(1)

establishes a policy on information security setting out the overall principles of the competent authority with regard to the potential impact of information security risks on aviation safety;

(2)

identifies and reviews information security risks in accordance with point IS.AR.205;

(3)

defines and implements information security risk treatment measures in accordance with point IS.AR.210;

(4)

defines and implements, in accordance with point IS.AR.215, the measures required to detect information security events, identifies those which are considered incidents with a potential impact on aviation safety, and responds to, and recovers from, those information security incidents;

(5)

complies with the requirements contained in point IS.AR.220 when contracting any part of the activities described in point IS.AR.200 to other organisations;

(6)

complies with the personnel requirements contained in point IS.AR.225;

(7)

complies with the record-keeping requirements contained in point IS.AR.230;

(8)

monitors compliance of its own organisation with the requirements of this Regulation and provides feedback on findings to the person referred to in point IS.AR.225 (a) to ensure effective implementation of corrective actions;

(9)

protects the confidentiality of any information that the competent authority may have related to organisations subject to its oversight and the information received through the organisation’s external reporting schemes established in accordance with point IS.I.OR.230 of Annex II (Part-IS.I.OR) to this Regulation and point IS.D.OR.230 of the Annex (Part-IS.D.OR) to Delegated Regulation (EU) 2022/1645;

(10)

notifies the Agency of changes that affect the capacity of the competent authority to perform its tasks and discharge its responsibilities as defined in this Regulation;

(11)

defines and implements procedures to share, as appropriate and in a practical and timely manner, relevant information to assist other competent authorities and agencies, as well as organisations subject to this Regulation, to conduct effective security risk assessments relating to their activities.

(1)

the competent authority’s activities, facilities and resources, and the services the competent authority operates, provides, receives or maintains;

(2)

the equipment, systems, data and information that contribute to the functioning of the elements referred to in point (1)

(1)

assign a risk level according to a predefined classification established by the competent authority;

(2)

associate each risk and its level with the corresponding element or interface identified in accordance with points (a) and (b).

(1)

there is a change in the elements subject to information security risks;

(2)

there is a change in the interfaces between the competent authority’s organisation and other organisations, or in the risks communicated by the other organisations;

(3)

there is a change in the information or knowledge used for the identification, analysis and classification of risks;

(4)

there are lessons learnt from the analysis of information security incidents.

(1)

control the circumstances that contribute to the effective occurrence of the threat scenario;

(2)

reduce the consequences to aviation safety associated with the materialisation of the threat scenario;

(3)

avoid the risks.

(1)

identify deviations from predetermined functional performance baselines;

(2)

trigger warnings to activate proper response measures, in case of any deviation.

(1)

initiate the reaction of its own organisation to the warnings referred to in point (a)(2) by activating predefined resources and course of actions;

(2)

contain the spread of an attack and avoid the full materialisation of a threat scenario;

(3)

control the failure mode of the affected elements defined in point IS.AR.205(a).

(1)

remove the condition that caused the incident, or constrain it to a tolerable level;

(2)

restore a safe state of the affected elements defined in point IS.AR.205(a) within a recovery time previously defined by its own organisation.

(1)

have authority to fully access the resources necessary for the competent authority to perform all the tasks required by this Regulation;

(2)

possess the delegation of power required to perform the assigned duties;

(1)

The competent authority shall ensure that the following records are archived and traceable:

(2)

The records referred to in point (1)(i) shall be retained at least until 5 years after the contract has been amended or terminated.

(3)

The records referred to in point (1)(ii) and (iii) shall be retained at least for a period of 5 years.

(4)

The records referred to in point (1)(iv) shall be retained until those information security events have been reassessed in accordance with a periodicity defined in a procedure established by the competent authority.

(1)

The personnel’s qualification and experience records shall be retained for as long as the person works for the competent authority, and for at least 3 years after the person has left the competent authority.

(2)

Members of the staff shall, upon their request, be given access to their individual records. In addition, upon their request, the competent authority shall provide them with a copy of their individual records on leaving the competent authority.

