{"id":53378,"date":"2024-10-23T14:58:19","date_gmt":"2024-10-23T12:58:19","guid":{"rendered":"https:\/\/www.usd.de\/?p=53378"},"modified":"2025-01-08T16:24:37","modified_gmt":"2025-01-08T15:24:37","slug":"7-questions-on-part-is","status":"publish","type":"post","link":"https:\/\/www.usd.de\/en\/7-questions-on-part-is\/","title":{"rendered":"Part-IS: The 7 Most Important Questions"},"content":{"rendered":"\n

Civil aviation consists of a complex network of numerous interrelated systems that are increasingly becoming the target of cyber attacks. Part-IS is intended to oblige the organizations involved to take effective measures to protect themselves against information security risks that could affect flight safety.<\/p>\n\n\n\n

Our experts Andrea Rupprich and Wienke Schumacher answer the 7 most important questions about Part-IS and, with the help of their insights from implementation and consulting projects, provide tips for your optimal preparation.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n
<\/div>\n\n\n\n
\n
\"Andrea
Andrea Rupprich<\/figcaption><\/figure>\n<\/div>\n\n\n\n
<\/div>\n\n\n\n
\n
\"Wienke
Wienke Schumacher<\/figcaption><\/figure>\n<\/div>\n\n\n\n
<\/div>\n<\/div>\n\n\n\n

<\/p>\n\n\n\n

    \n
  1. What is Part-IS?<\/a><\/li>\n\n\n\n
  2. What are the objectives of Part-IS?<\/a><\/li>\n\n\n\n
  3. Who is affected by Part-IS?<\/a><\/li>\n\n\n\n
  4. What are the main requirements of Part-IS?<\/a><\/li>\n\n\n\n
  5. What impact does Part-IS have on the processes in the company?<\/a><\/li>\n\n\n\n
  6. How does an ISMS according to Part-IS differ from an ISMS according to ISO 27001?<\/a><\/li>\n\n\n\n
  7. How do you best start implementing Part-IS?<\/a><\/li>\n<\/ol>\n\n\n\n

    <\/p>\n\n\n\n

    1. What is Part-IS?<\/h2>\n\n\n\n

    Part-IS<\/a> (Part Information Security) refers to two EU regulations with very similar content.<\/p>\n\n\n\n

    One is the European Commission's \u201cImplementing Regulation 2023\/203\u201d and the other is the European Commission's \u201cDelegated Regulation 2022\/1645\u201d. The \u201cDelegated Regulation 2022\/1645\u201d applies to manufacturing and design organizations, as well as aerodrome operators and providers of apron control services.<\/p>\n\n\n\n

    Both have the objective of managing information security risks that could potentially impact aviation safety. In short, Part-IS requires that companies falling within the scope of the regulation must establish an ISMS. Transposition into national law is not necessary.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    2. What are the objectives of Part-IS?<\/h2>\n\n\n\n

    Safety risks in the airline industry have always been rigorously managed. Every incident in the aviation industry results in extensive investigations with the aim of improving processes to avoid similar incidents. Despite such efforts, the attacks of September 11 were able to happen. In the final report on the terrorist attacks, the most serious mistake was noted as \u201ca lack of imagination\u201d \u2013 people simply did not have enough imagination to come up with such a drastic scenario (exact quote: \u201cThe most important failure was one of imagination.\u201d<\/p>\n\n\n\n

    See 9\/11 Report here: National Commission on Terrorist Attacks Upon the United States (911commission.gov)<\/a>.<\/p>\n\n\n\n

    With the increasing digitalization, the scenario of a \u201ccyber 9\/11\u201d is conceivable, in which an attacker no longer even has to board the aircraft, but can cause catastrophic damage by digitally manipulating and remotely controlling it. Part-IS is a measure to counter and guard against precisely this worst-case scenario.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    3. Who is affected by Part-IS? <\/h2>\n\n\n\n

    A number of organizations that are already regulated by other aviation regulations are affected. The \u201cImplementing Regulation 2023\/203\u201d applies, for one, to:<\/p>\n\n\n\n

    a) maintenance organizations (\"Part-145 organization\", technical maintenance of aircraft) <\/p>\n\n\n\n

    b) continuing airworthiness management organizations (\"CAMO organization\", monitoring aircraft maintenance activities) <\/p>\n\n\n\n

    c) air operators subject to Annex III (Part-ORO) to Regulation (EU) No 965\/2012 (\u201cAOCs\u201d, i.e. companies that hold an Air Operators Certificate and are able to carry out flight operations on the basis of this)<\/p>\n\n\n\n

