Part-IS compliance software
Acuna GRC includes Part-IS in its framework library. Adopt it next to ISO 27001, assess information security risks for their impact on aviation safety, follow every incident and keep the proof your authority will ask for.
What Part-IS asks
Part-IS is set by Delegated Regulation (EU) 2022/1645 (Part-IS.D.OR, applicable since 16 October 2025) and Implementing Regulation (EU) 2023/203 (Part-IS.I.OR, applicable since 22 February 2026). Each organisation in scope runs an information security management system (ISMS) built around its impact on aviation safety.
Identify the assets, systems and interfaces that could affect safety, assess their information security risks and treat the ones above your acceptance level.
Run an internal reporting scheme, detect, respond to and recover from incidents, and report those with a safety impact to the competent authority within 72 hours.
The accountable manager answers for the ISMS, contracted activities stay under your control, and the ISMS manual, records and improvements are kept up to date.
Does this sound like you?
Most aviation organisations already have a safety management system and some security controls. The work goes into joining them, checking contractors and proving to the authority that it all runs.
We already have ISO 27001. Do we start again for Part-IS?
Fix: No. EASA says the two are in most parts aligned. Adopt Part-IS in Comply next to ISO 27001: one measure counts for every framework that asks for it, and you see what is left.
See what is reusedOur safety team and our IT security team never meet.
Fix: Keep information security risks in one register with the safety impact written into each one, an owner who approves it, and treatment plans you can show at the next safety review.
See the risk registerOur MRO subcontractors and IT suppliers are a list in a spreadsheet.
Fix: Keep contracted organisations in one supplier register, send them questionnaires and rate each answer, so you can show they meet what you contracted.
See supplier checksIf we had to report to the authority tomorrow, the facts would be in inboxes.
Fix: Log each event as an Incident issue. Its timeline keeps dated steps with their files, so the facts are ready when you report.
See the incident timelineHow Acuna GRC covers it
Acuna GRC runs Part-IS in its four core workspaces, with TPRM for contracted activities: Comply sets the program, Implement puts the measures in place, Operate runs the risks and the ISMS manual, TPRM checks suppliers and Assure keeps incidents, audits and findings.
Part-IS is included in the framework library: adopt it in Comply next to ISO 27001. Common Measures are mapped across frameworks, so one measure counts for each requirement it meets, and Mapping lists the Part-IS requirements that have no measure yet. Your own frameworks can be imported too.
See Comply →Each measure in Implement has an owner, and each control that checks it has a schedule and a checklist. Every signed run is kept as proof, and health rolls up from controls to measures to the Part-IS requirements.
See Implement →Operate keeps your information security risks with their assets, threats and treatment plans, each with an owner who approves it and reviews it each year. The ISMS manual and your procedures are Documents with an owner, approvers, numbered revisions and a yearly review.
See Operate →TPRM keeps one supplier register. Send questionnaires one at a time or as a campaign, rate each assessment from one to three shields, and follow a daily A to F grade of each supplier’s public security posture.
See TPRM →Log each event as an Incident issue in Assure. Its timeline keeps dated steps with phase labels and files. Internal audits, findings from the authority and corrective actions with their root cause stay in the same place until they are verified.
See Assure →Aiko at your pace
In Mapping, Run AI ranks the best measures from your own library for each Part-IS requirement with no measure, each with a confidence score and a reason. Nothing is linked until you apply it.
1Aiko proposes
2You confirm
3You set the pace
Ask Aiko which controls have no measure, and it plans every missing link on its own page. Nothing is linked until you click Apply.
Admins set the highest mode for each action.
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Our experts run a Part-IS gap assessment with your team in Acuna GRC, starting from the ISMS or ISO 27001 work you already have, then help you plan the measures that are missing.
GRC Consulting team leader
Bénédicte Sévin
ISO 27001 Lead Implementer
Cybersecurity governance expert
Jean-Emmanuel Rodriguez
Gap analysis and framework implementation.png&w=3840&q=75&dpl=dpl_CTwEAfoDPTGWDgYwZbUKDq19eBbt)
CEO of Abilene Group
Henri Haenni
Business continuity and risk managementYou run the program in Acuna GRC, with Aiko.
Guidance, reviews and audit preparation with your team.
Our experts run it. You review.
Integrations
Connectors pull security data from your identity, device, cloud, backup and training tools on a schedule, so control values stay current without a manual step.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra ID
Okta
Google Workspace
Intune
Jamf Pro
CrowdStrike
Defender
AWS
Azure
Microsoft 365
Acronis
KnowBe4
Jira
ServiceNowConnectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Part-IS runs in the four core workspaces, with TPRM for contracted activities. Add the Staff Portal, Evaluations and Group management as you need them.
FAQ
Under Implementing Regulation (EU) 2023/203: Part-145 maintenance organisations, CAMOs, air operators under Part-ORO, approved training organisations, aircrew aero-medical centres, FSTD operators, ATCO training organisations and ATCO aero-medical centres, and ATM/ANS providers, with exclusions for some light aviation activities. Under Delegated Regulation (EU) 2022/1645: Part 21 design and production organisations, aerodrome operators and apron management service providers.
Organisations under Delegated Regulation (EU) 2022/1645 have had to comply since 16 October 2025. Organisations under Implementing Regulation (EU) 2023/203 have had to comply since 22 February 2026.
Not on its own. EASA says Part-IS is in most parts aligned with ISO 27001, but aviation safety has to be part of your risk management. An ISO 27001 ISMS can be extended to the Part-IS scope after a gap analysis, and in Acuna GRC the measures you already run count for both. ISO 27001 compliance software
No. EASA states that NIS2 compliance does not imply Part-IS compliance. The two overlap, so in Acuna GRC you adopt both frameworks and one measure counts for each requirement it meets. NIS2 compliance software
The accountable manager answers for the ISMS. EASA guidance has them endorse the information security policy, receive audit findings and understand what Part-IS sets out to achieve, with a person or group appointed to run compliance day to day.
Not by size. Under IS.I.OR.200(e) and IS.D.OR.200(e), the competent authority can approve a derogation if a documented risk assessment shows no information security risk with a potential impact on aviation safety. External reporting still applies.
No. You report to your competent authority yourself. Acuna GRC keeps the incident record and its timeline, so the facts are ready when you report.
No tool can do that for you. Acuna GRC runs your ISMS and keeps the evidence, and our experts can check where you stand.
In Switzerland or the EU, as you choose, or in your private cloud or on your own premises.
Tell us your approvals and the frameworks you already run. We show you Part-IS in Acuna GRC, and how our experts can assess where you stand.
Hosted in Switzerland, the EU or the US
.png&w=3840&q=75&dpl=dpl_CTwEAfoDPTGWDgYwZbUKDq19eBbt)
