Home | Luka Pace Bonello

Bridging the Gap
Between Aviation Safety & Information Security.

Turning information security into a practical, trusted part of aviation safety.

About

ABOUT LUKA PACE BONELLO

Hi, I'm Luka.

Aviation runs on trust - trust in the aircraft, the data, and the systems that keep operations safe. When cybersecurity isn't managed properly, that trust is at risk.

I help aviation organisations achieve EASA Part-IS compliance pragmatically - building information security management systems that integrate with existing safety management approaches, satisfy the regulation, and don't turn operations upside down.

Because in aviation, security exists to protect safety. Not the other way around.

Read Luka's Story

TRAINING COURSES

Explore Luka's comprehensive training courses designed to equip you with the latest knowledge and practical skills in aviation cybersecurity.

View Courses

PUBLICATIONS

Read Luka's latest publications on aviation cybersecurity and EASA Part-IS.

All Publications

Two technicians in a hangar: one checks server cables in an unlocked server cabinet, the other talks on a phone by computers with warning screens pointing to an incident. Text: Vulnerabilities vs. Incidents.

EASA Part-IS: How to Tell the Difference Between a Vulnerability and an Incident (And Why You Must)

Understanding the distinction between vulnerabilities and incidents is critical for effective EASA Part-IS compliance. This article provides a clear, practical breakdown of IS.I.OR.220, helping organisations correctly assess, manage, and respond to each. It offers structured guidance to strengthen your ISMS, support informed decision-making, and ensure a proactive, risk-based approach to aviation information security.

Luka Pace Bonello

4 days ago6 min read

Information Security Risk Treatment under EASA Part-IS: A Practical Guide

How should aviation organisations treat information security risks under EASA Part-IS? This article explains how unacceptable cyber risks should be reduced, documented, and managed in practice under IS.I.OR.210. Using a realistic flight operations example, it shows how aviation organisations move from risk identification to effective risk treatment while protecting aviation safety.

Luka Pace Bonello

Mar 136 min read

People looking at a CAMO system displaying an image of an aircraft engine design.

How to Assess Information Security Risks Under EASA Part-IS: A Practical Safety-Focused Approach

Assessing information security risks under EASA Part-IS requires more than technical analysis. It demands a structured, safety-focused approach that identifies how compromised information could affect safe operations. Using a practical CAMO maintenance data scenario, this article breaks down how to evaluate impact, reason through likelihood, derive risk, and ensure assessments are aligned with aviation safety principles.

Luka Pace Bonello

Feb 266 min read

Bridging the Gap Between Aviation Safety & Information Security.

Turning information security into a practical, trusted part of aviation safety.

ABOUT LUKA PACE BONELLO

TRAINING COURSES

PUBLICATIONS

EASA Part-IS: How to Tell the Difference Between a Vulnerability and an Incident (And Why You Must)

How to Reduce Information Security Risk Under EASA Part-IS

Information Security Risk Treatment under EASA Part-IS: A Practical Guide

EASA Part-IS: How to Tell the Difference Between a Vulnerability and an Incident (And Why You Must)

Information Security Risk Treatment under EASA Part-IS: A Practical Guide

How to Assess Information Security Risks Under EASA Part-IS: A Practical Safety-Focused Approach

Bridging the Gap
Between Aviation Safety & Information Security.