Why cybersecurity is in Module 10
Modern aircraft and maintenance organisations run on data: aircraft networks, loadable software, electronic technical logs, electronic signatures (AAC 4 of 2023), maintenance-planning databases, parts-traceability systems and the DGCA's own eGCA portal. If that data is corrupted, stolen or unavailable, an aircraft can be released with the wrong software, a life-limited part can be mis-tracked, or a deferred defect can disappear from the record. In other words, information security has become an airworthiness issue.
The CAR-66 syllabus (10.10, level 1 for all B categories) asks for a basic understanding of the “regulation on the introduction of organisation requirements for the management of information security risks related to aeronautical information systems used in civil aviation” — the exact title of EU Regulation (EU) 2023/203.
DGCA has not (yet) published a separate Indian CAR on information security; the Indian CAR-145, CAR-M, CAR-CAMO and CAR-CAO texts do not contain Part-IS requirements. The syllabus therefore points to the EASA rules, which Indian organisations holding EASA approvals already follow, and which DGCA typically harmonises with. Learn the principles below.
The two EU regulations — “Part-IS”
| Regulation | Annex | Applies to | Applicable from |
|---|---|---|---|
| (EU) 2023/203 (Implementing) | Part-IS.AR (authorities) · Part-IS.I.OR (organisations) | Competent authorities and organisations including Part-145 maintenance organisations, Part-CAMO, air operators, training organisations, ATM/ANS providers | 22 February 2026 |
| (EU) 2022/1645 (Delegated) | Part-IS.D.OR | Design and production organisations and aerodromes | 16 October 2025 |
EASA publishes both, with their AMC and GM, as the Easy Access Rules for Information Security (Dec 2025 revision in the course library).
Key definitions (Article 3)
- Information security — the preservation of confidentiality, integrity, authenticity and availability of network and information systems.
- Information security event — an identified occurrence of a system, service or network state indicating a possible breach of policy or failure of controls, or a previously unknown situation relevant to security.
- Incident — any event having an actual adverse effect on the security of network and information systems.
- Information security risk — the risk to civil aviation operations, assets, individuals and other organisations due to the potential of an information security event.
The Information Security Management System — IS.I.OR.200
Each organisation sets up, implements and maintains an ISMS that ensures it:
- establishes an information security policy focused on the potential impact on aviation safety;
- identifies and reviews information security risks (IS.I.OR.205);
- defines and implements risk treatment measures (IS.I.OR.210);
- implements an internal reporting scheme (IS.I.OR.215);
- detects events, identifies incidents with potential safety impact, and responds and recovers (IS.I.OR.220);
- implements measures the authority mandates as an immediate reaction;
- addresses findings from the authority (IS.I.OR.225);
- runs an external reporting scheme (IS.I.OR.230);
- controls contracted security activities (IS.I.OR.235);
- meets the personnel requirements (IS.I.OR.240);
- keeps records (IS.I.OR.245);
- monitors compliance and feeds findings back to the accountable manager;
- protects the confidentiality of information received from other organisations.
It must be documented in an Information Security Management Manual (ISMM) (IS.I.OR.250), changes managed (IS.I.OR.255) and continuously improved (IS.I.OR.260). The ISMS is proportionate to the organisation and may be integrated with its existing management system (for a CAR-145 organisation, alongside its SMS). An organisation may be granted an exemption where it demonstrates that its activities pose no significant information security risk to aviation safety.
Risk assessment and treatment — IS.I.OR.205 and 210
- Identify all elements exposed to risk — activities, facilities, resources, services, and the equipment, systems, data and information behind them.
- Identify interfaces with other organisations that could create mutual exposure (suppliers, operators, IT providers).
- For each risk with potential safety impact, assign a risk level from a predefined classification based on the likelihood of the threat scenario and the severity of its safety consequences.
- Treat unacceptable risks with measures, verify their effectiveness, and review the assessment periodically and after changes or incidents.
Reporting and incidents — IS.I.OR.215 to 230
| Scheme | What happens |
|---|---|
| Internal reporting (215) | Staff report events, vulnerabilities and incidents internally; causes and contributing factors are analysed and fed into risk management — just like the safety reporting scheme |
| Incident handling (220) | Detect events, identify incidents, contain, respond and recover |
| External reporting (230) | Incidents or vulnerabilities that may represent a significant risk to aviation safety are reported to the competent authority (and, where relevant, the design approval holder) as soon as possible, not exceeding 72 hours, followed by follow-up reports |
Notice the pattern across Module 10: occurrence reports (M.A.202, 145.A.60), design holder reports (21.3A) and information security reports (IS.I.OR.230) all use a 72-hour limit.
People and records — IS.I.OR.240 and 245
- The accountable manager (the same person as under Part-145/CAMO) has corporate authority to finance and carry out all information security activities, ensures resources, and promotes the information security policy.
- The accountable manager appoints a person or group responsible for compliance with Part-IS (reporting directly to them), and a person or group for compliance monitoring; a common responsible person may be used where structures are shared.
- Personnel must have the competence for their security tasks.
- Records — approvals and risk assessments, contracts, key processes, identified risks and treatments, incidents and vulnerabilities — are archived and traceable.
Cyber hygiene for the AME
You do not need to be an IT specialist, but your daily actions are part of the organisation's defences:
- Software loading — load only approved, controlled loadable software parts from the approved source, verify the part number and integrity check (checksum/CRC) before and after loading, and record the configuration change.
- Aircraft networks — respect the separation between the aircraft control domain, airline information services and passenger domains; never connect unauthorised devices to maintenance ports.
- Maintenance laptops, USB media and data loaders — use only organisation-controlled, scanned equipment; no personal USB drives on aircraft or shop systems.
- Electronic records and signatures — protect your login and eGCA credentials; never share passwords; an electronic signature carries the same weight as your written one (AAC 4 of 2023).
- Report suspicious emails, unexpected system behaviour, lost devices or unusual data changes through the internal reporting scheme — promptly.
Chapter summary
- Information security = confidentiality, integrity, authenticity and availability of network and information systems — now a safety issue.
- Syllabus 10.10 names Regulation (EU) 2023/203 (Part-IS.I.OR, applicable 22 Feb 2026); 2022/1645 covers design/production (16 Oct 2025). No separate DGCA CAR yet.
- ISMS: policy, risk assessment and treatment, internal and external reporting, incident response, contracting, personnel, records, compliance monitoring, confidentiality; documented in the ISMM.
- Risk level = likelihood of the threat scenario × severity of safety consequences.
- Significant incidents reported to the authority within 72 hours.
- AMEs: controlled software loading with integrity checks, no unauthorised devices, protect credentials, report anomalies.