FAQ n.143743

If a derogation has been granted, it should be because no risks impacting aviation safety have been identified within the organisation or at the interfaces during the documented risk assessment. 

Derogated organisations should explicitly communicate their 'derogated' status to any present functional chain interfaces, i.e. the organisation's lack of an ISMS under Part-IS requirements. This should also take place every time they are assessed as an interface by a new organisation. This should encourage the interfaced organisations in question to perform a diligent analysis and monitor any changes, through their ISMS.