How Aerospace Companies Protect Technical Data Flowing Through the MRO Supply Network

An Airbus A320 AMM — Aircraft Maintenance Manual — runs to approximately 170,000 pages. It contains precise procedures for every structural inspection, every component replacement, every airworthiness-critical task. It is, by definition, the most operationally sensitive technical document in civil aviation.

In a typical global MRO network, that manual — or sections of it — is distributed to maintenance facilities on four continents, subcontracted to specialized shops in a dozen countries, accessed by licensed engineers in environments that range from purpose-built MRO facilities to field maintenance teams working off-site.

EASA Part-IS requires MRO organizations to build an Information Security Management System. That is the right regulatory response to an industry with extraordinary data dependencies. But an ISMS protects your organization's security posture. It doesn't protect the AMM that left your system this morning for the line-maintenance shop in Singapore.

That's the gap EASA Part-IS introduces without solving, and it's the gap that aircraft technical documentation is most vulnerable to.

What EASA Part-IS Requires

Established under Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203, EASA Part-IS creates binding information security requirements across EU civil aviation. For Part-145 MRO organizations, the compliance deadline was 22 February 2026.

The requirement is substantive. Organizations must implement an ISMS that is not merely documented but effectively operational. The ISMS must integrate detection, response, governance, and reporting into existing safety frameworks — with cybersecurity treated as a managed, accountable system, not a standalone IT function.

Part-IS incorporates standards including NIST, ISO 27001, and NIS2, adapted to the aviation safety context. The regulatory intent is clear: aviation organizations that manage safety-critical technical data must govern that data with the same rigor they apply to physical airworthiness.

That intent is correct, but the problem is architectural.

The Mobility Problem an ISMS Cannot Solve

An ISMS governs information security within an organization's operational boundary. It sets policies, mandates controls, manages risk, and produces audit evidence that demonstrates security posture to regulators and customers. This is valuable and necessary.

But aviation maintenance technical documentation — Aircraft Maintenance Manuals, Component Maintenance Manuals, Supplemental Type Certificate data packages, Engineering Orders, service bulletins — does not stay within organizational boundaries. It moves constantly, by design, because the aircraft requires it.

When a Part-145 MRO receives a component for deep maintenance, the relevant CMM leaves the original OEM's systems, enters the MRO's document management environment, and may be further routed to a specialist shop that handles the specific repair. Each organization in that chain has its own ISMS, its own security posture, its own regulatory compliance state. The document's protection ends at each organizational boundary. Your ISMS says nothing about what happens to the file inside the next organization's systems.

This is not a failure of Part-IS as a regulatory framework. It is a structural limitation of any organization-level security model applied to data that moves across organizational boundaries.

"Your [container] security ends where the file does — and the file leaves the [container] every single day." That observation is especially acute in aviation: the file must leave the system. The maintenance workflow demands it.

The AMM's Journey Through the MRO Network

Walk through what a document's supply chain looks like in practice.

An OEM issues a service bulletin affecting the thrust reverser actuator on a widely operated narrowbody. The affected AMM revision is distributed to Part-145 approved MRO organizations, typically via an OEM-operated document distribution portal. From there:

• The MRO's technical documentation team ingests the revision into their own DMS — a SharePoint library, a Flatirons CORENA instance, or a custom-built document management environment.
• Line engineers access the relevant sections on tablets or workstations during the inspection.
• If the organization subcontracts any aspect of the task, the relevant CMM section goes to the subcontractor — typically by email or through a portal the subcontractor accesses with their own credentials.
• If the component is shipped to a specialist repair shop outside the main MRO facility, the CMM travels with it, either attached to the work order or downloaded to a local system at the repair station.

At each step, the document exists in a new environment that is outside the originating organization's ISMS. The ISMS compliance of the subcontractor, the repair station, the specialist shop — it is known only through the supplier qualification process. And supplier qualification processes assess compliance at a point in time, not continuously.

The AMM doesn't know it crossed an organizational boundary. It's a file. Without protection that travels with it, its security posture is determined by whichever system it currently lives in.

What Part-IS Compliance Requires at the Data Layer

EASA Part-IS compliance requires demonstrating control over safety-critical information assets. The ISMS framework mandates that organizations identify their information assets, assess risks to those assets, and implement controls proportionate to the risk.

For technical documentation that crosses organizational boundaries, the control that is proportionate to the risk is file-level protection, not perimeter protection.

An organization's firewalls, access controls, and authentication systems govern access to data within their environment. They provide strong evidence of ISMS implementation for their own boundary. They provide no evidence of what happens to the data after it leaves.

Per-file encryption with context-aware access controls addresses this gap directly. Each technical document carries its own encryption and access policy. The policy travels with the file into the receiving organization's system, into the subcontractor's DMS, into the specialist repair station. Access requires authentication against the originating organization's policy — not just a valid login to the receiving system.

The file defends itself. That's not a feature — it's the control model that Part-IS's intent requires when the data is as mobile as aviation maintenance documentation.

What This Means for Part-145 Compliance Demonstrability

When a Part-145 approved organization faces a regulatory audit of its ISMS, one of the central questions is: how do you demonstrate control over information assets that are distributed across your supply chain?

An audit of the internal document management environment demonstrates controls within the organizational boundary. It does not demonstrate controls over files that left the boundary as part of normal operational workflow.

Per-file audit logging changes this. Every access to a protected technical document — within the MRO's environment, at the subcontractor, at the remote repair station — generates an access event logged against the originating access policy. That log travels with the file, not with the system it's currently in.

The result is an audit record that spans the document's lifecycle across organizational boundaries: who accessed the AMM revision, when, on what device, in what geographic location, and under what access policy context. That's the evidence base Part-IS compliance actually requires for distributed technical documentation.

The Broader Aviation Supply Chain Risk

EASA Part-IS focuses on safety-relevant data. But the aviation maintenance supply chain also handles data that carries export control obligations — aircraft components that appear on ITAR or EAR control lists, technical data for defense programs where the platform has both civil and military variants, STC data packages for modifications developed under export-controlled programs.

An AMM or CMM for a component with dual-use or defense application isn't just a safety document. It's also a controlled technical data artifact with distribution restrictions that follow it regardless of which organization is handling it.

This makes the file-protection problem in aviation maintenance doubly acute: you need controls that satisfy Part-IS's ISMS requirements, and that enforce export-control distribution restrictions, without creating a friction that brings the maintenance operation to a halt.

Control that travels with the data — enforced at the file level, invisible to the engineer doing the work — is how those two requirements coexist.

Protect the Technical Document, Not the Folder

The aviation maintenance supply chain is one of the most complex data distribution networks in any regulated industry. An AMM revision touches dozens of organizations, dozens of systems, dozens of countries, before it reaches the engineer who needs it. Part-IS rightly demands that this data be governed with the rigor that aviation safety requires.

But the wall around the organization's ISMS isn't where the risk concentrates. The risk concentrates at every point where the technical document leaves one organizational boundary and enters another.

The Theodosian Walls of Constantinople defended the city — but the threat eventually came from a direction the walls weren't pointed. Aviation maintenance documentation is outside the walls before the pilot even leaves the gate.

The file needs to carry the wall with it.

FAQs: EASA Part-IS & Technical Data Security