We’re ISO 27001 certified. Does that cover Part-IS?
The aviation cybersecurity community
Your auditor has questions. Your peers have answers.
Peers and specialists across information security, aviation security and aviation safety, whichever framework your auditor brought.
Join cyberNERD€39.00 a month per person. Less for teams.
Example thread
cyberNERD consultant
Great head start, not a pass. EASA doesn’t credit the certificate, but its official mapping shows what to add, starting with aviation safety impact in your risk assessment.
Built for whoever signs the security bit
- Accountable managers
- ISMS managers
- CISOs
- Compliance managers
- Safety managers
- Practitioners
- Operators
- CAMOs
- Part-145
- Aerodromes
- ANSPs
- DOA and POA holders
What’s inside
People in the same audit
Ask the question you can’t ask your regulator. Someone here has already answered it.
Consultants in the forum
cyberNERD consultants take part in the discussions.
Threat intel for aviation
What a vulnerability means for flight safety, in plain words. Members only.
Library, events, digests
Templates, guides, sessions and a digest that respects your inbox.
Threat intel that speaks flight ops
Example entry
Vulnerability CVE-2023-4966, NetScaler ADC and Gateway. NVD 7.5 HIGH; Citrix 9.4 CRITICAL. On CISA KEV. Used against Boeing Distribution Inc. (advisory AA23-325A).
What it means for you If staff or contractors reach your systems through an unpatched NetScaler or Citrix Gateway, attackers can steal live sessions and log in as your users without a password or MFA.
What to do this week 1. Patch and reset: fixed builds 14.1-8.50, 13.1-49.15, 13.0-92.19 or later (replace end-of-life 12.1), then kill all active and persistent sessions. Maps to vulnerability management: ISO 27001 A.8.8 "Management of technical vulnerabilities"; NIS2 Art 21(2)(e). 2. Check who connects in: ask remote MRO, IT and ops software providers whether they patched and record it as supplier risk: ISO 27001 A.5.19 to A.5.22; Part-IS IS.I.OR.205(b); NIS2 Art 21(2)(d); US defence supply chain: DFARS 252.204-7021 flowdown.
Sources https://nvd.nist.gov/vuln/detail/CVE-2023-4966 https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
Members get these when it matters, not when a vendor wants a webinar signup.
Five frameworks. One crew room.
ISO/IEC 27001:2022
The voluntary, certifiable ISMS standard most aviation organisations already use. Certificates to the 2013 edition ended on 31 Oct 2025.
EASA Part-IS
EU rules (Regulations 2022/1645 and 2023/203) requiring approved and declared aviation organisations to manage information security risks to aviation safety. Applies from 16 Oct 2025 for design, production and aerodromes, and from 22 Feb 2026 for most others. Ground handling follows on 27 Mar 2031.
EU NIS2
The EU cybersecurity directive (2022/2555), applied through national law since 18 Oct 2024. In aviation it covers airlines, airports and air traffic control providers, generally medium-sized or larger.
EU CRA
EU rules (2024/2847) for products with digital elements. Products certified under EU aviation safety rules are excluded, so in aviation it mainly hits ground software, ops tools and connected equipment. Reporting of actively exploited vulnerabilities since 11 Sep 2026; full application 11 Dec 2027.
US DoD CMMC
For defence contractors and subcontractors anywhere that handle FCI or CUI under DoD contracts, including aerospace suppliers through flowdown. Phase 1 self-assessments since 10 Nov 2025. Phase 2 (third-party assessments) suspended since 13 Jul 2026.
Simple pricing, cheaper together
| Seats | Per person |
|---|---|
| 1 to 4 | €39.00 |
| 5 to 9 | €29.00 |
| 10 to 50 | we’ll set a price together |
Prices exclude VAT. US billing is in USD. You manage your team’s seats.
Billed monthly. Cancellation takes effect at the end of the period you’ve paid for. Removing a seat waits until renewal.
Join cyberNERDMade by NERD.aero
We build software and run security compliance work for aviation. cyberNERD is where that work meets the people doing it. Part-IS.eu is joining the family.
NERD.aero Part-IS.eu
Fair questions
Is there a free tier?
No. Members pay, so the room stays useful and vendor-free.
Can I start alone and add my team?
Yes. Add seats from your group settings. Your price drops when you cross a tier.
Who’s in the room?
Security, compliance and safety people from aviation organisations. No sales pitches allowed.
Can I cancel?
Yes. You keep access until the end of the period you’ve paid for. Seats you remove drop off at renewal.
Bring your audit questions. Leave with answers.
Join cyberNERD€39.00 a month per person. Less for teams.