    d) approved training organizations (ATOs) <\/p>\n\n\n\n

    e) aircrew aero-medical centers <\/p>\n\n\n\n

    f) flight simulation training device (FSTD) operators (exception for exclusively theoretical training)<\/p>\n\n\n\n

    g) air traffic controller training organizations (ATCO TOs) and ATCO aero-medical centres<\/p>\n\n\n\n

    h) organizations subject to Annex III (Part-ATM\/ANS.OR) to Implementing Regulation (EU) 2017\/373 (these are providers of \u201cAir Traffic Management\u201d and \u201cAir Navigation Systems\u201d, with restrictions, for example, on air traffic in connection with drones)<\/p>\n\n\n\n

    In addition to these organizations, the relevant authorities, such as the EASA or the LBA in Germany, must also implement Part-IS.<\/p>\n\n\n\n

    The \u201cCommission Delegated Regulation (EU) 2022\/1645\u201d applies to manufacturing and design organizations, as well as aerodrome operators and providers of apron control services.<\/p>\n\n\n\n

    The audit activities that the relevant authorities already carry out with regard to applicable aviation requirements are extended to include Part-IS.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    4. What are the main requirements of Part-IS?<\/h2>\n\n\n\n

    Requirement IS.I.OR.240 Requirements for personnel<\/h3>\n\n\n\n

    Part-IS requires the establishment of a new role, the so-called \u201cAppointed Person Information Security\u201d, which is responsible for compliance with the requirements in the organization. There is also the option of designating a group as APIS. This person is responsible for everything required in Part-IS with regard to InfoSec and represents Part-IS compliance to the authorities. Alternatively, for more complex organizational structures, there is the option of designating a \u201cCommon Responsible Person\u201d who can take on this role across organizations.<\/p>\n\n\n\n

    In addition to the \u201cAPIS\u201d, Part-IS requires other already known roles such as those of the Accountable Manager or the Compliance Monitoring Manager.<\/p>\n\n\n\n

    Requirements IS.I.OR.205 Assessment of the information security risk and IS.I.OR.210 Dealing with the information security risk<\/h3>\n\n\n\n

    The most elaborate requirement is probably the one for risk management. As is usual in an ISMS, information security risks should be identified, evaluated and treated. A specialty of Part-IS is that this must be based on a comprehensive asset inventory. Specifically, the organizations should \u201cidentify all elements [\u2026] that could be exposed to information security risks.\u201d This includes:<\/p>\n\n\n\n

    1. the organization's activities<\/strong>, facilities<\/strong> and resources<\/strong>, as well as the services<\/strong> the organization operates, provides, maintains or upholds;<\/p>\n\n\n\n

    2. the equipment,<\/strong> systems,<\/strong> data<\/strong> and information<\/strong> needed for the elements listed in item 1 to function.<\/p>\n\n\n\n

    3. the interfaces<\/strong> between organizations that could lead to them being exposed to each other's information security risks.<\/p>\n\n\n\n

    Finally, for Part-IS, this requires a special consideration of information security risks that could have a negative impact on the safety of flight operations.<\/p>\n\n\n\n

    Requirement IS.I.OR.250 Information Security Management Manual (ISMM)<\/h3>\n\n\n\n

    Another requirement that is indispensable for Part-IS compliance is the \u201cInformation Security Management Manual\u201d (ISMM). This is where all roles, responsibilities and core processes of the implemented Part-IS ISMS are documented. Part-IS strictly defines which aspects must be included in the ISMM. The ISMM ultimately serves as proof of compliance, which must be presented to the relevant authorities as proof that Part-IS has been implemented. <\/p>\n\n\n\n

    It is possible to incorporate the contents of the ISMM into existing manuals required under aviation law, such as an approved safety management manual for an approved aviation company.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    5. What impact does Part-IS have on the processes in the company? <\/h2>\n\n\n\n

    In principle, the existing processes of organizations regulated under aviation law must be expanded to include the management of information security risks. The legal text fits into the existing requirements and ties in with many familiar aspects, for example in the requirements for internal and external reporting or in the specifications for compliance monitoring management (internal audit system).<\/p>\n\n\n\n

    The difficulty is that Part-IS forces organizations to consider not only safety in the sense of operational safety, but also information security issues. In this context, Part-IS is primarily concerned with intentional or illegal acts that deliberately endanger the life and limb of people. The exclusive assumption of intentional and malicious acts represents a certain change in mindset when considering risks in aviation safety.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    6. How does an ISMS according to Part-IS differ from an ISMS according to ISO 27001?<\/h2>\n\n\n\n