(1)

establishes a policy on information security setting out the overall principles of the organisation with regard to the potential impact of information security risks on aviation safety;

(2)

identifies and reviews information security risks in accordance with point IS.I.OR.205;

(3)

defines and implements information security risk treatment measures in accordance with point IS.I.OR.210;

(4)

implements an information security internal reporting scheme in accordance with point IS.I.OR.215;

(5)

defines and implements, in accordance with point IS.I.OR.220, the measures required to detect information security events, identifies those events which are considered incidents with a potential impact on aviation safety except as permitted by point IS.I.OR.205(e), and responds to, and recovers from, those information security incidents;

(6)

implements the measures that have been notified by the competent authority as an immediate reaction to an information security incident or vulnerability with an impact on aviation safety;

(7)

takes appropriate action, in accordance with point IS.I.OR.225, to address findings notified by the competent authority;

(8)

implements an external reporting scheme in accordance with point IS.I.OR.230 in order to enable the competent authority to take appropriate actions;

(9)

complies with the requirements contained in point IS.I.OR.235 when contracting any part of the activities referred to in point IS.I.OR.200 to other organisations;

(10)

complies with the personnel requirements laid down in point IS.I.OR.240;

(11)

complies with the record-keeping requirements laid down in point IS.I.OR.245;

(12)

monitors compliance of the organisation with the requirements of this Regulation and provides feedback on findings to the accountable manager to ensure effective implementation of corrective actions;

(13)

protects, without prejudice to applicable incident reporting requirements, the confidentiality of any information that the organisation may have received from other organisations, according to its level of sensitivity.

(1)

the organisation’s activities, facilities and resources, as well as the services the organisation operates, provides, receives or maintains;

(2)

the equipment, systems, data and information that contribute to the functioning of the elements listed in point (1).

(1)

assign a risk level according to a predefined classification established by the organisation;

(2)

associate each risk and its level with the corresponding element or interface identified in accordance with points (a) and (b).

(1)

there is a change in the elements subject to information security risks;

(2)

there is a change in the interfaces between the organisation and other organisations, or in the risks communicated by the other organisations;

(3)

there is a change in the information or knowledge used for the identification, analysis and classification of risks;

(4)

there are lessons learnt from the analysis of information security incidents.

(1)

control the circumstances that contribute to the effective occurrence of the threat scenario;

(2)

reduce the consequences on aviation safety associated with the materialisation of the threat scenario;

(3)

avoid the risks.

(1)

identify which of the events reported pursuant to point (a) are considered information security incidents or vulnerabilities with a potential impact on aviation safety;

(2)

identify the causes of, and contributing factors to, the information security incidents and vulnerabilities identified in accordance with point (1), and address them as part of the information security risk management process in accordance with points IS.I.OR.205 and IS.I.OR.220;

(3)

ensure an evaluation of all known, relevant information relating to the information security incidents and vulnerabilities identified in accordance with point (1);

(4)

ensure the implementation of a method to distribute internally the information as necessary.

(1)

identify deviations from predetermined functional performance baselines;

(2)

trigger warnings to activate proper response measures, in case of any deviation.

(1)

initiate the reaction to the warnings referred to in point (a)(2) by activating predefined resources and course of actions;

(2)

contain the spread of an attack and avoid the full materialisation of a threat scenario;

(3)

control the failure mode of the affected elements defined in point IS.I.OR.205(a).

(1)

remove the condition that caused the incident, or constrain it to a tolerable level;

(2)

reach a safe state of the affected elements defined in point IS.I.OR.205(a) within a recovery time previously defined by the organisation.

(1)

identify the root cause or causes of, and contributing factors to, the non-compliance;

(2)

define a corrective action plan;

(3)

demonstrate the correction of the non-compliance to the satisfaction of the competent authority.

(1)

Where such an incident or vulnerability affects an aircraft or associated system or component, the organisation shall also report it to the design approval holder;

(2)

Where such an incident or vulnerability affects a system or constituent used by the organisation, the organisation shall report it to the organisation responsible for the design of the system or constituent.

(1)

a notification shall be submitted to the competent authority and, if applicable, to the design approval holder or to the organisation responsible for the design of the system or constituent, as soon as the condition has been known to the organisation;

(2)

a report shall be submitted to the competent authority and, if applicable, to the design approval holder or to the organisation responsible for the design of the system or constituent, as soon as possible, but not exceeding 72 hours from the time the condition has been known to the organisation, unless exceptional circumstances prevent this.

The report shall be made in the form defined by the competent authority and shall contain all relevant information about the condition known to the organisation;

(3)

a follow-up report shall be submitted to the competent authority and, if applicable, to the design approval holder or to the organisation responsible for the design of the system or constituent, providing details of the actions the organisation has taken or intends to take to recover from the incident and the actions it intends to take to prevent similar information security incidents in the future.

The follow-up report shall be submitted as soon as those actions have been identified, and shall be produced in the form defined by the competent authority.

(1)

ensure that all necessary resources are available to comply with the requirements of this Regulation;

(2)

establish and promote the information security policy referred to in point IS.I.OR.200(a)(1);

(3)

demonstrate a basic understanding of this Regulation.

