text: AMC and GM to Part 21 Issue 2, Amendment 15

text: N o t e t o t h e re a d e r

text: In amended, and in particular in existing (that is, unchanged) text, ‘Agency’ is used interchangeably with ‘EASA’. The interchangeable use of these two terms is more apparent in the consolidated versions. Therefore, please note that both terms refer to the ‘European Union Aviation Safety Agency (EASA)’.

text: Annex III to ED Decision 2023/010/R Page 1 of 2

text: Annex III to ED Decision 2023/010/R Page 2 of 2

identifier: AMC & GM to Part 21 — Issue 2, Amendment 15

amnesord: Part 21 - Airworthiness and Environmental Certification

beslut: ED Decision 2023/010/R

publisher: Europeiska unionens byrå för luftfartssäkerhet

sprak: en

serie: amc-gm

text: Annex III to ED Decision 2023/010/R ‘AMC and GM to Part 21 — Issue 2, Amendment 15’

type: rubrik

text: The text of the amendment is arranged to show deleted, new or amended text as follows:

type: stycke

text: — deleted text is struck through;

text: — new or amended text is highlighted in cyan;

text: — an ellipsis ‘[…]’ indicates that the rest of the text is unchanged.

text: The Annex to Decision 2012/020/R of 30 October 2012 of the Executive Director of the Agency is amended as follows:

text: AMC1 21.B.20A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

text: (a) To appropriately collect and analyse information related to information security incidents and vulnerabilities with a potential impact on aviation safety, the competent authority should implement means that ensure the necessary confidentiality. (b) When disseminating information related to information security incidents and vulnerabilities with a potential impact on aviation safety, the competent authority should properly select the appropriate recipient(s) to prevent the content of a report from being exploited to the detriment of aviation safety, by revealing, for instance, uncorrected vulnerabilities.

text: GM1 21.B.20A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

text: When deemed necessary, a two-step mechanism could be used: a report alerting about the information security event or incident and the availability of additional data that would require controlled and confidential distribution. This report should only alert recipients of the urgency and the necessity for organisations and competent authorities to establish further communication through secure means. Therefore, the report should consist of two parts: one limited to mostly public information and one containing the sensitive data that should be restricted to the recipients who need to know. Wherever possible, reports should be based on an agreed taxonomy.

type: vagledning

utgivare: easa