Safety is not an option, Part-IS

The talk introduces Part-IS, the European Union Aviation Safety Agency's horizontal regulation for information security in aviation. The speaker frames it as a safety regulation first, so the question is how an information security failure could lead to an unacceptable safety outcome. Recent incidents are used as examples, including a baggage system outage at several European airports and widespread GPS spoofing over the Baltic region. The regulation draws heavily on ISO 27001 concepts with a safety twist, and the first compliance date for airlines and operators was 22 February 2026.

The middle section walks through the key elements. Organizations need named responsibilities, documented policies and procedures, and an inventory of safety-critical ground systems such as weight and balance tooling. Risk assessments link information security threats to failure conditions through a bow-tie view. Incident reporting timelines are still being negotiated, and the speaker argues that three months is too short for fixes that require recertification. The talk also covers overlaps with NIST 2 and aviation security, and the difficulty small operators face in meeting the requirements.

The final section covers who can audit. Auditors must come from entities qualified under EASA or national authorities, with strict conflict-of-interest rules and auditor skills spanning information security and aviation safety. Audits review the information security management manual, the risk register and staff interviews, and findings are graded by level, where a level one finding would stop operations. The speaker closes by noting that the operating-effectiveness phase is still undefined, and that auditors can feed back to regulators to help shape it.