Slide 1: Part-IS with Airbus Protect: Going Beyond Compliance
} _enabling a trusted future 11 November 2025 Part-IS with Airbus Protect: Going Beyond Compliance with Thaddeus Eze and Sunaina Aytan
Slide 2: Meet the speakers
# : Meet the speakers This material is the property of Airbus Protect SAS and is protected by copyright. Unauthorised copying, reproduction, or distribution is strictly prohibited
Slide 3: Agenda
Agenda 01 Building blocks for Part-IS 02 Challenges faced by the Part-IS community 03 How to achieve lean implementation 04 What’s next 05 Open Q&A This material is the property of Airbus Protect SAS and is protected by copyright. Unauthorised copying, reproduction, distribution, or sharing of login
Slide 4: Agenda
Agenda 01 Building blocks for Part-IS 02 Challenges faced by the Part-IS community 03 How to achieve lean implementation 04 What’s next 05 Open Q&A This material is the property of Airbus Protect SAS and is protected by copyright. Unauthorised copying, reproduction, distribution, or sharing of login
Slide 5: Reminder - scope
# : Reminder - scope NIS2 (EU) GDPR (EU) 2022/2555 2016/679 ISO27K NIST Cyber Threats Part-IS (EU) CS2X x (EU) Cyber Safety This material is the property of Airbus Protect SAS and is protected by copyright. Unauthorised copying, reproduction, or distribution is strictly prohibited
Slide 6: Part-IS in a nutshell
>> : Part-IS in a nutshell #who? EASA approved organisations #when? October 2025 February 2026 > OEMs > Airlines > design & > MROs production > Training ORGs organisations > ATM /ANS > Airports #what? Information Security Risk assessment Risk treatment Event management rity Secu ety Management Syste
Slide 7: Differences are complementary
: Differences are complementary Break the silos >>> One goal One language One approach Company Security management Integrated Company Security Security mngt Business Safety Business Safety ISMS SMS ISMS Part-IS SMS Before After This material is the property of Airbus Protect SAS and is protected by
Slide 8: Risk assessment example
} _ Risk assessment example # ● Methodology should be: ■ Threat scenario based ■ Repeatable & comparable ● Risk assessment Vs management ● Risk treatment plan follow up Operational scenarios
Slide 9: Risk assessment example
} _ Risk assessment example # Key s point
Slide 10: But compliance is in stages
Risk Management : But Emergency Procedures compliance is in stages SecurityTraining Airworthiness Regulation Quality Assurance Compliance Accreditation Technical Skills Inspection Ethics Policies Aviation Law Audit Standard Standards Flight Operations Safety Licensing Maintenance Operational Safety
Slide 11: Part-IS is [maturity] driven
: Part-IS is [maturity] driven Different implementation levels of the ISMS Now: an ISMS exists, is 18 months: the Later: the ISMS is fully documented, approved, ISMS is being operated achieving expected and suitable to the exactly as written outcomes organisation’s context bl & e’ g’ ta nt’ iv tin e
Slide 12: Beware: Documentation
>> Beware: Documentation … discrepancy between documented procedures and operational practices
Slide 13: Foundational elements for a strong compliance framework
: Foundational elements for a strong compliance framework Identify and define the Understand what needs to scope of Part-IS change Break the silos ~ Take your time to build, minding integrated security mgt the gap - it is maturity based
Slide 14: Agenda
Agenda 01 Building blocks for Part-IS 02 Challenges faced by the Part-IS community 03 How to achieve lean implementation 04 What’s next 05 Open Q&A This material is the property of Airbus Protect SAS and is protected by copyright. Unauthorised copying, reproduction, distribution, or sharing of login
Slide 15: Part-IS challenges
>> Part-IS challenges Breaking the silos between safety and security Understanding security for safety Risk and incident management Understanding a threat based scenario framework Governance Organisational structure Asset management This material is the property of Airbus Protect SAS and is protecte
Slide 16: 3rd parties & risks
: 3rd parties & risks Contracts Partners, suppliers, customers Security continuum: Incidents & vulnerabilities Third party risk management: Identification & sharing Risk management security for safety: Method and evaluation This material is the property of Airbus Protect SAS and is protected by copy
Slide 17: Challenge 1: Changes in the organisational structure
>> Challenge 1: Changes in the organisational structure Approved Organisation Accountable Manager Oversight Compliance monitoring Nominated SMS Information Security Post holder Responsible person Responsible person Approved SMS Information Existing Organisation staff staff Security staff New This ma
Slide 18: Challenge 2: What exactly is security for safety?
