EASA Implementing Regulation 2023/203 — Part IS CA — has been active since January 2023. Its November 2025 amendment extended Information Security Management System (ISMS) requirements beyond formally approved organizations to organizations operating under declaration — broadening the scope to include a significantly larger population of maintenance organizations, design organizations, and aerodrome operators. The sassofia.com May 2026 regulatory update confirmed the scope of this extension: „By amending several foundational regulations (including 1178/2011, 748/2012, 965/2012, 139/2014, and 1321/2014), this act harmonizes information security protocols across the entire aviation value chain.“
For quality managers in Part 145 maintenance organizations and Part 21 production approval holders: if your organization has not implemented a documented ISMS consistent with 2023/203 requirements, you are operating with a regulatory compliance gap that your next competent authority surveillance audit will identify. The requirement is not optional and it is not deferred — it is active.
1. What 2023/203 Actually Requires
The regulation requires aviation organizations to identify and manage information security risks that could impact aviation safety. The key word is „safety-relevant“ — 2023/203 is not an IT security regulation in the conventional sense. It is a safety management regulation that addresses cybersecurity threats as a category of safety risk. The ISMS required under 2023/203 must cover:
Information security risk assessment. Identification of information assets — systems, data, processes — whose compromise could affect the organization’s ability to maintain airworthy products or conduct safe operations. For a Part 145 organization, this includes: maintenance management systems, airworthiness documentation systems, tooling calibration databases, parts traceability systems, and communication systems used for technical data exchange with customers and regulatory authorities.
Risk-proportionate controls. Access controls, authentication requirements, network security, patch management, and backup and recovery procedures proportionate to the identified risks. The regulation does not mandate specific technical standards — it requires a risk-based approach documented in the organization’s Maintenance Organization Exposition or equivalent quality system documentation.
Incident detection and reporting. Procedures for detecting information security events, assessing whether they constitute incidents with safety relevance, and reporting to the competent authority where required. This is the interface between 2023/203 and Regulation 376/2014 on occurrence reporting — a cybersecurity incident that affects airworthiness data integrity is potentially a reportable occurrence.
Supplier and third-party management. Assessment of information security risks arising from third-party access to your information systems — including software vendors with remote access to maintenance systems, cloud service providers hosting quality data, and customers with direct system access for technical data exchange. This is the supply chain dimension of 2023/203 that most organizations have not yet addressed systematically.
2. The Interface with IA9100
IA9100’s cybersecurity integration requirement at Clause 8.1 — mandatory for aerospace quality management systems when the standard publishes — directly overlaps with 2023/203. The IAQG Key Change Summary identifies information security as one of six named areas of substantive change. The audit evidence expected: governance structures, threat assessment covering ERP systems, CAD and quality data storage, remote access infrastructure, and incident response procedures linked to quality records.
An organization that builds its ISMS to satisfy 2023/203 requirements now will have the implementation evidence required for an IA9100 transition audit when that transition begins. The organizations that have not started are facing two parallel implementation requirements — regulatory and standards — in a compressed timeline.
3. What a 2023/203-Compliant ISMS Looks Like in Practice
For a mid-market Part 145 organization, the minimum viable ISMS consistent with 2023/203 requirements covers five documented elements: an information asset inventory identifying all systems and data relevant to maintenance safety, a risk assessment documenting identified threats and their potential safety impact, a control set proportionate to the identified risks with implementation evidence, an incident response procedure with clear escalation and reporting paths, and a supplier/third-party assessment process. None of these elements require ISO 27001 certification — they require documented, implemented, and auditable processes.
3 Concrete Actions
1. If your organization has not conducted an information security risk assessment consistent with 2023/203 requirements, prioritize this before your next competent authority surveillance audit. The risk assessment is the foundation of the ISMS — without it, the other elements cannot be developed coherently. Scope the assessment specifically to safety-relevant information assets: systems whose compromise could affect airworthiness documentation, parts traceability, or maintenance record integrity.
2. Review your Maintenance Organization Exposition or equivalent quality system documentation for cybersecurity content. A reference to „IT security policy managed by the IT department“ is not sufficient for 2023/203 compliance. The MOE must reflect an integrated ISMS with safety-relevant scope, documented risk assessment, and defined incident response procedures linked to the occurrence reporting framework under 376/2014.
3. Extend your supplier qualification process to include information security assessment for suppliers with access to your safety-relevant systems. The assessment does not need to be an ISO 27001 audit — it needs to verify that the supplier has implemented proportionate access controls, has an incident notification process, and understands which data they access qualifies as safety-relevant under 2023/203. This assessment should be documented and retained as part of the supplier qualification record.
👉 Request a Technical Consultation → www.skqc.org
Sources
- European Commission — Implementing Regulation (EU) 2023/203 Part IS CA: Information Security Requirements, eur-lex.europa.eu
- European Commission — Delegated Regulation (EU) 2022/1645 Part IS IA: Information Security Requirements, eur-lex.europa.eu
- sassofia.com — EASA Part 145 Regulatory Update May 2026, sassofia.com
- EASA — AMC and GM to Part-IS.I.OR and Part-IS.D.OR, easa.europa.eu
- EASA — AMC/GM Acceptable Means of Compliance to Regulation (EU) 2022/1645 and 2023/203, easa.europa.eu
- IAQG — IA9100 Key Change Summary: Cybersecurity Integration (Clause 8.1), iaqg.org
- European Parliament and Council — Regulation (EU) 376/2014 on Occurrence Reporting in Civil Aviation, eur-lex.europa.eu
#EASACybersecurity #Part145 #Part21 #ISMS #AviationSafety #QualityManagement #InformationSecurity #IA9100 #SKQC