FCC EAS Cybersecurity Requirements | Hurley Technical Solutions

What changed

Three required security controls

FCC 26-38 adds paragraph (d) to 47 CFR § 11.35. The rule applies to EAS equipment, studio-transmitter-link equipment, and remotely managed equipment that routes, processes, or inserts content into a station's programming.

Secure authentication

Change every default password before equipment is used to broadcast. Passwords must contain at least 15 characters, must not use dictionary words, and must not be reused on other accounts, equipment, applications, or services. Change a password whenever compromise is suspected.

Prompt security updates

Promptly test and install security patches and security-related software or firmware updates issued by equipment manufacturers. Testing is allowed, but it must begin promptly and finish within a timeframe consistent with industry best practices.

Restricted remote access

Use a network firewall or comparable network-segmentation practice to limit remote-management access to authorized devices and authorized users.

Alternative authentication is permitted. The rule allows reasonably sufficient alternatives to a qualifying password, including one-time-password devices, out-of-band methods, and cryptographic authentication.

Station compliance review checklist

Inventory the EAS encoder/decoder and all remotely managed equipment in the station's program chain.
Identify and change every factory-default credential before broadcast use.
Replace passwords that are shorter than 15 characters, use dictionary words, or are reused elsewhere.
Confirm that current vendor security patches, software updates, and firmware updates have been tested and installed.
Document equipment models, firmware versions, update dates, and responsible staff.
Review all internet-facing and remote-management services.
Place covered equipment behind an appropriately configured firewall or comparable network segmentation.
Limit remote access to specifically authorized users and devices.
Remove unused accounts, services, port forwards, and vendor access paths.
Create a process for responding to suspected credential compromise.

What this means for smaller stations

The controls are practical, but the scope can extend beyond the EAS unit itself. Internet-accessible codecs, remote-control devices, studio-transmitter links, automation or playout systems, and other remotely managed devices may require review when they route, process, or insert programming content.

Start with an accurate equipment inventory. A station cannot secure, patch, or segment equipment it has not identified.

FCC EAS cybersecurity requirements now in effect