Part-IS: cybersecurity is no longer optional, it is a regulatory obligation

24 Septembre 2026

The EASA Part-IS regulation (EU 2023/203) has applied since 22 February 2026 to CAMO and Part-145 organisations. What it requires, and how to secure your airworthiness and maintenance data.

Part-IS: cybersecurity becomes regulatory

Since 22 February 2026, information security has been an enforceable requirement for CAMO and Part-145 organisations. Here is what changes, without unnecessary jargon.

For a long time, cybersecurity was seen as an IT matter, separate from "real" aviation safety. That time is over. With the Part-IS regulation (Implementing Regulation (EU) 2023/203, supplemented by Delegated Regulation 2022/1645), Europe has established a simple principle: a cyber risk that can affect flight safety is a safety risk. To be treated as such.

(Please note: the regulatory section reflects our own reading, for awareness and information purposes only; you must validate with the competent authorities all legal elements specific to your company on this subject.)

Who is concerned, and since when

The deadlines are now behind us – which means the authorities are entering the inspection phase:

16 October 2025: design and production organisations (Part-21), aerodromes… (via 2022/1645).
22 February 2026: most operational players via 2023/203 – continuing airworthiness management organisations (CAMO), Part-145 maintenance organisations, operators, training organisations.

Over the following twelve months, national authorities carry out their first "cyber" audits. In other words: the question is no longer "should we start?" but "are you ready to demonstrate it?".

Light aircraft and special cases. Exemptions exist (notably for organisations handling only ELA1/ELA2 aircraft). And for military activities – State drones or helicopters – the applicable framework comes under the military authorities (EMAR/national logic) rather than EASA. The "cyber = safety" principle, however, applies everywhere: customers increasingly require it, whatever the status.

What Part-IS concretely requires

The core of the system is an information security management system (ISMS) integrated into your safety management system (SMS). In practice, this means being able to answer four questions:

What must I protect? Identify critical information assets – airworthiness records, maintenance data, workshop computers and tablets, access accounts, exchanges with OEMs.
What are my risks? Assess the threats which, through these assets, could degrade safety (alteration of a record, unavailability of a system, leak).
How do I protect myself and react? Risk-reduction measures, incident detection and response, with notification where required.
How do I prove it? Documented policies, designated roles, staff training, traceability – enough to stand up to an audit.

Note: an ISO 27001 certification is an excellent foundation, but it is not sufficient in itself – Part-IS requires the explicit link with aviation safety that the generic standard does not make.

The direct link with your traceability tool

A large share of a CAMO/MRO's "critical assets" is precisely the data you manage every day: the integrity of the airworthiness record, the authenticity of a signature, the audit trail of a change, control of access. Business software designed for security – controlled hosting (cloud or on premise), fine-grained rights management, logging, tested backups – does not "do" your Part-IS compliance for you, but it is a concrete, demonstrable building block of it.

Where to start

No need to do everything at once. The realistic approach: map your data assets, identify the 2–3 major risks, lock down access and backups, write down what you do and train your teams. The rest is built over time and audited.

Where do you stand on the security of your airworthiness data? Let's take stock.

👉 Talk to a TracingFlight adviser