urn: urn:intuitem:risk:library:part-is.d.or
locale: en
ref_id: EASA-PART-IS.D.OR
name: PART-IS.D.OR (Delegated Regulation (EU) 2022/1645)
description: "COMMISSION DELEGATED REGULATION (EU) 2022/1645 of 14 July 2022 laying\
  \ down rules for the application of Regulation (EU) 2018/1139 of the European Parliament\
  \ and of the Council, as regards requirements for the management of information\
  \ security risks with a potential impact on aviation safety for organisations covered\
  \ by Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 and amending Commission\
  \ Regulations (EU) No 748/2012 and (EU) No 139/2014\n\nHere is the link to the delegated\
  \ regulation : \nhttps://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R1645"
copyright: EU COMMISSION
version: 1
publication_date: 2024-08-12
provider: EU COMMISSION
packager: intuitem
objects:
  framework:
    urn: urn:intuitem:risk:framework:part-is.d.or
    ref_id: EASA-PART-IS.D.OR
    name: PART-IS.D.OR (Delegated Regulation (EU) 2022/1645)
    description: "\"COMMISSION DELEGATED REGULATION (EU) 2022/1645 of 14 July 2022\
      \ laying down rules for the application of Regulation (EU) 2018/1139 of the\
      \ European Parliament and of the Council, as regards requirements for the management\
      \ of information security risks with a potential impact on aviation safety for\
      \ organisations covered by Commission Regulations (EU) No 748/2012 and (EU)\
      \ No 139/2014 and amending Commission Regulations (EU) No 748/2012 and (EU)\
      \ No 139/2014\n\nHere is the link to the delegated regulation : \nhttps://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R1645\""
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      assessable: false
      depth: 1
      ref_id: ANNEX
      name: "INFORMATION SECURITY \u2013 ORGANISATION REQUIREMENTS"
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.100
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.100
      name: Scope
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.100
      description: This Part establishes the requirements to be met by the organisations
        referred to in Article 2 of this Regulation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.200
      name: Information security management system (ISMS)
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200
      ref_id: IS.D.OR.200-a
      description: 'In order to achieve the objectives set out in Article 1, the organisation
        shall set up, implement and maintain an information security management system
        (ISMS) which ensures that the organisation:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.1
      description: establishes a policy on information security setting out the overall
        principles of the organisation with regard to the potential impact of information
        security risks on aviation safety;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.2
      description: identifies and reviews information security risks in accordance
        with point IS.D.OR.205;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.3
      description: defines and implements information security risk treatment measures
        in accordance with point IS.D.OR.210;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.4
      description: implements an information security internal reporting scheme in
        accordance with point IS.D.OR.215;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.5
      description: defines and implements, in accordance with point IS.D.OR.220, the
        measures required to detect information security events, identifies those
        events which are considered incidents with a potential impact on aviation
        safety except as permitted by point IS.D.OR.205(e), and responds to, and recovers
        from, those information security incidents;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.6
      description: implements the measures that have been notified by the competent
        authority as an immediate reaction to an information security incident or
        vulnerability with an impact on aviation safety;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.7
      description: takes appropriate action, in accordance with point IS.D.OR.225,
        to address findings notified by the competent authority;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.8
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.8
      description: implements an external reporting scheme in accordance with point
        IS.D.OR.230 in order to enable the competent authority to take appropriate
        actions;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.9
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.9
      description: complies with the requirements contained in point IS.D.OR.235 when
        contracting any part of the activities referred to in point IS.D.OR.200 to
        other organisations;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.10
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.10
      description: complies with the personnel requirements laid down in point IS.D.OR.240;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.11
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.11
      description: complies with the record-keeping requirements laid down in point
        IS.D.OR.245;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.12
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.12
      description: monitors compliance of the organisation with the requirements of
        this Regulation and provides feedback on findings to the accountable manager
        or, in the case of design organisations, to the head of the design organisation,
        in order to ensure effective implementation of corrective actions;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a.13
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-a
      ref_id: IS.D.OR.200-a.13
      description: protects, without prejudice to applicable incident reporting requirements,
        the confidentiality of any information that the organisation may have received
        from other organisations, according to its level of sensitivity.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200
      ref_id: IS.D.OR.200-b
      description: In order to continuously meet the requirements referred to in Article
        1, the organisation shall implement a continuous improvement process in accordance
        with point IS.D.OR.260.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-c
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200
      ref_id: IS.D.OR.200-c
      description: The organisation shall document, in accordance with point IS.D.OR.250,
        all key processes, procedures, roles and responsibilities required to comply
        with point IS.D.OR.200(a) and establish a process for amending that documentation.
