Academy of Information Security in Civil Aviation – PART-IS Manager

The thematic units that make up the Academy of Information Security in Civil Aviation – PART-IS Manager program are designed to cover all key aspects of information security management in the aviation environment. Each unit provides focused theoretical knowledge and practical guidance aligned with regulatory requirements and international standards, giving participants a foundation for effective and responsible ISMS implementation in their organizations.
The program consists of the following units:

The program consists of the following units:

➤ PART-IS Management
Introduction to the strategic requirements of information security in civil aviation, with emphasis on the role of management, regulatory obligations, and responsibilities in establishing and maintaining the ISMS.
➤ PART-IS.I.OR Lead Implementer

Detailed analysis of the requirements from PART-IS.I.OR and related standards, with practical guidelines for planning, implementing, and managing the ISMS in aviation organizations.

➤ ISMS Document Management in Civil Aviation

Understanding the complete ISMS documentation, including its structure, importance, and roles and responsibilities for creation and maintenance.

➤ Information Security Risk Assessment in Civil Aviation

A methodological framework for conducting risk assessments in accordance with ISO 27005 and PART-IS.I.OR, including risk identification, analysis, evaluation, and treatment.

➤ Information Security Internal Audit in Civil Aviation

Planning and conducting internal ISMS audits according to ISO 19011 and PART-IS.I.OR, with skill development for preparing plans, reports, and classifying findings.

➤ Information Security Incident Management in Civil Aviation

Procedures for detection, reporting, response, and recovery from information security incidents in line with ISO 27035 and regulatory obligations.

➤ Changes and Improvements of the ISMS in Civil Aviation

Managing changes and continuously improving the ISMS through self-assessments, oversight, reporting, and application of the PDCA cycle.

▶ Modul 1: PART-IS Management

The PART-IS Management module serves as an introduction to information security management in civil aviation under the EASA PART-IS.I.OR requirements. It is intended for individuals in managerial or supervisory roles within organizations subject to this framework, with the aim of acquiring foundational knowledge of the management’s role in addressing security requirements.
Special emphasis is placed on the strategic responsibility of management in establishing an effective ISMS by defining objectives, policies, responsibilities, and resources aligned with regulatory and business goals. The module covers organizational obligations under Regulation (EU) 2023/203, with a focus on identifying processes and systems that impact flight safety and integrating them into the risk management system.
Participants analyze examples of managerial decisions that shape the ISMS, distinguishing between formal compliance and operational effectiveness. The final part of the module addresses oversight, self-assessments, and reporting, highlighting the importance of a closed feedback loop. This module serves as a foundation for the program’s further specialized content.
▶ Module 2: PART-IS.I.OR Lead Implementer

▶ Module 3: ISMS Document Management in Civil Aviation

The ISMS Document Management in Civil Aviation module focuses on the effective management of documentation within the ISMS in accordance with Regulation (EU) 2023/203 and the ISO/IEC 27001:2022 standard. It is intended for professionals who must ensure compliance and operational effectiveness through proper handling of documented information.
Participants receive an overview of key ISMS documents, including policies, methodologies, registers, plans, and records, with emphasis on their role in demonstrating compliance during oversight. All phases of the documentation lifecycle are covered – from creation to withdrawal – with clearly defined roles, procedures, and rules. In practical exercises, participants create documents such as a security policy, risk register, and incident response plans. They practice version control, tracking changes, and communication with interested parties. Special attention is given to recordkeeping, including requirements for format, structure, data retention, and the use of DMS systems.
The final part of the module highlights the integration of ISMS documentation with other management systems within the organization, enhancing transparency and compliance. This module develops essential competencies for structured and sustainable documentation management in the aviation industry.