(1)

The organisation shall ensure that the following records are archived and traceable:

(2)

The records referred to in point (1)(i) shall be retained at least until 5 years after the approval has lost its validity.

(3)

The records referred to in point (1)(ii) shall be retained at least until 5 years after the contract has been amended or terminated.

(4)

The records referred to point (1)(iii), (iv) and (v) shall be retained at least for a period of 5 years.

(5)

The records referred to in point (1)(vi) shall be retained until those information security events have been reassessed in accordance with a periodicity defined in a procedure established by the organisation.

(1)

The personnel’s qualification and experience records shall be retained for as long as the person works for the organisation, and for at least 3 years after the person has left the organisation.

(2)

Members of the staff shall, upon their request, be given access to their individual records. In addition, upon their request, the organisation shall provide them with a copy of their individual records on leaving the organisation.

(1)

a statement signed by the accountable manager confirming that the organisation will at all times work in accordance with this Annex and with the ISMM. If the accountable manager is not the chief executive officer (CEO) of the organisation, then the CEO shall countersign the statement;

(2)

the title(s), name(s), duties, accountabilities, responsibilities and authorities of the person or persons defined in point IS.I.OR.240(b) and (c);

(3)

the title, name, duties, accountabilities, responsibilities and authority of the common responsible person defined in point IS.I.OR.240(d), if applicable;

(4)

the information security policy of the organisation as referred to in point IS.I.OR.200(a)(1);

(5)

a general description of the number and categories of staff and of the system in place to plan the availability of staff as required by point IS.I.OR.240;

(6)

the title(s), name(s), duties, accountabilities, responsibilities and authorities of the key persons responsible for the implementation of point IS.I.OR.200, including the person or persons responsible for the compliance monitoring function referred to in point IS.I.OR.200(a)(12);

(7)

an organisation chart showing the associated chains of accountability and responsibility for the persons referred to in points (2) and (6);

(8)

the description of the internal reporting scheme referred to in point IS.I.OR.215;

(9)

the procedures that specify how the organisation ensures compliance with this Part, and in particular:

(10)

the details of currently approved alternative means of compliance.

(1)

the application shall be submitted before any such change takes place, in order to enable the competent authority to determine continued compliance with this Regulation and to amend, if necessary, the organisation certificate and related terms of approval attached to it;

(2)

the organisation shall make available to the competent authority any information it requests to evaluate the change;

(3)

the change shall be implemented only upon receipt of a formal approval by the competent authority;

(4)

the organisation shall operate under the conditions prescribed by the competent authority during the implementation of such changes.

(a)

in point ‘ARA.GEN.125, the following point (c) is added:

(b)

the following point ARA.GEN.135A is inserted after point ARA.GEN.135:

‘ ARA.GEN.135A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

(c)

in point ARA.GEN.200, the following point (e) is added:

(d)

point ARA.GEN.205 is amended as follows:

(e)

in point ARA.GEN.300, the following point (g) is added:

(f)

the following point ARA.GEN.330A is inserted after point ARA.GEN.330:

‘ ARA.GEN.330A Changes to the information security management system

(a)

the following heading is inserted after heading 21.B.20:

‘21.B.20A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety’;

(b)

the heading of point 21.B.30 is replaced by the following:

‘21.B.30 Allocation of tasks’;

(c)

the following heading is inserted after heading 21.B.240:

‘21.B.240A Changes to the information security management system’;

(d)

the following heading is inserted after heading 21.B.435:

‘21.B.435A Changes to the information security management system’;

‘(c)

The competent authority of the Member State shall provide the Agency as soon as possible with safety-significant information stemming from the information security reports it has received pursuant to point IS.D.OR.230 of the Annex (Part-IS.D.OR) to Delegated Regulation (EU) 2022/1645.’;

(a)

The competent authority shall implement a system to appropriately collect, analyse, and disseminate information related to information security incidents and vulnerabilities with a potential impact on aviation safety that are reported by organisations. This shall be done in coordination with any other relevant authorities responsible for information security or cybersecurity within the Member State to increase the coordination and compatibility of reporting schemes.

(b)

The Agency shall implement a system to appropriately analyse any relevant safety-significant information received in accordance with point 21.B.15(c), and without undue delay provide the Member States and the Commission with any information, including recommendations or corrective actions to be taken, necessary for them to react in a timely manner to an information security incident or vulnerability with a potential impact on aviation safety involving products, parts, non-installed equipment, persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.