        Changes to those processes, procedures, roles and responsibilities shall be
        managed in accordance with point IS.D.OR.255.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-d
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200
      ref_id: IS.D.OR.200-d
      description: The processes, procedures, roles and responsibilities established
        by the organisation in order to comply with point IS.D. OR.200(a) shall correspond
        to the nature and complexity of its activities, based on an assessment of
        the information security risks inherent to those activities, and may be integrated
        within other existing management systems already implemented by the organisation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200-e
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200
      ref_id: IS.D.OR.200-e
      description: Without prejudice to the obligation to comply with the reporting
        requirements contained in Regulation (EU) No 376/2014 of the European Parliament
        and of the Council (1) and the requirements of point IS.D.OR.200 (a) (13),
        the organisation may be granted approval by the competent authority not to
        implement the requirements referred to in points (a) to (d)) and the related
        requirements contained in points IS.D.OR.205 through IS.D.OR.260, if it demonstrates
        to the satisfaction of that authority that its activities, facilities and
        resources, as well as the services it operates, provides, receives and maintains,
        do not pose any information security risks with a potential impact on aviation
        safety neither to itself nor to other organisations. The approval shall be
        based on a documented information security risk assessment carried out by
        the organisation or a third party in accordance with point IS.D.OR.205 and
        reviewed and approved by its competent authority.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node24
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.200
      description: The continued validity of that approval will be reviewed by the
        competent authority following the applicable oversight audit cycle and whenever
        changes are implemented in the scope of work of the organisation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.205
      name: Information security risk assessment
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-a
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205
      ref_id: IS.D.OR.205-a
      description: 'The organisation shall identify all of its elements, which could
        be exposed to information security risks. That shall include:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-a.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-a
      ref_id: IS.D.OR.205-a.1
      description: "the organisation\u2019s activities, facilities and resources,\
        \ as well as the services the organisation operates, provides, receives or\
        \ maintains;"
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-a.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-a
      ref_id: IS.D.OR.205-a.2
      description: the equipment, systems, data and information that contribute to
        the functioning of the elements listed in point (1).
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205
      ref_id: IS.D.OR.205-b
      description: The organisation shall identify the interfaces that it has with
        other organisations, and which could result in the mutual exposure to information
        security risks.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-c
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205
      ref_id: IS.D.OR.205-c
      description: 'With regard to the elements and interfaces referred to in points
        (a) and (b), the organisation shall identify the information security risks
        which may have a potential impact on aviation safety. For each identified
        risk, the organisation shall:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-c.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-c
      ref_id: IS.D.OR.205-c.1
      description: assign a risk level according to a predefined classification established
        by the organisation;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-c.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-c
      ref_id: IS.D.OR.205-c.2
      description: associate each risk and its level with the corresponding element
        or interface identified in accordance with points (a) and (b).
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node33
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205
      description: The predefined classification referred to in point (1) shall take
        into account the potential of occurrence of the threat scenario and the severity
        of its safety consequences. Based on that classification, and taking into
        account whether the organisation has a structured and repeatable risk management
        process for operations, the organisation shall be able to establish whether
        the risk is acceptable or needs to be treated in accordance with point IS.D.OR.210.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node34
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205
      description: In order to facilitate the mutual comparability of risks assessments,
        the assignment of the risk level pursuant to point (1) shall take into account
        relevant information acquired in coordination with the organisations referred
        to in point (b).