▶ Module 4: Information Security Internal Audit in Civil Aviation

The Information Security Internal Audit in Civil Aviation module is intended for professionals conducting internal ISMS audits within civil aviation organizations. It is based on requirement IS.I.OR.250 of Regulation (EU) 2023/203, as well as ISO/IEC 27001:2022 and ISO 19011 standards.
Participants gain knowledge of the purpose, objectives, and obligations of the audit, with a focus on independently verifying the effectiveness of information security measures and identifying areas for improvement. The module covers all stages of the audit: from planning, defining scope and criteria, through execution and evidence collection, to reporting and communication. Emphasis is placed on a risk-based, contextual, and sampling-based approach. In practical exercises, participants prepare an audit plan, conduct simulated interviews, identify nonconformities, and write findings, developing analytical and communication skills.
The module also explores the relationship between auditing and risk, incident, and change management, and the integration of results into decision-making systems. The final section focuses on monitoring corrective actions and reporting. The module equips participants with the competence to take on the professional role of an internal auditor in aviation safety.

▶ Module 5: Information Security Risk Assessment in Civil Aviation
The Information Security Risk Assessment in Civil Aviation module provides participants with comprehensive knowledge and practical skills for conducting information security risk assessments in civil aviation. It is based on Regulation (EU) 2023/203 (IS.I.OR.205) and the ISO/IEC 27005 and ISO 31000 standards.
The focus is on developing the ability to identify, analyze, and evaluate risks that may impact the safety of flight operations. Emphasis is placed on defining context, scope, and risk acceptance criteria. Participants learn how to identify information assets, threats, vulnerabilities, and controls, as well as how to use various data collection methods.
The analysis includes assessing likelihood and consequences, and determining the level of risk using qualitative or quantitative methods. Evaluation supports decisions on which risks require treatment and which can be accepted. The module includes development of risk treatment plans, assignment of ownership, and monitoring the effectiveness of controls. Practical exercises include a full simulation of the risk assessment process. The final section focuses on documentation, risk register maintenance, and reporting to management. The module equips participants to perform risk assessments in line with regulatory and operational aviation requirements.
▶ Module 6: Information Security Incident Management in Civil Aviation
The Information Security Incident Management in Civil Aviation module offers a practical approach to managing information security incidents in aviation, based on IS.I.OR.220 and IS.I.OR.230 of Regulation (EU) 2023/203 and the ISO/IEC 27035-1:2023 standard.
Participants learn how to identify security events, distinguish them from incidents, assess risks, and manage the response in accordance with regulatory requirements. The link to flight operations and the importance of a swift, coordinated response is emphasized. The module covers planning and preparation: defining roles, communication protocols, response plans, and training. This is followed by detection and reporting, use of security tools, metrics, and whistleblower protection. During the assessment phase, participants analyze reports, classify incidents, determine priorities, and initiate responses.
The response includes impact mitigation, crisis communication, and continuity preservation. Finally, the module covers learning from incidents through root cause analysis, control review, and improvement proposals. Exercises simulate real-world scenarios, developing teamwork and crisis decision-making. This module prepares participants for professional incident management in a security-sensitive aviation environment.
▶ Module 7: Changes and Improvements of the ISMS in Civil Aviation

The Changes and Improvements of the ISMS in Civil Aviation module focuses on planning and implementing changes and continual improvement of the ISMS in accordance with Regulation (EU) 2023/203, particularly articles IS.I.OR.255 and IS.I.OR.260.
Participants adopt a methodological framework for managing changes that affect the ISMS – such as changes in structure, technology, or suppliers – with emphasis on risk analysis, planning, communication, and monitoring impact. They learn how to classify changes, assess their impact on safety, maintain documentation, and communicate with competent authorities.
The module also covers the evaluation of ISMS effectiveness through KPIs, self-assessments, audits, and result analysis. Participants learn how to use data from incidents, monitoring, and feedback to continuously improve policies and procedures, and how to engage personnel in the improvement process.
Exercises include change scenario analysis, development of change plans, and use of tools to monitor effectiveness and prevent regression. The module concludes with the application of the PDCA cycle, turning the ISMS into a dynamic tool for risk management and resilience building in aviation organizations.

We offer attractive discounts for group registrations. The applicable rates are as follows: 

• 5 % discount for 2 participants,
• 10 % for 3 participants,
• 15 % for 4 participants, 

• and a generous 20% discount for groups of more than 5 participants. 

These discounts apply both to the full program and to individual modules.