EASA Part-IS Compliance Checklist for Aviation Operators
EASA Part-IS requires aviation operators to implement and document an Information Security Management System — but the regulation does not provide a simple checklist of what this means in practice. This checklist translates the Part-IS requirements and associated acceptable means of compliance (AMC) into a practical set of evidence items that aviation operators should be able to demonstrate to their National Aviation Authority during oversight inspections. Use it to assess your current compliance position and identify priority gaps.
EASA Part-IS compliance requires evidence across ISMS documentation, risk management, technical controls, incident response, and ongoing governance — use this checklist to identify your gaps.
ISMS Foundation: Essential Documentation
The following documentation forms the foundation of a Part-IS compliant ISMS:
- Information Security Policy: Approved by the Accountable Manager, stating the organisation's commitment to information security and alignment to aviation safety objectives
- ISMS Scope Document: Written definition of the systems, processes, locations, and third parties within ISMS scope
- Risk Assessment Methodology: Documented approach to identifying, assessing, and prioritising information security risks
- Risk Register: Current risk register identifying information security risks, their likelihood and impact, and treatment decisions
- Statement of Applicability: Record of which security controls are implemented, which are excluded, and justification for exclusions
- Asset Register: Inventory of information assets within ISMS scope — systems, data, physical assets
Technical Controls: Implementation Evidence
Part-IS requires implementation of appropriate security controls. Key evidence items include:
- Access management records: User provisioning and de-provisioning processes, access review records, privileged access management documentation
- MFA implementation: Evidence of MFA deployment on remote access, email, and administrative systems
- Network security: Network architecture documentation showing segmentation between IT and OT, and between operational and public networks
- Patch management: Patch management policy and records demonstrating systematic vulnerability remediation
- Endpoint protection: Deployment records for endpoint protection across managed devices
- Encryption: Documentation of encryption at rest and in transit for sensitive information assets
- Vendor security: Third-party risk assessment records for significant suppliers — with security requirements incorporated in contracts
Incident Response and Reporting Evidence
Part-IS incident response requirements demand documented and tested capabilities:
- Incident Response Plan: Documented procedures for detecting, responding to, and recovering from information security incidents — covering scenarios relevant to aviation operations
- Exercise records: Evidence of incident response plan testing — tabletop exercises, simulation exercises, or live test events — within the last 12 months
- Incident register: Log of all security incidents and events, including how they were handled and any lessons learned
- NAA reporting procedure: Documented procedure for notifying the National Aviation Authority of incidents that may affect aviation safety — with designated responsible person and contact details
- Recovery testing: Evidence that backup and recovery procedures have been tested and recovery time objectives validated
Governance and Training Evidence
Part-IS requires management governance and trained personnel:
- Management review records: Minutes or records of management review of ISMS effectiveness — at defined intervals, at minimum annually
- Training records: Evidence that personnel with information security responsibilities have received appropriate training
- Awareness records: Evidence of general staff security awareness activities — training completion records, phishing simulation reports
- Role and responsibility assignments: Documented assignment of information security responsibilities — who is responsible for what within the ISMS
- Internal audit records: Evidence of internal audit of ISMS effectiveness and compliance
Frequently Asked Questions
How often should the EASA Part-IS checklist items be reviewed?
Part-IS requires the ISMS to be subject to regular management review — at minimum annually for most elements. The risk assessment should be reviewed when significant changes occur (new systems, new threats, organisational changes) and at least annually. The incident response plan should be tested at least annually. Technical controls should be reviewed as part of ongoing security operations. The overall compliance position should be assessed before any NAA oversight inspection.
Is this checklist the same as what EASA or NAAs use for Part-IS inspections?
This checklist is based on Part-IS requirements and the EASA Acceptable Means of Compliance (AMC) materials. NAAs develop their own inspection protocols, which may be more detailed or organised differently. However, the underlying requirements are derived from the same regulation — so evidence that satisfies this checklist should substantively address what NAA inspectors are looking for. Operators should also review any NAA-specific guidance published by their national authority (CAA in the UK, DGAC in France, LBA in Germany, etc.).
How does this Part-IS checklist relate to ISO 27001?
ISO 27001 provides a comprehensive ISMS framework that maps closely to Part-IS requirements. Organisations with ISO 27001 certification will typically be able to satisfy most Part-IS evidence requirements through their existing ISO 27001 documentation and records. The key Part-IS additions beyond standard ISO 27001 are the aviation safety dimension of the risk assessment and the NAA incident reporting procedure. ISO 27001 certified organisations should supplement their existing ISMS with these aviation-specific elements.
Get EASA Part-IS compliance support
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.