The Federal Aviation Administration (FAA) has recently announced new cybersecurity regulations for newly built aircraft in order to protect aircraft manufacturers from potential cyber threats. The Notice of Proposed Rulemaking (NPRN) was proposed on August 21, 2024, with the aim of simplifying and expediting the new aircraft certification process while maintaining the same level of safety.
These proposed regulations are specifically designed to safeguard the equipment, systems, and networks of airplanes, engines, and propellers against intentionally unauthorized electronic interactions (IUEI) or cyber threats. The FAA’s goal is to reduce costs and time required to certify new and changed products, as well as harmonize regulatory requirements with other civil aviation authorities.
Under the proposed regulations, multi-engine aircraft with more than 19 passenger seats or a maximum takeoff weight over 19,000 pounds will be required to conduct a cybersecurity risk evaluation. Manufacturers will be expected to assess the severity of threat conditions on associated assets and implement mitigation strategies such as installing protection mechanisms.
The FAA emphasized the importance of protecting against unauthorized access and malicious modification of aircraft equipment, systems, and networks. Additionally, new regulations have been introduced to enhance the safety of engine and propeller systems susceptible to IUEI.
Currently, aircraft must meet airworthiness standards to obtain a US type certificate and have the certification validated by foreign authorities. The FAA’s new cybersecurity regulations aim to further strengthen the safety and security measures in place for newly built aircraft.