Six months have passed since the compliance deadline for Part-IS has passed for DOA and POA (February this year).
Plenty of SME organisations met it the way they meet most new requirements: a dedicated information security management system, bolted on the DMS, satisfying the letter of Regulation, largely separate from how design and compliance data actually flows, day to day.
Let me ask a provocative question: what about if those same organisaitons would not think about is as an IT project, but as a safety compliance-infrastructure project wearing a cybersecurity label? (which I believe it is).
That separation is in fact the gap Part-IS was meant to close. The regulation isn't only asking whether you have an ISMS. It's asking whether information affecting the safety of your designs (including who can change compliance evidence, and how you'd know if something had been altered) is actually protected as part of your working process, not documented as a parallel one.
Organisations whose compliance data already lives in a single structured, access-controlled model found Part-IS was mostly a formality. Organisations where compliance evidence is scattered across shared drives, email and personal folders found it exposed a much older problem that cybersecurity language happened to surface.
Six months in: was Part-IS a genuine change to how you manage compliance data, or a new document sitting beside the old process?