ISMS frameworks that are genuinely functional, not just compliant on paper. Our packages cover gap analysis, documentation development, and the practical implementation of record-keeping systems aligned with IS.I/D.OR.245. Our AeroScan tool complements this by scanning your IT infrastructure and producing detailed, traceable reports of findings, vulnerability distribution, and security action items, giving your organisation documented evidence of its security posture that feeds directly into your ISMS records.
Whether you are an AOC holder preparing for your first cyber audit, a CAMO working through implementation, or a Part-145 organisation looking to tighten your documentation standards, contact Aero Compliance Solutions today to find out how we can help you build a record-keeping system that stands up to scrutiny.