EASA Part-IS: Aviation ISMS, Present & Suitable

Including Part-145 and CAMO organisations (except Part-ML-only), certain air operators (Part-ORO), ATOs, aero-medical centres, FSTD operators, ATM/ANS, U-space, design and production (Part 21), aerodromes and apron management, plus certain declared organisations (NCC, SPO, apron, ground handling). Out of scope include DTOs, Part-ML-only organisations and declared DOA holders. ELA2 exemptions apply. Check Article 2 of each regulation.

Present, Suitable, Operating and Effective. By the applicability date, the organisation must have established the ISMS foundation (Present and Suitable) and start operating it. Part-IS compliance is recognised when the authority also concludes Operating. Effective is continuous improvement (IS.OR.260); no specific maturity level is mandated.

16 October 2025 for organisations under Delegated Regulation (EU) 2022/1645 (design, production, aerodromes). 22 February 2026 for those under Implementing Regulation (EU) 2023/203 (maintenance, CAMO, operators, ATM/ANS, etc.) and for authority requirements (Part-IS.AR). Both deadlines have passed: the focus is now on operating the ISMS and reaching the Operating level.

No. An ISO 27001 ISMS can be adapted, but Part-IS adds aviation-safety-specific requirements. Part-IS is not a lex specialis under NIS2: an organisation may need to comply with both. NIS2 compliance does not automatically mean Part-IS compliance; equivalence in effect is verified by the competent authority.

Yes. The Part-IS framework is part of the multi-framework compliance module, with FR/EN audit questionnaires aligned to Present and Suitable criteria (competent-authority / Part-IS TF G-03 checklists), NIST 800-53 control mappings, and an evidence register shared with ISO 27001 or NIS2.