Part-IS Is Here. Is Your ISMS Working?

Part-IS is the EASA framework mandating cyber security controls to safeguard flight safety - digital vulnerabilities are treated as critical airworthiness risks. It became applicable on 16 October 2025 for aerodrome operators and design and production organisations, and on 22 February 2026 for airlines, Part-145 maintenance organisations, CAMOs and approved training organisations.

Standard IT providers understand data security but not flight safety. A generic checklist doesn't account for continuing airworthiness management systems, flight planning tools or EASA reporting requirements. Our partnership with Maor Compliance merges EASA and IOSA auditing background with information security engineering, so the controls protect the operation rather than just the network.

Part-IS requires you to build an ISMS. ISO 27001 is the leading international standard for exactly that, so aligning the two gives you a globally recognised framework for work you have to do anyway. We use a dual-scope approach to build one ISMS that satisfies both your national aviation authority and an ISO 27001 certification body.

Yes. Under EASA guidelines these functions can be contracted to external specialists. Ultimate accountability remains with your Accountable Manager, but the joint Dalton Aero and Maor team can handle the gap analysis, design the security manual, manage risk assessments and conduct the internal audits.

Non-compliance can affect your operational approvals. Your authority may issue formal findings, mandate corrective actions, or restrict approvals where a system lacks active risk management, monitoring or staff training. The work is in producing audit-ready evidence before the inspection, not after it.

Typically three to nine months, depending on your existing IT infrastructure and the size of the organisation - a small CAMO moves faster than a large maintenance group. Aviation-specific risk templates and delivery frameworks shorten it considerably.