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-d
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205
      ref_id: IS.D.OR.205-d
      description: 'The organisation shall review and update the risk assessment carried
        out in accordance with points (a), (b) and (c) in any of the following situations:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-d.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-d
      ref_id: IS.D.OR.205-d.1
      description: ' there is a change in the elements subject to information security
        risks;'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-d.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-d
      ref_id: IS.D.OR.205-d.2
      description: ' there is a change in the interfaces between the organisation
        and other organisations, or in the risks communicated by the other organisations;'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-d.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-d
      ref_id: IS.D.OR.205-d.3
      description: ' there is a change in the information or knowledge used for the
        identification, analysis and classification of risks;'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-d.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.205-d
      ref_id: IS.D.OR.205-d.4
      description: ' there are lessons learnt from the analysis of information security
        incidents.'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.210
      name: ' Information security risk treatment'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210
      ref_id: IS.D.OR.210-a
      description: 'The organisation shall develop measures to address unacceptable
        risks identified in accordance with point IS.D. OR.205, implement them in
        a timely manner and check their continued effectiveness. Those measures shall
        enable the organisation to:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210-a.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210-a
      ref_id: IS.D.OR.210-a.1
      description: control the circumstances that contribute to the effective occurrence
        of the threat scenario;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210-a.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210-a
      ref_id: IS.D.OR.210-a.2
      description: reduce the consequences on aviation safety associated with the
        materialisation of the threat scenario;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210-a.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210-a
      ref_id: IS.D.OR.210-a.3
      description: avoid the risks.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node45
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210-a
      description: Those measures shall not introduce any new potential unacceptable
        risks to aviation safety.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210
      ref_id: IS.D.OR.210-b
      description: The person referred to in point IS.D.OR.240 (a) and (b) and other
        affected personnel of the organisation shall be informed of the outcome of
        the risk assessment carried out in accordance with point IS.D.OR.205, the
        corresponding threat scenarios and the measures to be implemented.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node47
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.210
      description: The organisation shall also inform organisations with which it
        has an interface in accordance with point IS.D.OR.205 (b) of any risk shared
        between both organisations.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.215
      name: Information security internal reporting scheme
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215
      ref_id: IS.D.OR.215-a
      description: The organisation shall establish an internal reporting scheme to
        enable the collection and evaluation of information security events, including
        those to be reported pursuant to point IS.D.OR.230.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215
      ref_id: IS.D.OR.215-b
      description: 'That scheme and the process referred to in point IS.D.OR.220 shall
        enable the organisation to:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-b.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-b
      ref_id: IS.D.OR.215-b.1
      description: identify which of the events reported pursuant to point (a) are
        considered information security incidents or vulnerabilities with a potential
        impact on aviation safety;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-b.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-b
      ref_id: IS.D.OR.215-b.2
      description: identify the causes of, and contributing factors to, the information
        security incidents and vulnerabilities identified in accordance with point
        (1), and address them as part of the information security risk management
        process in accordance with points IS.D.OR.205 and IS.D.OR.220;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-b.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-b
      ref_id: IS.D.OR.215-b.3
      description: ensure an evaluation of all known, relevant information relating
        to the information security incidents and vulnerabilities identified in accordance
        with point (1);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-b.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-b
      ref_id: IS.D.OR.215-b.4
      description: ensure the implementation of a method to distribute internally
        the information as necessary.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-c
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215
      ref_id: IS.D.OR.215-c
      description: Any contracted organisation which may expose the organisation to
        information security risks with a potential impact on aviation safety shall
        be required to report information security events to the organisation. Those
        reports shall be submitted using the procedures established in the specific
        contractual arrangements and shall be evaluated in accordance with point (b).
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-d
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215
      ref_id: IS.D.OR.215-d
      description: The organisation shall cooperate on investigations with any other
        organisation that has a significant contribution to the information security
        of its own activities.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215-e
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.215
      ref_id: IS.D.OR.215-e
      description: The organisation may integrate that reporting scheme with other
        reporting schemes it has already implemented.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.220
      name: "Information security incidents \u2013 detection, response and recovery"
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220
      ref_id: IS.D.OR.220-a
      description: 'Based on the outcome of the risk assessment carried out in accordance
        with point IS.D.OR.205 and the outcome of the risk treatment performed in
        accordance with point IS.D.OR.210, the organisation shall implement measures
        to detect incidents and vulnerabilities that indicate the potential materialisation
        of unacceptable risks and which may have a potential impact on aviation safety.