(c)

Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the potential impact on aviation safety of the information security incident or vulnerability.

(d)

Measures taken in accordance with point (c) shall immediately be notified to all persons or organisations that shall comply with them under Regulation (EU) 2018/1139 and its delegated and implementing acts. The competent authority of the Member State shall also notify those measures to the Agency and, when combined action is required, the competent authorities of the other Member States concerned.’;

‘(e)

In addition to the requirements contained in point (a), the management system established and maintained by the competent authority shall comply with Annex I (Part-IS.AR) to Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.’;

(a)

the heading is replaced by the following:

‘21.B.30 Allocation of tasks’;

(b)

the following point (c) is added:

‘(g)

With regard to the certification and oversight of the organisation’s compliance with point 21.A.139A, in addition to complying with points (a) to (f), the competent authority shall review any approval granted under point IS.I.OR.200(e) of this Regulation or point IS.D.OR.200(e) of Delegated Regulation (EU) 2022/1645 following the applicable oversight audit cycle and whenever changes are implemented in the scope of work of the organisation.’

(a)

For changes managed and notified to the competent authority in accordance with the procedure set out in point IS.D.OR.255(a) of the Annex (Part-IS.D.OR) to Delegated Regulation (EU) 2022/1645, the competent authority shall include the review of such changes in its continuing oversight in accordance with the principles laid down in point 21.B.221. If any non-compliance is found, the competent authority shall notify the organisation thereof, request further changes and act in accordance with point 21.B.225.

(b)

For other changes requiring an application for approval in accordance with point IS.D.OR.255(b) of the Annex (Part-IS.D.OR) to Delegated Regulation (EU) 2022/1645:

‘(d)

For the certification and oversight of the organisation’s compliance with point 21.A.239A, in addition to complying with points (a) to (c), the competent authority shall comply with the following principles:

(a)

For changes managed and notified to the competent authority in accordance with the procedure set out in point IS.D.OR.255(a) of the Annex (Part-IS.D.OR) to Delegated Regulation (EU) 2022/1645, the competent authority shall include the review of such changes in its continuing oversight in accordance with the principles laid down in point 21.B.431. If any non-compliance is found, the competent authority shall notify the organisation thereof, request further changes and act in accordance with point 21.B.433.

(b)

For other changes requiring an application for approval in accordance with point IS.D.OR.255(b) of the Annex (Part-IS.D.OR) to Delegated Regulation (EU) 2022/1645:

(a)

in point ARO.GEN.125, the following point (c) is added:

(b)

the following point ARO.GEN.135A is inserted after point ARO.GEN.135:

‘ARO.GEN.135A    Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

(c)

in point ARO.GEN.200, the following point (e) is added:

(d)

point ARO.GEN.205 is amended as follows:

(e)

in point ARO.GEN.300, the following point (g) is added:

(f)

the following point ARO.GEN.330A is inserted after point ARO.GEN.330:

‘ARO.GEN.330A    Changes to the information security management system

‘(c)

The competent authority of the Member State shall provide the Agency as soon as possible with safety-significant information stemming from the information security reports it has received pursuant to point IS.D.OR.230 of the Annex (Part-IS.D.OR) to Delegated Regulation (EU) 2022/1645.’;

(a)

The competent authority shall implement a system to appropriately collect, analyse, and disseminate information related to information security incidents and vulnerabilities with a potential impact on aviation safety that are reported by organisations. This shall be done in coordination with any other relevant authorities responsible for information security or cybersecurity within the Member State to increase the coordination and compatibility of reporting schemes.

(b)

The Agency shall implement a system to appropriately analyse any relevant safety-significant information received in accordance with point ADR.AR.A.025(c), and without undue delay provide the Member States and the Commission with any information, including recommendations or corrective actions to be taken, necessary for them to react in a timely manner to an information security incident or vulnerability with a potential impact on aviation safety involving products, parts, non-installed equipment, persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.

(c)

Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the potential impact on aviation safety of the information security incident or vulnerability.

(d)

Measures taken in accordance with point (c) shall immediately be notified to all persons or organisations that shall comply with them under Regulation (EU) 2018/1139 and its delegated and implementing acts. The competent authority of the Member State shall also notify those measures to the Agency and, when combined action is required, the competent authorities of the other Member States concerned.’;

‘(d)

In addition to the requirements contained in point (a), the management system established and maintained by the competent authority shall comply with Annex I (Part-IS.AR) to Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.’;

(i)

the heading is replaced by the following:

‘ ADR.AR.B.010 Allocation of tasks ’;

(ii)

the following point (c) is added:

‘(f)

With regard to the certification and oversight of the organisation’s compliance with point ADR.OR.D.005A, in addition to complying with points (a) to (e), the competent authority shall review any approval granted under point IS.I.OR.200(e) of this Regulation or point IS.D.OR.200(e) of Delegated Regulation (EU) 2022/1645 following the applicable oversight audit cycle and whenever changes are implemented in the scope of work of the organisation.’

