From 16 October 2025, civil aviation organisations will need to comply with new EASA rules on information security.