        Those detection measures shall enable the organisation to:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-a.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-a
      ref_id: IS.D.OR.220-a.1
      description: identify deviations from predetermined functional performance baselines;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-a.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-a
      ref_id: IS.D.OR.220-a.2
      description: trigger warnings to activate proper response measures, in case
        of any deviation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220
      ref_id: IS.D.OR.220-b
      description: 'The organisation shall implement measures to respond to any event
        conditions identified in accordance with point (a) that may develop or have
        developed into an information security incident. Those response measures shall
        enable the organisation to:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-b.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-b
      ref_id: IS.D.OR.220-b.1
      description: initiate the reaction to the warnings referred to in point (a)(2)
        by activating predefined resources and course of actions;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-b.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-b
      ref_id: IS.D.OR.220-b.2
      description: contain the spread of an attack and avoid the full materialisation
        of a threat scenario;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-b.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-b
      ref_id: IS.D.OR.220-b.3
      description: control the failure mode of the affected elements defined in point
        IS.D.OR.205(a).
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-c
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220
      ref_id: IS.D.OR.220-c
      description: 'The organisation shall implement measures aimed at recovering
        from information security incidents, including emergency measures, if needed.
        Those recovery measures shall enable the organisation to:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-c.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-c
      ref_id: IS.D.OR.220-c.1
      description: remove the condition that caused the incident, or constrain it
        to a tolerable level;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-c.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.220-c
      ref_id: IS.D.OR.220-c.2
      description: reach a safe state of the affected elements defined in point IS.D.OR.205(a)
        within a recovery time previously defined by the organisation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.225
      name: Response to findings notified by the competent authority
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225
      ref_id: IS.D.OR.225-a
      description: 'After receipt of the notification of findings submitted by the
        competent authority, the organisation shall:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225-a.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225-a
      ref_id: IS.D.OR.225-a.1
      description: identify the root cause or causes of, and contributing factors
        to, the non-compliance;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225-a.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225-a
      ref_id: IS.D.OR.225-a.2
      description: define a corrective action plan;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225-a.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225-a
      ref_id: IS.D.OR.225-a.3
      description: demonstrate the correction of the non-compliance to the satisfaction
        of the competent authority.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.225
      ref_id: IS.D.OR.225-b
      description: The actions referred to in point (a) shall be carried out within
        the period agreed with the competent authority.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.230
      name: Information security external reporting scheme
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230
      ref_id: IS.D.OR.230-a
      description: The organisation shall implement an information security reporting
        system that complies with the requirements laid down in Regulation (EU) No
        376/2014 and its delegated and implementing acts if that Regulation is applicable
        to the organisation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230
      ref_id: IS.D.OR.230-b
      description: 'Without prejudice to the obligations of Regulation (EU) No 376/2014,
        the organisation shall ensure that any information security incident or vulnerability,
        which may represent a significant risk to aviation safety, is reported to
        their competent authority. Furthermore:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-b.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-b
      ref_id: IS.D.OR.230-b.1
      description: where such an incident or vulnerability affects an aircraft or
        associated system or component, the organisation shall also report it to the
        design approval holder;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-b.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-b
      ref_id: IS.D.OR.230-b.2
      description: where such an incident or vulnerability affects a system or constituent
        used by the organisation, the organisation shall report it to the organisation
        responsible for the design of the system or constituent.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-c
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230
      ref_id: IS.D.OR.230-c
      description: 'The organisation shall report the conditions referred to in point
        (b) as follows:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-c.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-c
