Information Security (Part-IS) Training (Online)
Maintenance now runs on digital information: loadable software, airworthiness records, test equipment and data portals. This course explains what Part-IS asks of your organisation and what you personally do to keep that information, and the aircraft that depend on it, safe.
Who needs this training
- Staff of Part-145 maintenance organisations, CAMOs and CAOs, to which Part-IS applies from 22 February 2026.
- Anyone working in those organisations: the course assumes no prior knowledge of computers, networks or cyber security.
The rule this training answers
Part-IS for maintenance and continuing-airworthiness organisations is Implementing Regulation (EU) 2023/203, Part-IS.I.OR, applicable from 22 February 2026 to Part-145 organisations, CAMOs and CAOs. It requires the organisation to run an information security management system, and point IS.I.OR.240(g) requires that its people have the competence to do their work securely. AMC1 and GM1 IS.I.OR.240(g) describe the competence process and the training programme.
It is easily confused with Delegated Regulation (EU) 2022/1645 (Part-IS.D.OR), which covers Part-21 design and production organisations and does not bind a Part-145, CAMO or CAO.
Part-IS sets no pass mark and no fixed retraining interval. The 75% pass mark on this course is our own assessment standard.
Initial or Continuation
Initial
First-time trainingThe full first-time syllabus, taught in depth. Take this if you have not been trained in this subject before.
- 9 lessons
- 2 h 35 min of lessons
- 27 knowledge checks
- 16 exam questions
Continuation
RefresherThe shorter refresher for staff already trained. It recaps the essentials and focuses on current emphasis and lessons learned.
- 6 lessons
- 1 h 29 min of lessons
- 18 knowledge checks
- 12 exam questions
Lesson times are reading times. They are not a regulatory training duration.
What you will learn
- Why information security is now an airworthiness matter.
- What Part-IS is, who it applies to, and its vocabulary, including an event versus an incident.
- How an information security management system works, and how risk is assessed and treated.
- How attacks actually happen: phishing, ransomware, insiders and the supply chain.
- Everyday defences in the hangar and the office, including software loading and test equipment.
- Spotting, reporting and responding, and your own responsibilities.
Syllabus, lesson by lesson
Information Security (Part-IS) - Initial9 lessons, 2 h 35 min
- 1 Why information security is now an airworthiness matterIS.I.OR.100 16 min
- 2 What Part-IS is - the regulation, scope, dates and languageIS.I.OR.100 17 min
- 3 The ISMS - how your organisation manages information securityIS.I.OR.200 16 min
- 4 Information security risk - assessment and treatmentIS.I.OR.205 / IS.I.OR.210 17 min
- 5 Threats and how attacks actually happenIS.I.OR.205 18 min
- 6 Everyday defences - what you personally doGM1 IS.I.OR.240(g) 18 min
- 7 Information security in the hangar and the CAMO officeIS.I.OR.205 / IS.I.OR.220 18 min
- 8 Spotting, reporting, responding and recoveringIS.I.OR.215 / IS.I.OR.220 / IS.I.OR.230 18 min
- 9 Your responsibilities, the supply chain, and keeping currentIS.I.OR.235 / IS.I.OR.240 / IS.I.OR.260 17 min
Information Security (Part-IS) - Continuation6 lessons, 1 h 29 min
- 1 Part-IS in one page - why it exists and your part in itIS.I.OR.100 14 min
- 2 The current threat landscapeIS.I.OR.205 15 min
- 3 Everyday defences - a refresherGM1 IS.I.OR.240(g) 15 min
- 4 Reporting discipline - the skill that decaysIS.I.OR.215 / IS.I.OR.220 16 min
- 5 Lessons learned and what has changedIS.I.OR.255 / IS.I.OR.260 14 min
- 6 Your responsibilities and staying currentIS.I.OR.240 / IS.I.OR.260 15 min
From the course introduction
Welcome to your Information Security training under EASA Part-IS. This is an initial course - a first, full grounding in information security for anyone working in a Part-145 maintenance organisation, a CAMO, or a Combined Airworthiness Organisation (CAO). You do not need any prior knowledge of computers, networks or cyber security. We start from first principles, build each idea from the ground up, and always tie it back to the one thing that matters: the aircraft you help keep airworthy has to stay safe.
Here is the single idea the whole course rests on. Modern maintenance and airworthiness-management work runs on digital information. The software you load onto an aircraft, the records that prove it is airworthy, the test kit you plug in, the OEM data portals you pull maintenance data from, the EASA Form 1 chain that follows a part - all of it is information held in, and moved by, computer systems. If that information is stolen, quietly altered, or made unavailable at the wrong moment, the damage does not stop at the IT department. It can reach the aircraft. That is why the regulator has made information security a management-system requirement for your organisation, and why it is now part of everyone's job, not just the people who fix printers.
Your certificate
Pass the final exam at 75% and download your certificate straight away. Your organisation can check it at any time at Verify a certificate.
Part-IS sets no fixed retraining interval: your organisation decides how often awareness training recurs, based on its own risk (GM1 IS.I.OR.240(g)). Your certificate shows a "Refresh due by" date 24 months after issue as a common convention, not a legal limit.
This is independent training mapped to the applicable AMC and GM. Part66Online is not a Part-147 approved organisation, and no Part-147 approval is needed for this training. Final acceptance toward your training obligations rests with your employing organisation and its competent authority.
What the certificate records
- Your name
- The course and the references it is mapped to
- That you passed the assessment
- The issue date and a “Refresh due by” date
- A unique ID that can be verified online
