EU Regulation 2022/1645

Commission Delegated Regulation (EU) 2022/1645

EU Regulation 2022/1645 establishes mandatory cybersecurity management requirements for Part 21 Design Organisations (DOs) and Production Organisations (POs) in the aviation sector. It introduces the implementation of an Information Security Management System (ISMS) to protect critical systems, data, and processes from cyber threats.

Book your strategy call View source ↗

Overview

Commission Delegated Regulation (EU) 2022/1645 is an amendment to Regulation (EU) No 748/2012, introducing cybersecurity management requirements in Subparts J and G of Part 21 for Design Organisations (DOs) and Production Organisations (POs). These entities are required to implement and maintain an Information Security Management System (ISMS) to identify and manage security risks impacting aviation safety, establish incident reporting mechanisms, and ensure continuous improvement in cybersecurity. Key challenges include integrating ISMS with existing safety systems, managing compliance with evolving regulations, and addressing supply chain and cultural resistance issues. The regulation aligns with EASA cybersecurity rulemaking and addresses risks like legacy system vulnerabilities, remote work security, and insider threats.

Related in Critical Infrastructure

Critical InfrastructureRegulation

EASA Part-IS — European Union Aviation Safety Agency (EASA) - Part IS - Easy Access Rules for Information Security

The EASA Part-IS Regulation mandates information security measures within the aviation sector to address digital threats that impact safety. It provides a framework for managing risks, responding to incidents, and safeguarding aviation systems.

European Union • EU • vDecember 2025

View details

Critical InfrastructureGuideline

SMDDS — OWASP Secure Medical Devices Deployment Standard

The OWASP Secure Medical Devices Deployment Standard provides guidance for the secure deployment of medical devices within healthcare environments, addressing the rising threats such as botnets and malware targeting IoT devices. It emphasizes security measures across device purchasing, network security, interface controls, and incident handling.

OWASP

View details

Critical InfrastructureRegulation

DORA — Regulation (EU) 2022/2554 - Digital Operational Resilience Act

Regulation (EU) 2022/2554, known as DORA, establishes a unified framework for digital operational resilience in the European Union's financial sector. It aims to ensure financial entities can withstand, recover, and adapt to ICT-related disruptions while safeguarding the stability and integrity of the financial system.

European Parliament and Council of the European Union • European Union

View details

Critical InfrastructureLaw

SOCIA 2018 — Security of Critical Infrastructure Act 2018

The Security of Critical Infrastructure Act 2018 (SOCIA) establishes a regulatory framework for managing national security risks to Australia’s critical infrastructure sectors. It introduces statutory obligations, reporting requirements, and oversight mechanisms for critical assets.

Australian Department of Home Affairs • Australia • vNo. 29, 2018

View details

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call