Since Part-IS took full effect on 22 February 2026, a common pattern has emerged across many organizations: The necessary guidelines have been drafted, processes documented, internal audits completed, and the first review by the regulatory authority is just around the corner. Nevertheless, key questions remain for those responsible: Are the new processes working in day-to-day operations? Where are the weaknesses in the established structures that need to be systematically addressed through the improvement process?
Prior to Part-IS taking effect, we highlighted the regulation’s key requirements and challenges in our article "Part-IS: The 7 Most Important Questions". Now, a little more than half a year later, it is becoming increasingly clear that the real challenge lies not in creating documents, but in embedding the requirements into day-to-day operations for the long term.
From the Part-IS projects that our experts are supporting, we can already identify initial patterns and find answers to these questions. We present our lessons learned in this article.
Lesson Learned: The Transition to Routine Operations Is More Challenging than Setting up the Processes
A great deal of effort is invested in developing policies and procedures during the project phase in order to create stable, long-term structures. However, it is only once operations are underway that it becomes clear whether the results actually work in day-to-day business and are accepted and applied.
We are currently supporting many organizations as they work to transition their Part-IS initiatives from the project phase to routine operations. Clear responsibilities, defined priorities, and a structured roadmap help them integrate the numerous requirements step by step and embed them permanently.
This phase in particular determines whether information security will be perceived as an additional administrative burden or become an integral part of operational processes. Feedback from the line departments provides valuable insights into which measures work in day-to-day operations and where adjustments are needed. Especially after the first government audit, important insights often emerge that guide the further development of the processes.
Lesson Learned: In Asset Management, the Initial Inventory Is Just the Starting Point
Compiling an inventory of all assets relevant to Part-IS is a major undertaking for organizations, as the regulation considers not only IT applications but also hardware, resources, facilities, and much more to be important. Once the inventory has been initially created, the work of continuously maintaining and updating the data sets begins. Here, too, responsibilities and processes often need to be established or adapted first.
Organizations should view asset inventories from the outset as an ongoing effort rather than a one-time project. The greatest added value often emerges only in the first few months of operation: responsibilities are clarified, data quality is improved, and valuation methods are standardized. Those who systematically leverage these experiences gradually improve their asset inventory and, with it, their understanding of scope and risks. Ideally, inventories are integrated into existing corporate systems at an early stage. This reduces the need for manual maintenance and allows established processes to be leveraged specifically for information security management.
Lesson Learned: Part-IS Does Not Stop at the Company’s Boundaries
With regard to auditing, greater emphasis is also being placed on the information security of external service providers and partners. Many organizations already have established contractual relationships and existing mechanisms for managing service providers and partners. However, these do not automatically meet the requirements of Part-IS.
Particularly in corporate structures and complex supply chains, the question often arises as to what security requirements must be imposed on external service providers and partners and how compliance with these requirements can be demonstrated to the authorities. It is not sufficient to rely solely on existing contracts and business relationships. Rather, service agreements, responsibilities, and documentation requirements should be specifically reviewed to ensure they comply with Part-IS guidelines.
Lesson Learned: Information Security Is Only Effective When Employees Embrace It
Perhaps the most important insight from the first six months: Part-IS will only be successful in the long term if all employees understand and embody its requirements. This includes a clear definition of roles, responsibilities, and required competencies. This can be particularly challenging under Part-IS, as areas of responsibility often span multiple departments and must be coordinated, particularly at the interfaces between safety and information security.
In many projects, we are currently helping to identify specific training needs and to clarify role descriptions and responsibilities. This enables employees to correctly classify and report information security-related incidents and contribute their expertise to risk assessments. Likewise, the manager responsible for Part-IS should be clearly established as the central point of contact within the organization.
We are seeing a particularly positive trend in cases where Part-IS-related questions are increasingly coming directly from the business units and being addressed directly to the Part-IS manager. This shows that the new measures are beginning to become part of everyday work.
Lesson Learned: Documentation Alone Is Not Sufficient for the Audit
Audit readiness begins much earlier than many organizations initially expect. This is because regulatory agencies will not only check whether standardized procedures are in place and whether they are documented, but, above all, whether these procedures are actually being followed. To ensure a smooth audit, each measure should be documented in a way that clearly demonstrates how its effectiveness can be verified, even to third parties.
The first reliable evidence for this begins to emerge as early as the project phase, for example through the creation of risk and asset inventories. In incident management, however, there is often still a lack of real-world use cases from which the effectiveness of established procedures can be determined. Simulations and tabletop exercises provide an opportunity to test the new processes under realistic conditions, document their effectiveness, and identify potential improvements based on the results.
Lesson Learned: Without Key Performance Indicators, It Is Difficult to Manage Improvement
Since Part-IS took effect, many organizations have shifted their focus from establishing the ISMS to ensuring its sustainable operation. It has become clear that implementation does not end with the introduction of the ISMS. Rather, this marks the beginning of a phase of continuous management and further development.
To enable organizations to measure their progress and manage it effectively, they should define appropriate key performance indicators (KPIs) early on. What is crucial here is not only collecting the KPIs themselves, but also the establishment of evaluation intervals, report recipients, and escalation procedures. Only in this way can organizations assess which measures are effective and in which areas there is a need for further optimization. Key performance indicators that highlight both the maturity level of information security and the actual effectiveness of implemented measures are particularly helpful in this regard.
The Next 12 Months Will Determine Long-Term Success
The first months of Part-IS show that most organizations have successfully addressed the basic requirements. For many of them, the focus is now on effectively embedding existing processes into their day-to-day operations.
"After more than half a year of Part-IS, I am convinced that the greatest successes are achieved where the focus is not merely on meeting requirements. Part-IS requires a shift in thinking and behavior, in which safety and information security naturally go hand in hand. When this is put into practice and embraced by all employees as part of a safety and information security culture, companies lay the foundation for a sustainably secure and resilient organization."
Wienke Schumacher, Senior Security Consultant, usd AG
Our experience to date makes it clear that, in particular, the operationalization of processes, the further development of asset and risk management, and the involvement of individual departments will be decisive for long-term success. The next 12 months will reveal whether information security and flight safety have indeed been effectively integrated and whether the structures that have been established will function under real-world conditions. This will be crucial to a successful transition to the operational phase.
Do you have any questions about Part-IS or need support? Contact us, we're happy to help.