      ref_id: IS.D.OR.230-c.1
      description: a notification shall be submitted to the competent authority and,
        if applicable, to the design approval holder or to the organisation responsible
        for the design of the system or constituent, as soon as the condition has
        been known to the organisation;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-c.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-c
      ref_id: IS.D.OR.230-c.2
      description: a report shall be submitted to the competent authority and, if
        applicable, to the design approval holder or to the organisation responsible
        for the design of the system or constituent, as soon as possible, but not
        exceeding 72 hours from the time the condition has been known to the organisation,
        unless exceptional circumstances prevent this.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node83
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-c
      description: The report shall be made in the form defined by the competent authority
        and shall contain all relevant information about the condition known to the
        organisation;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-c.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-c
      ref_id: IS.D.OR.230-c.3
      description: a follow-up report shall be submitted to the competent authority
        and, if applicable, to the design approval holder or to the organisation responsible
        for the design of the system or constituent, providing details of the actions
        the organisation has taken or intends to take to recover from the incident
        and the actions it intends to take to prevent similar information security
        incidents in the future.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node85
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.230-c
      description: The follow-up report shall be submitted as soon as those actions
        have been identified, and shall be produced in the form defined by the competent
        authority.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.235
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.235
      name: Contracting of information security management activities
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.235-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.235
      ref_id: IS.D.OR.235-a
      description: The organisation shall ensure that when contracting any part of
        the activities referred to in point IS.D.OR.200 to other organisations, the
        contracted activities comply with the requirements of this Regulation and
        the contracted organisation works under its oversight. The organisation shall
        ensure that the risks associated with the contracted activities are appropriately
        managed.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.235-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.235
      ref_id: IS.D.OR.235-b
      description: The organisation shall ensure that the competent authority can
        have access upon request to the contracted organisation to determine continued
        compliance with the applicable requirements laid down in this Regulation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.240
      name: Personnel requirements
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      ref_id: IS.D.OR.240-a
      description: 'The accountable manager of the organisation or, in the case of
        design organisations, the head of the design organisation, designated in accordance
        with Regulation (EU) No 748/2012 and Regulation (EU) No 139/2014 as referred
        to in points 1(a) and (b) of Article 2 of this Regulation, shall have corporate
        authority to ensure that all activities required by this Regulation can be
        financed and carried out. That person shall:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-a.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-a
      ref_id: IS.D.OR.240-a.1
      description: ensure that all necessary resources are available to comply with
        the requirements of this Regulation;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-a.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-a
      ref_id: IS.D.OR.240-a.2
      description: establish and promote the information security policy referred
        to in point IS.D.OR.200(a)(1);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-a.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-a
      ref_id: IS.D.OR.240-a.3
      description: demonstrate a basic understanding of this Regulation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      ref_id: IS.D.OR.240-b
      description: The accountable manager or, in the case of design organisations,
        the head of the design organisation, shall appoint a person or group of persons
        to ensure that the organisation is in compliance with the requirements of
        this Regulation, and shall define the extent of their authority. That person
        or group of persons shall report directly to the accountable manager or, in
        the case of design organisations, to the head of the design organisation,
        and shall have the appropriate knowledge, background and experience to discharge
        their responsibilities. It shall be determined in the procedures who deputises
        for a particular person in the case of lengthy absence of that person.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-c
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      ref_id: IS.D.OR.240-c
      description: The accountable manager or, in the case of design organisations,
        the head of the design organisation shall appoint a person or group of persons
        with the responsibility to manage the compliance monitoring function referred
        to in point IS.D.OR.200(a)(12).
