Sec. 571. Findings
406 words·~2 min read·
/bill/118/hr/3935/rh/section-571A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Congress finds the following: Congress has repeatedly tasked the Federal Aviation Administration with responsibility for securing the national airspace system, including the air traffic control system and other air navigation services, civil aircraft, and aeronautical products and articles through safety regulation and oversight. These mandates have routinely included protecting against associated cyber threats affecting aviation safety or the Administration’s provision of safe, secure, and efficient air navigation services and airspace management.
In 2016, Congress passed the FAA Extension, Safety, and Security Act of 2016, which established requirements for the Federal Aviation Administration to enhance the national airspace system’s cybersecurity and included mandates for the Administration to— develop a cybersecurity strategic plan; coordinate with other Federal agencies to identify cyber vulnerabilities; develop a cyber threat model; and complete a comprehensive, strategic policy framework to identify and mitigate cybersecurity risks to the air traffic control system.
In 2018, Congress passed the FAA Reauthorization Act of 2018 which— authorized funding for the construction of Federal Aviation Administration facilities dedicated to improving the cybersecurity of the national airspace system; required the Federal Aviation Administration to review and update its comprehensive, strategic policy framework for cybersecurity to assess the degree to which the framework identifies and addresses known cybersecurity risks associated with the aviation system, and evaluate existing short- and long-term objectives for addressing cybersecurity risks to the national airspace system; created a Chief Technology Officer position within the Federal Aviation Administration to be responsible for, among other things, coordinating the implementation, operation, maintenance, and cybersecurity of technology programs relating to the air traffic control system with the aviation industry and other Federal agencies; and directed the National Academy of Sciences to study the cybersecurity workforce of the Federal Aviation Administration in order to develop recommendations to increase the size, quality, and diversity of such workforce.
Congress has tasked the Federal Aviation Administration with being the primary Federal agency to assess and address the threats posed from cyber incidents relating to Federal Aviation Administration-provided air traffic control and air navigation services and the threats posed from cyber incidents relating to civil aircraft, aeronautical products and articles, aviation networks, aviation systems, services, and operations, and the aerospace industry affecting aviation safety or the provision of safe, secure, and efficient air navigation services and airspace management by the Administration.
Since 2005, the Federal Aviation Administration has been addressing cyber vulnerabilities in civil aircraft and aeronautical products and articles during the safety certification process.