Is the derogation provision under point IS.D.OR.200(e) or point IS.I.OR.200(e) linked to the flexibility provisions of Article 71 of the Basic Regulation?
Is the derogation provision under point IS.D.OR.200(e) or point IS.I.OR.200(e) linked to the flexibility provisions of Article 71 of the Basic Regulation?
Answer
Point IS.D.OR.200(e) of the Annex (Part-IS.D.OR) to Commission Delegated Regulation (EU) 2022/1645 or IS.I.OR.200(e) of Annex II (Part-IS.I.OR) to Commission Implementing Regulation (EU) 2023/203 provide for a self-contained derogation possibility which can be used independently of Article 71. Those points allow an organisation to be temporarily exempted from implementing an information security management system, provided that its activities, facilities, resources, and services do not pose any information security risks that could affect aviation safety. Therefore, the two are not linked.
Last updated
22/08/2025