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-d
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      ref_id: IS.D.OR.240-d
      description: Where the organisation shares information security organisational
        structures, policies, processes and procedures, with other organisations or
        with areas of their own organisation which are not part of the approval or
        declaration, the accountable manager or, in the case of design organisations,
        the head of the design organisation, may delegate its activities to a common
        responsible person.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node97
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      description: In such a case, coordination measures shall be established between
        the accountable manager of the organisation or, in the case of design organisations,
        the head of the design organisation, and the common responsible person to
        ensure adequate integration of the information security management within
        the organisation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-e
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      ref_id: IS.D.OR.240-e
      description: The accountable manager or the head of the design organisation,
        or the common responsible person referred to in point (d), shall have corporate
        authority to establish and maintain the organisational structures, policies,
        processes and procedures necessary to implement point IS.D.OR.200.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-f
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      ref_id: IS.D.OR.240-f
      description: The organisation shall have a process in place to ensure that they
        have sufficient personnel on duty to carry out the activities covered by this
        Annex.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-g
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      ref_id: IS.D.OR.240-g
      description: The organisation shall have a process in place to ensure that the
        personnel referred to in point (f) have the necessary competence to perform
        their tasks.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-h
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      ref_id: IS.D.OR.240-h
      description: The organisation shall have a process in place to ensure that personnel
        acknowledge the responsibilities associated with the assigned roles and tasks
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240-i
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.240
      ref_id: IS.D.OR.240-i
      description: The organisation shall ensure that the identity and trustworthiness
        of the personnel who have access to information systems and data subject to
        the requirements of this Regulation are appropriately established.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.245
      name: Record-keeping
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245
      ref_id: IS.D.OR.245-a
      description: The organisation shall keep records of its information security
        management activities
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a
      ref_id: IS.D.OR.245-a.1
      description: 'The organisation shall ensure that the following records are archived
        and traceable:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1.i
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1
      ref_id: IS.D.OR.245-a.1.i
      description: any approval received and any associated information security risk
        assessment in accordance with point IS.D.OR.200(e);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1.ii
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1
      ref_id: IS.D.OR.245-a.1.ii
      description: contracts for activities referred to in point IS.D.OR.200(a)(9);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1.iii
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1
      ref_id: IS.D.OR.245-a.1.iii
      description: records of the key processes referred to in point IS.D.OR.200(d);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1.iv
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1
      ref_id: IS.D.OR.245-a.1.iv
      description: records of the risks identified in the risk assessment referred
        to in point IS.D.OR.205 along with the associated risk treatment measures
        referred to in point IS.D.OR.210;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1.v
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1
      ref_id: IS.D.OR.245-a.1.v
      description: records of information security incidents and vulnerabilities reported
        in accordance with the reporting schemes referred to in points IS.D.OR.215
        and IS.D.OR.230;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1.vi
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.1
      ref_id: IS.D.OR.245-a.1.vi
      description: records of those information security events which may need to
        be reassessed to reveal undetected information security incidents or vulnerabilities.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a
      ref_id: IS.D.OR.245-a.2
      description: The records referred to in point (1)(i) shall be retained at least
        until 5 years after the approval has lost its validity.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a
      ref_id: IS.D.OR.245-a.3
      description: The records referred to in point (1)(ii) shall be retained at least
        until 5 years after the contract has been amended or terminated.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a
      ref_id: IS.D.OR.245-a.4
      description: The records referred to in point (1)(iii), (iv) and (v) shall be
        retained at least for a period of 5 years.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-a
      ref_id: IS.D.OR.245-a.5
      description: The records referred to in point (1)(vi) shall be retained until
        those information security events have been reassessed in accordance with
        a periodicity defined in a procedure established by the organisation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245
      ref_id: IS.D.OR.245-b
      description: The organisation shall keep records of qualification and experience
        of its own staff involved in information security management activities
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-b.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-b
      ref_id: IS.D.OR.245-b.1
      description: "The personnel\u2019s qualification and experience records be retained\
        \ for as long as the person works for the organisation, and for at least 3\
        \ years after the person has left the organisation."
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-b.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-b
      ref_id: IS.D.OR.245-b.2
      description: Members of the staff shall, upon their request, be given access
        to their individual records. In addition, upon their request, the organisation
        shall provide them with a copy of their individual records on leaving the
        organisation.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-c
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245
      ref_id: IS.D.OR.245-c
      description: "The format of the records shall be specified in the organisation\u2019\
        s procedures."
