What tool should be used to report information security incidents?
Answer
In Part-IS, the requirements for internal reporting (point IS.I.OR.215 (a) and (b) of Annex II (Part-IS.I.OR) to Commission Implementing Regulation (EU) 2023/203 and point IS.D.OR.215 (a) and (b) of the Annex (Part-IS.D.OR) to Commission Delegated Regulation (EU) 2022/1645) and for external reporting (point IS.I.OR.230 (a) and (b) of Part-IS.I.OR and point IS.D.OR.215 (a) and (b) of Part-IS.D.OR) do not specify a particular reporting tool, leaving this at the discretion of the organisations. However, according to point IS.OR.230(a) and Article 7 of Regulation (EU) No 376/2014 (Occurrence Reporting), to facilitate information exchange, occurrence reports should be stored in databases which should be compatible with the ECCAIRS-2, the EASA/European Commission reporting tool.