Available
Part-IS ISMS starter pack
Organise the scope, policy, risk records, incident arrangements and evidence for an information security management system with an aviation-safety focus.
Problem
Information security work needs a defined scope and a recorded link to aviation safety. Policies, risks, interfaces and incident arrangements need to fit the existing management system. This pack provides working documents for that preparation.
Outcome
Organise the scope, policy, risk records, incident arrangements and evidence for an information security management system with an aviation-safety focus.
What’s included
Ten editable documents and three worksheets, supplied as DOCX, XLSX and ZIP
- Teaching example – synthetic (DOCX, Examples/worked-example.docx)
- Part-IS applicability and scope (XLSX, Working/A-applicability-scope.xlsx)
- Information security policy (DOCX, Working/B-information-security-policy.docx)
- Information security risk assessment method (DOCX, Working/C-risk-assessment-method.docx)
- Part-IS element, interface and risk register (XLSX, Working/D-asset-risk-register.xlsx)
- Information security event detection, response, recovery and reporting (DOCX, Working/E-incident-response-procedure.docx)
- ISMS change management and management review (DOCX, Working/F-change-and-review.docx)
- Part-IS evidence index and cross-reference (XLSX, Working/G-evidence-index.xlsx)
- Sources and applicability (DOCX, Working/Sources.docx)
- AI walkthrough brief – Part-IS ISMS Starter Pack (DOCX, Working/ai-walkthrough-brief.docx)
- Your first session and handover (DOCX, Working/first-session.docx)
- Start here – Part-IS ISMS Starter Pack (DOCX, Working/guide.docx)
- Part-IS readiness checklist (DOCX, Working/one-page-checklist.docx)
Who it’s for
- Smaller aviation organisations examining whether Part-IS applies to them.
- People preparing and reviewing ISMS records within an existing management system.
What this is not
- This is an ISMS documentation starter, not certification, an approval by an authority or legal advice.
- It does not assess or audit your organisation, supply security tooling or a technical controls catalogue, or cover the competent authority’s own Part-IS requirements.
FAQ
What do we need to start?
Identify your organisation, activities, interfaces and responsible checker. Check scope and exclusions first, then record your own evidence and unresolved points before making operational or regulatory decisions.
Are worked examples included?
Yes. Synthetic teaching records are supplied separately in Examples. Replace their invented facts with your own evidence; they are not operational permissions or accepted risks.
Does it replace our manual or existing arrangements?
It is intended to sit within your existing system. You must establish the applicable scope and complete the policy, methods, procedures and evidence; the pack does not deliver a completed or assessed ISMS.
Which sources does the pack refer to, and where do we check them?
Sources.docx refers to Regulations (EU) 2022/1645 and 2023/203, EASA information-security guidance and the Norwegian implementation source. Check whether they apply to you, including exclusions and the relevant route, and confirm the current consolidated text and authority procedure using the linked sources.
What happens when rules or operations change?
Review the scope, records and procedures when rules, operations or authority conditions change. Use the change and management-review templates and retain a traceable evidence index.
Who owns the content we write in it?
You may fill in, adapt and build on the templates, forms, registers and worksheets and use the result as your own operational document. You may give the completed result, but not the pack itself, to a regulator, auditor, insurer or client. You may not redistribute the pack or use it to deliver paid services to third parties.
Price
The entry price is EUR 149 / NOK 1 590, excluding value added tax.
| Licence | One-off, excluding MVA | Optional annual updates, excluding MVA | One-off in Norway, including 25% MVA |
|---|---|---|---|
| Personal, one named user | EUR 149 / NOK 1 590 | EUR 49 / NOK 520 | NOK 1 987.50 |
| Organisation, one legal entity | EUR 399 / NOK 4 290 | EUR 129 / NOK 1 390 | NOK 5 362.50 |
Personal to Organisation upgrade, for the difference between the two current list prices: EUR 250 / NOK 2 700, excluding value added tax.
The purchase is perpetual and the update subscription is optional. If you subscribe, you receive revised files when the regulatory baseline changes; if you let it lapse, you keep everything you already have. A lapsed subscription costs you updates, never access.
Licence and VAT
Personal, one named user and Organisation, one legal entity. Both are one-off and perpetual: you keep the files.
How merverdiavgift is charged
The seller is RMX DRIFT AS, organisation number 931 140 574, registered for merverdiavgift in Norway. Every product here is an electronic service for MVA purposes, so the rate is decided by where you are established and whether you are buying as a business or as a private individual.
If you are in Norway, you are charged 25 per cent MVA on top of the kroner list price. The final column above is that total, and it is the amount a private buyer in Norway pays. A Norwegian business or public body is charged the same 25 per cent and can normally reclaim it as input MVA through its own return, so the ex-MVA column is the real cost to you.
If you are a business or public body established outside Norway, the sale is zero-rated as a remotely deliverable service under merverdiavgiftsloven section 6-22. You are charged the list price with no Norwegian MVA added, and you account for any VAT due in your own country under the reverse charge. Enter your organisation or VAT number at checkout: without it we cannot treat the sale as a business supply and MVA is added.
We do not currently sell to private individuals outside Norway. A sale to a consumer in another country would make us liable to register and account for that country’s VAT from the first sale, and we have chosen not to take that on until the volume justifies it. If you are buying for professional use, purchase through your employer or company and enter its number, or get in touch.
Prices are reviewed twice a year and the two currency lists are held close to parity, so switching currency saves you almost nothing. Nothing on this page is tax advice; if your situation is unusual, ask your own adviser.