Welcome

Become a member or log in to the aviation community

This community is for aviation enthusiast to meet and share their passion. Keep yourself updated and share the latest news & events.

Newest communities
in the EASA community

Cybersecurity

Public community · 10424 members

Air Operations

Public community · 25183 members

Join your community

Join a community to be part of the discussion.

Vasileios PAPAGEORGIOU commented on a post in Cybersecurity

8 months ago

Sheena Miller

8 months ago Public

Hi everyone, very useful workshop on part IS last week. With regard to the Derogation discussion, I have been through the Assessment tool (very useful, thank you!) and believe we can apply for a derogation. The Implementation Guidelines say there should be a "derogation application form template" which will include a high level risk assessment. I know there was a lot of discussion about derogation so I may have missed it but I cannot find a time scale for the form's development or where it will be posted when available. Can anyone assist me? -

Vasileios PAPAGEORGIOU • 8 months ago

A new release (Beta v2) has been uploaded on Github:
https://github.com/Mario1645PartIS/Part-IS-compliance-tool/blob/main/As…

As Mario mentioned in another comment, this is the release of the second BETA Test Release for the Compliance Assessment tool. It is fully functional in "Compliance" and "Maturity" mode.

The assessment questions from the EASA guidance material "Part-IS oversight approach" are fully inserted for all requirements.

In addition, an additional statistics column was entered to completion rate table. The "non-compliant" column shows the percentage of requirements, non-compliant in the assessment. The structure and the questions can be adapted to individual needs by selecting the "developer mode".

Show all 2 comments

Philip Ribeiro commented on a post in Cybersecurity

9 months ago

Thomas Dall Pedersen

10 months ago Public

Hi all

Do you know why EASA has elected to use the word "appoint" and not "nominate" in the selection of the person/group being responsible for the ISMS?
I'm referring to IS.I.OR.240(b) Personnel requirements.

I've been through the video from the EASA Part-IS workshop in November '24 and on day 1 at timestamp 5:34:00, Gerrit Neubauer asks if there is any difference from authority perspective between a "nominated person" and a "appointed person".
To this question, Angeliki Karakoliou from EASA replies, that they consider it as being the same.

But, why not just use the term "nominated"?
Can I find references for how EASA interpret those terms other places than in the YouTube video?

The reason for my questions, is the way the regulations set requirements for "nominated persons", but not as much for "appointed persons". Unless of course, those two terms are considered the same.
There are many references to "nominated person" like:
In AMC1 ARO.GEN.330 Changes - organisations, the compentent authority must make sure the nominated person is suitable before acceptence.
In ORO.AOC.135 Personnel requirements, a list of "nominated persons" is described, but no mention of ISMS.

How have you interpreted this and do you know how the authorities will interpret it?

Philip Ribeiro • 9 months ago

Interesting, I recently had a chat with a colleague about that.

According to the Cambridge Dictionary APPOINTED means "to choose someone officially for a job or responsibility", that implies a decision that has been made, not pending any approval.

Whereas NOMINATED means "to officially suggest someone for an election, job, position, or honour", implying that that person may or may not get the job, position, pending approval.

Therefore, it shouldn't be seen as "the same", and in the context of Part-IS it seems consistent to "APPOINT a person or group of persons".

Show all 2 comments

Diego Magrini commented on a post in Cybersecurity

9 months ago

Diego Magrini

9 months ago Public

Good afternoon EASA folks!
Could I ask a clarification about 2025/011/ED?

The mapping of competencies at Annex II "A. Part-IS7 training for NAA inspectors" mostly references to Part-IS.AR. However NAA's inspectors will audit organisations, therefore reference should be to Part-IS.I.OR and .D.OR.

Am I missing anything?

Diego Magrini • 9 months ago

I disagree.

I believe the spirit of the ED is to have NAA Inspectors trained on auditing the implementation of Part-IS witin organisations, not to audit the internal implementation within NAAs.

That will most probably be the first requirement, as Part-IS.D.OR becomes applicable before Part-IS.AR.

For example, point number 3 reads:
"Evaluate how an organisation has identified and documented the aviation safety relevant assets that are in the ISMS scope."
It specifically talks about an organisation implementation, and yet it is mapped to IS.AR.205(a)(b)

IS.AR.205(a) reads "The competent authority shall identify all the elements of its own organisation [...]"
So it has nothing to do with "Evaluate how an organisation has [...]".

This is a common misconception I encounter when talking to NAAs, so I am not surprised to see it. However, I think it should be corrected for the sake of clarity.

Or at least, there should be no reference to AR/OR when the requirements are identical in AR and OR.
Or there should be two mappings, one for NAA inspectors auditing Organisations (under D.OR or I.OR) and one for NAA inspectors auditing Authorities (under AR).

Show all 2 comments