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245-d
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.245
      ref_id: IS.D.OR.245-d
      description: Records shall be stored in a manner that ensures protection from
        damage, alteration and theft, with information being identified, when required,
        according to its security classification level. The organisation shall ensure
        that the records are stored using means to ensure integrity, authenticity
        and authorised access.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.250
      name: Information security management manual (ISMM)
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250
      ref_id: IS.D.OR.250-a
      description: 'The organisation shall make available to the competent authority
        an information security management manual (ISMM) and, where applicable, any
        referenced associated manuals and procedures, containing:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.1
      description: a statement signed by the accountable manager or, in the case of
        design organisations, by the head of the design organisation, confirming that
        the organisation will at all times work in accordance with this Annex and
        with the ISMM. If the accountable manager or, in the case of design organisations,
        the head of the design organisation, is not the chief executive officer (CEO)
        of the organisation, then such CEO shall countersign the statement;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.2
      description: the title(s), name(s), duties, accountabilities, responsibilities
        and authorities of the person or persons referred to in point IS.D.OR.240(b)
        and (c);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.3
      description: the title, name, duties, accountabilities, responsibilities and
        authorities of the common responsible person referred to in point IS.D.OR.240(d),
        if applicable;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.4
      description: the information security policy of the organisation as referred
        to in point IS.D.OR.200(a)(1);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.5
      description: a general description of the number and categories of staff and
        of the system in place to plan the availability of staff as required by point
        IS.D.OR.240;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.6
      description: the title(s), name(s), duties, accountabilities, responsibilities
        and authorities of the key persons responsible for the implementation of point
        IS.D.OR.200, including the person or persons responsible for the compliance
        monitoring function referred to in point IS.D.OR.200(a)(12);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.7
      description: an organisation chart showing the associated chains of accountability
        and responsibility for the persons referred to in points (2) and (6);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.8
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.8
      description: the description of the internal reporting scheme referred to in
        point IS.D.OR.215
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.9
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.9
      description: 'the procedures that specify how the organisation ensures compliance
        with this Part, and in particular:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.9.i
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.9
      ref_id: IS.D.OR.250-a.9.i
      description: the documentation point IS.D.OR.200(c);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.9.ii
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.9
      ref_id: IS.D.OR.250-a.9.ii
      description: the procedures that define how the organisation controls any contracted
        activities referred to in point IS.D. OR.200(a)(9);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.9.iii
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.9
      ref_id: IS.D.OR.250-a.9.iii
      description: the ISMM amendment procedure defined in point (c);
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a.10
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-a
      ref_id: IS.D.OR.250-a.10
      description: the details of currently approved alternative means of compliance.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250
      ref_id: IS.D.OR.250-b
      description: The initial issue of the ISMM shall be approved and a copy shall
        be retained by the competent authority. The ISMM shall be amended as necessary
        to remain an up-to-date description of the ISMS of the organisation. A copy
        of any amendments to the ISMM shall be provided to the competent authority.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-c
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250
      ref_id: IS.D.OR.250-c
      description: Amendments to the ISMM shall be managed in a procedure established
        by the organisation. Any amendments that are not included within the scope
        of this procedure and any amendments related to the changes referred to in
        point IS.D. OR.255(b), shall be approved by the competent authority.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250-d
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.250
      ref_id: IS.D.OR.250-d
      description: The organisation may integrate the ISMM with other management expositions
        or manuals it holds, provided there is a clear cross reference that indicates
        which portions of the management exposition or manual correspond to the different
        requirements contained in this Annex.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:annex
      ref_id: IS.D.OR.255
      name: Changes to the information security management system
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255-a
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255
      ref_id: IS.D.OR.255-a
      description: Changes to the ISMS may be managed and notified to the competent
        authority in a procedure developed by the organisation. This procedure shall
        be approved by the competent authority.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255-b
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255
      ref_id: IS.D.OR.255-b
      description: With regard to changes to the ISMS not covered by the procedure
        referred to in point (a), the organisation shall apply for and obtain an approval
        issued by the competent authority.
    - urn: urn:intuitem:risk:req_node:part-is.d.or:node142
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255
      description: 'With regard to these changes:'
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255-b.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:node142
      ref_id: IS.D.OR.255-b.1
      description: the application shall be submitted before any such change takes
        place, in order to enable the competent authority to determine continued compliance
        with this Regulation and to amend, if necessary, the organisation certificate
        and related terms of approval attached to it;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255-b.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:node142
      ref_id: IS.D.OR.255-b.2
      description: the organisation shall make available to the competent authority
        any information it requests to evaluate the change;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255-b.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:node142
      ref_id: IS.D.OR.255-b.3
      description: the change shall be implemented only upon receipt of a formal approval
        by the competent authority;
    - urn: urn:intuitem:risk:req_node:part-is.d.or:is.d.or.255-b.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:part-is.d.or:node142
      ref_id: IS.D.OR.255-b.4
      description: the organisation shall operate under the conditions prescribed
        by the competent authority during the implementation of such changes.