(a)

With regard to changes managed and notified to the competent authority in accordance with the procedure set out in point IS.D.OR.255(a) of the Annex (Part-IS.D.OR) to Delegated Regulation (EU) 2022/1645, the competent authority shall include the review of such changes in its continuing oversight in accordance with the principles laid down in point ADR.AR.C.005. If any non-compliance is found, the competent authority shall notify the organisation thereof, request further changes and act in accordance with point ADR.AR.C.055.

(b)

With regard to other changes requiring an application for approval in accordance with point IS.D.OR.255(b) of the Annex (Part-IS.D.OR) to Delegated Regulation (EU) 2022/1645:

(a)

the Table of Contents is amended as follows:

(b)

the following point 145.A.200A is inserted after point 145.A.200:

‘145.A.200A    Information security management system

In addition to the management system referred to in point 145.A.200, the maintenance organisation shall establish, implement and maintain an information security management system in accordance with Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.’;

(c)

in point 145.B.125, the following point (c) is added:

(d)

the following point 145.B.135A is inserted after point 145.B.135:

‘145.B.135A    Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

(e)

in point 145.B.200, the following point (e) is added:

(f)

point 145.B.205 is amended as follows:

(g)

in point 145.B.300, the following point (g) is added:

(h)

the following point 145.B.330A is inserted after point 145.B.330:

‘145.B.330A    Changes to the information security management system

(a)

in the Table of Contents, the following heading is inserted after heading 66.B.10:

(b)

the following point 66.B.15 is inserted after point 66.B.10:

‘66.B.15    Information security management system

The competent authority shall establish, implement and maintain an information security management system in accordance with Annex I (Part-IS.AR) to Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.’;

(a)

the Table of Contents is amended as follows:

(b)

the following point CAMO.A.200A is inserted after point CAMO.A.200:

‘CAMO.A.200A    Information security management system

In addition to the management system referred to in point CAMO.A.200, the organisation shall establish, implement and maintain an information security management system in accordance with Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.’;

(c)

in point CAMO.B.125, the following point (c) is added:

(d)

the following point CAMO.B.135A is inserted after CAMO.B.135:

‘CAMO.B.135A    Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

(e)

in point CAMO.B.200, the following point (e) is added:

(f)

point CAMO.B.205 is amended as follows:

(g)

in point CAMO.B.300, the following point (g) is added:

(h)

the following point CAMO.B.330A is inserted after point CAMO.B.330:

‘CAMO.B.330A    Changes to the information security management system

(a)

in point ATCO.AR.A.020, the following point (c) is added:

(b)

the following point ATCO.AR.A.025A is inserted after point ATCO.AR.A.025:

‘ATCO.AR.A.025A    Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

(c)

in point ATCO.AR.B.001, the following point (e) is added:

(d)

point ATCO.AR.B.005 is amended as follows:

(e)

in point ATCO.AR.C.001, the following point (f) is added:

(f)

the following point ATCO.AR.E.010A is inserted after point ATCO.AR.E.010:

‘ATCO.AR.E.010A    Changes to the information security management system

(a)

in point ATM/ANS.AR.A.020, the following point (c) is added:

(b)

the following point ATM/ANS.AR.A.025A is inserted after point ATM/ANS.AR.A.025:

‘ ATM/ANS.AR.A.025A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

(c)

in point ATM/ANS.AR.B.001, the following point (e) is added:

(d)

point ATM/ANS.AR.B.005 is amended as follows:

(e)

in point ATM/ANS.AR.C.010, the following point (d) is added:

(f)

the following point ATM/ANS.AR.C.025A is inserted after point ATM/ANS.AR.C.025:

‘ ATM/ANS.AR.C.025A Changes to the information security management system

(a)

the following point ATM/ANS.OR.B.005A is inserted after point ATM/ANS.OR.B.005:

‘ ATM/ANS.OR.B.005A Information security management system

In addition to the management system referred to in point ATM/ANS.OR.B.005, the service provider shall establish, implement and maintain an information security management system in accordance with Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.’;

(b)

point ATM/ANS.OR.D.010 is replaced by the following:

‘ ATM/ANS.OR.D.010 Security management