PART-IS is one of the most important changes in European aviation regulation because it treats information security as a safety issue, not only as an IT issue. In modern aviation, operational data, maintenance records, flight planning systems, air traffic services, training systems and connected platforms all depend on trustworthy information. If that information is unavailable, manipulated, disclosed or disrupted, the consequence may no longer be only technical. It may become operational and safety-critical.
What is PART-IS?
PART-IS stands for Information Security. It is the EASA regulatory framework for managing information-security risks that could have an impact on aviation safety. The key phrase is “with potential impact on aviation safety.” This means PART-IS is not a generic cybersecurity checklist. It is a safety-driven management-system requirement for aviation organisations and competent authorities.
Why aviation needs PART-IS
Aviation has become a highly digital ecosystem. Airlines, airports, maintenance organisations, air navigation service providers, U-space service providers, design organisations, production organisations and authorities all rely on information systems. These systems exchange data across organisational boundaries. That creates efficiency, but also new dependencies.
A compromised system can affect flight planning, crew scheduling, maintenance decisions, continuing airworthiness, aerodrome operations, ATM/ANS services or drone and U-space operations. PART-IS exists to make sure organisations understand these risks, manage them proportionately and connect information security with aviation safety governance.
PART-IS is not just cybersecurity
The word “information security” is deliberate. Cybersecurity usually focuses on digital threats, but PART-IS is broader. It covers information and communication technology systems and data used for civil aviation purposes. The risk may come from cyberattack, human error, weak access control, poor supplier management, system failure, data corruption or inadequate incident response.
This is why PART-IS should not be owned only by the IT department. IT is essential, but the regulation belongs to the aviation management system. Safety managers, compliance managers, accountable managers, operational leaders and security specialists all need to understand how information-security risks can create safety consequences.
The core requirement: an ISMS
The practical heart of PART-IS is the Information Security Management System, or ISMS. Each organisation must define the scope of its ISMS, identify information-security risks, assess their aviation-safety impact, treat those risks, assign responsibilities, manage incidents and continuously improve the system.
For many organisations, this will look familiar because it follows the logic of safety management: identify hazards, assess risk, apply mitigations, monitor performance and improve. The difference is that the hazard source is information security. A corrupted maintenance record, unavailable operational system, compromised interface or manipulated flight-data input can become part of the safety-risk picture.
What organisations should prepare
A practical PART-IS implementation should begin with scope. Which systems, data flows, suppliers, platforms and interfaces could affect aviation safety if confidentiality, integrity, availability or authenticity were compromised? Once the scope is clear, the organisation can build a risk register, define controls, establish reporting channels and connect the ISMS with existing safety and compliance processes.
Important preparation areas include information-security policy, risk assessment methodology, incident detection and response, internal reporting, external reporting, supplier and contracted-activity management, staff competence, compliance monitoring and continuous improvement.
PART-IS and ISO 27001
Organisations already certified to ISO/IEC 27001 have a useful foundation, but ISO 27001 is not automatically enough. PART-IS adds the aviation-safety lens. The question is not only whether information is protected. The question is whether the organisation can show that information-security risks with a possible safety impact are identified, assessed, treated, reported and overseen within the aviation regulatory context.
PART-IS and NIS2
PART-IS also needs to be understood separately from NIS2. NIS2 is a broad EU cybersecurity framework for essential and important entities. PART-IS is aviation-specific and focuses on information-security risks that could affect aviation safety. Compliance with one framework should not be assumed to automatically prove compliance with the other. Aviation organisations may need to map both frameworks carefully and avoid duplicate work while still meeting each obligation.
Why this matters for drones and U-space
PART-IS is especially relevant to unmanned aviation and U-space because these operations depend heavily on data exchange. Flight authorisations, network identification, conformance monitoring, geofencing, U-space services, communication links and digital traffic coordination all depend on trusted information. In this environment, information security becomes part of airspace safety.
A U-space service provider, drone operator or aviation-data service cannot treat cybersecurity as a background function. If operational data is delayed, manipulated or unavailable, the safety picture changes. PART-IS helps push the industry toward stronger governance for these digital dependencies.
Conclusion
PART-IS is a signal that aviation safety is becoming inseparable from information security. The regulation does not ask organisations to buy a single tool or install a single system. It asks them to understand their information-security risks, manage them through a structured ISMS, report incidents, learn from events and continuously improve.
For panka.pl readers, the key takeaway is simple: aviation cybersecurity is no longer only about protecting networks. It is about protecting the safety function of information. In connected aviation, safe flight depends on trusted data, resilient systems and clear accountability.