} Challenge 2: What exactly is security for safety? # Safety Management System Information Security Management (SMS) System (ISMS) Part-IS Can a safety failure be triggered by a ISMS for aviation safety threat condition? Can an information security event cause or contribute to a safety consequence?
Slide 19: Agenda
Agenda 01 Building blocks for Part-IS 02 Challenges faced by the Part-IS community 03 How to achieve lean implementation 05 What’s next 06 Open Q&A This material is the property of Airbus Protect SAS and is protected by copyright. Unauthorised copying, reproduction, distribution, or sharing of login
Slide 20: 1st Strategic Decision: Governance
1st - Strategic - Decision: Governance Define an integrated ISMS Business Safety Advanced 1 Single ISMS Resilient ISMS 2 Stakes ISMS Digital Safety Risk Risk Assessment Assessment Level Level of Regulations & Standards Regulations & Standards of Cyber (NIS2 / GDPR) p (Part-IS / UK ISMS) Security Att
Slide 21: Lean implementation: From basic to beyond compliance
Lean implementation: From basic to beyond compliance Managed risks Continuous beyond Scenarios-based Advanced improvement compliance risk management Resilient Business Resilience Safety Digital Security Security Efficiency for Safety Risk & maturity Risk Assessment Assessment Compliance Regulations
Slide 22: Sand Pebbles Rocks: going beyond compliance
: going beyond compliance Sand Pebbles Rocks Jar 22 Source: https://www.youtube.com/watch?v=cPgMeKfQFq8
Slide 23: Sand Pebbles Rocks: going beyond compliance
: going beyond compliance Obvious and easily identifiable: 1st priority to everything OVER ‘Major’ safety effect To protect people’s lives Sand Pebbles Rocks Jar 23 Source: https://www.youtube.com/watch?v=cPgMeKfQFq8
Slide 24: Sand Pebbles Jar: going beyond compliance
: going beyond compliance All other safety relevant AND aircraft operational reliability (AOG has business impacts) To protect the business (operational reliability) Sand Pebbles Jar 24 Source: https://www.youtube.com/watch?v=cPgMeKfQFq8
Slide 25: Sand Jar: going beyond compliance
: going beyond compliance Everything that contributes to best practices To protect from human error Sand Jar 25 Source: https://www.youtube.com/watch?v=cPgMeKfQFq8
Slide 26: Beer Jar: going beyond compliance
: going beyond compliance Beer Connect everything and fill all remaining gaps on daily activities through culture change, lessons learnt and proactive continuous improvement that evolves to address new threats To achieve RESILIENCE Jar 26 Source: https://www.youtube.com/watch?v=cPgMeKfQFq8
Slide 27: Sand Pebbles Rocks: going beyond compliance
: going beyond compliance … proactive continuous improvement that evolves to address new threats To achieve RESILIENCE Obvious and easily identifiable: 1st priority to everything OVER ‘Major’ safety effect To protect people’s lives Everything that contributes to best practices All other safety relev
Slide 28: Agenda
Agenda 01 Building blocks for Part-IS 02 Challenges faced by the Part-IS community 03 How to achieve lean implementation 04 What’s next 05 Open Q&A This material is the property of Airbus Protect SAS and is protected by copyright. Unauthorised copying, reproduction, distribution, or sharing of login
Slide 29: What's the [maturity] plan?
>> What’s the [maturity] plan? Goal: Achieve effective security level and resilience, guided by the principle of Security for Safety. Year 1: Write it down: Establish the ISMS ● Materialise the ISMS documentation ● Establish the roles and responsibilities ● Design the PROCESSES Achieve effective sec
Slide 30: Work Packages (WP) build upon each other
} Work Packages (WP) build upon each other Phase 1 Phase 2 Phase 3 Phase 4 Kick off / To be Build Check operational Continuous AS IS (2 months) Part IS implementation improvement (1 month) framework (2-3 months*) *depends on number of supplier audits WP 1 WP 2 WP 3 WP 4 WP 5 WP 6 AUTHORITY AUDIT Gap
Slide 31: Q&A With Airbus Protect
PROTECT Q&A With Airbus Protect Senior Cybersecurity Consultant at Airbus Protect Part-IS Service Leader, JA _ Governance & Compliance 9 Ree Ce 2. \ ersecurity Consultant & itor at Airbus Protect AIRBUS
Slide 32: Thank you
// Thank you # Contact Us Hamza Sheikh Engagement Manager protect@airbus.com www.protect.airbus.com hamza.sheikh@airbus.com