Applicability, Scope and Gap Assessment
Determine the applicable regulatory scope, identify affected activities and interfaces, and measure the organisation’s current arrangements against relevant Part-IS requirements.
AVIATION INFORMATION SECURITY
EASA Part-IS Compliance and Oversight Readiness
Part-IS is now applicable. Can your organisation demonstrate compliance?
AeroSecure helps aviation organisations implement and evidence an operational Information Security Management System—from applicability and aviation-safety risk assessment to documentation, training, internal audit and authority oversight support.
Request a 30-minute consultationEASA Part-IS Compliance Services
Comprehensive cybersecurity solutions tailored for aviation organizations to meet EASA information security requirements
Aviation Information-Security Risk Assessment
Identify information-security risks that may affect aviation safety, map assets and interfaces, evaluate risk, and establish proportionate treatment measures.
ISMM, Compliance Matrix and Procedures
Develop a tailored ISMM, regulatory compliance matrix, policies, procedures, registers, forms and responsibilities that reflect the organisation’s actual operation.
Operational Implementation and Evidence
Turn approved procedures into working processes, assign responsibilities, establish records, implement supplier controls and create the objective evidence required during oversight.
Role-Based Training and Incident Exercises
Deliver training for accountable managers, responsible personnel, auditors and employees, supported by practical scenarios and information-security incident exercises.
Mock Oversight, CAPA and Continuing Compliance
Test implementation before authority oversight, identify weaknesses, support corrective-action closure and provide continuing compliance assistance after initial implementation.
Implementation process
Scope
Confirm which Part-IS requirements apply, which activities and interfaces are in scope, and who is responsible.
Assess
Review current arrangements and aviation-safety information-security risks to identify gaps and priorities.
Design
Define a proportionate information-security management system, ISMM, procedures, responsibilities and compliance evidence suited to the organisation.
Implement
Put procedures into operation through controls, supplier coordination, records and role-based training.
Verify
Use internal audits and practical exercises to test whether controls work and evidence is ready for oversight.
Maintain
Track changes, incidents and corrective actions so compliance remains effective after initial implementation.
Part-IS is now applicable
Part-IS is now applicable to organisations within its regulatory scope. AeroSecure helps aviation organisations assess applicability, implement proportionate information-security processes, and maintain the records and evidence needed for continuing compliance and competent-authority oversight. Applicability depends on the organisation’s activities, approvals and interfaces and must be assessed individually.
- Data Protection
- Network Security
- EASA Compliance
- Aviation Safety
More than an ISMM
Part-IS oversight examines whether the organisation’s information-security processes actually operate—not merely whether an ISMM exists. AeroSecure helps establish the responsibilities, processes, competence, records and evidence required for continuing compliance.
- Integrated with existing safety and compliance-management systems
- Proportionate to the organisation’s size and complexity
- Designed around actual aviation services, interfaces and safety impacts
- Supported by implementation records and objective evidence
- Prepared for internal audit and competent-authority oversight
Aviation compliance first. Cybersecurity integrated.
AeroSecure combines aviation regulatory, operational, safety-management and information-security experience. Our solutions are built around aviation-safety impact, competent-authority expectations and practical integration with existing SMS and compliance-management systems—not generic cybersecurity templates.
- Former aviation regulatory-authority leadership
- Former military air traffic control experience
- Current commercial aviation operational experience
- Flight-instruction and ATO experience
- More than ten years of aviation compliance consultancy
- CompTIA Security+ certified lead consultant
- Practical aerodrome, SMS, CMS and regulatory-audit experience
About AeroSecure
AeroSecure is the aviation information-security and EASA Part-IS advisory practice of AeroConsulting Hungary Kft. From Budapest, we support aviation organisations across the EU from applicability assessment through implementation to oversight preparation.
Gábor Pongrácz
Lead Consultant — Aviation Compliance & Information Security
Gábor combines more than ten years of aviation compliance consultancy with experience in aviation regulatory leadership, military air traffic control, commercial aviation and flight training.
He helps aviation organisations translate Part-IS requirements into practical processes, clear responsibilities and evidence of implementation. His approach connects information security with aviation safety and integrates it into the organisation’s existing safety and compliance management systems.
CompTIA Security+ certifiedA globally recognised cybersecurity qualification covering core security skills, risk management and incident response.
Frequently asked questions
Does Part-IS apply to our organisation?
Applicability depends on your organisation’s activities, approvals and interfaces and must be assessed individually. Final regulatory determinations rest with the competent authority.
Is an ISMM sufficient for compliance?
No. An ISMM alone is insufficient: the processes must operate in practice and be supported by records and objective evidence.
Does ISO 27001 or NIS2 compliance automatically satisfy Part-IS?
No. ISO 27001 and NIS2 arrangements may support implementation, but Part-IS requirements must be assessed and evidenced separately.
Can AeroSecure assist after an authority finding?
Yes. We can support root-cause analysis, corrective actions and preparation of evidence for closure; the competent authority decides whether a finding is closed.
Do you provide continuing Part-IS support?
Yes. Support can include regulatory monitoring, internal audits, document updates, exercises and management reviews, tailored to the organisation.
Is there a separate Part-IS certificate?
Part-IS is not a standalone commercial certification scheme. Compliance is demonstrated through applicable oversight and evidence; the competent authority makes the regulatory determination.
Complimentary 30-Minute Applicability and Readiness Call
Talk with us about Part-IS applicability and your organisation’s current readiness.
Please do not submit sensitive system, vulnerability or incident information through this form. Secure document exchange will be arranged after initial contact.