Part-IS introduces formal information security management requirements for organisations approved under EASA. Unlike voluntary frameworks, supervisory authorities will expect demonstrable governance, risk assessment, and evidence of operating effectiveness.

What the checklist covers

The checklist groups requirements into ten thematic areas (governance, scope, risk assessment, controls, supply chain, training, monitoring, incident response, continuous improvement, and documentation). Each item includes the requirement reference, evidence examples, and a recommended owner.

Walk through each item with your accountable manager and operations lead. Rate current state, identify gaps, and assign owners and target dates. AeroCyber Register supports this structuring work — it does not replace your competent authority's formal review.

Part-IS Readiness Checklist — AeroCyber Register