The Federal Aviation Administration (FAA) has rolled out new cybersecurity rules for newly constructed aircraft in order to safeguard aircraft manufacturers from potential cyber threats.
The fresh Notice of Proposed Rulemaking (NPRN), put forth by the FAA on August 21, 2024, seeks to amend existing regulations and introduce new ones. The FAA’s objective is to streamline and expedite the certification process for new aircraft while upholding the same level of safety as current standards.
The proposed regulations are crafted to shield airplanes, engines, and propellers’ equipment, systems, and networks from intentionally unauthorized electronic interactions (IUEI) or cyber threats.
The FAA stated that the aim of the initiative is to “cut down on the costs and time needed to certify new and modified products and align FAA regulatory requirements with those of other civil aviation authorities.”
As per the proposed rules, multi-engine aircraft with over 19 passenger seats or a maximum takeoff weight exceeding 19,000 pounds (approximately 8618.25 kilograms) will be mandated to carry out a cybersecurity risk assessment.
The FAA anticipates that this evaluation will “evaluate the severity of the impact of threat conditions on related assets (system, architecture, etc.), in line with the means of compliance the applicant has been utilizing to meet the FAA’s special conditions on this subject.”
Subsequently, each applicant will be required to “address” the vulnerabilities. The agency foresees that such mitigation will involve the installation of single or multiple layers of protective mechanisms by the applicant. Moreover, each manufacturer must incorporate these procedures in their maintenance instructions to uphold these protections.
To combat security risks, manufacturers must fend off unauthorized access from within or outside the aircraft and thwart malicious alterations to aircraft equipment, systems, and networks.
Furthermore, the FAA has tabled new regulations to enhance the safety of any engine and propeller systems integrated into airplanes, equipment, and networks that are susceptible to IUEI.
Presently, an aircraft must meet airworthiness criteria to secure a US type certificate and have the certification validated by foreign authorities.