Key Takeaways
- The Government Accountability Office (GAO) found that the FAA has fully met only three of seven network‑protection goals in its 2020 Cybersecurity Strategy.
- Critical gaps remain in real‑time monitoring, user access controls, alignment with NIST standards, and a complete zero‑trust architecture plan.
- The TSA has not defined its cybersecurity responsibilities or identified the offices tasked with carrying them out, creating confusion among airlines and regulators.
- Stakeholders expressed doubts about the TSA’s resources, authority, and expertise, and some mistakenly believed the FAA remained their cybersecurity regulator.
- Because the National Airspace System’s ground‑based and airborne systems are tightly interconnected, overlapping roles increase risk unless responsibilities are clarified.
- GAO recommends that the TSA update its cybersecurity roadmap and communicate changes, while the FAA should finalize a comprehensive zero‑trust plan, align it with NIST guidance, and strengthen oversight of its strategy implementation.
- The Department of Homeland Security agreed to modernize the TSA’s plan by May 2027; the Department of Transportation pledged to address the FAA’s shortcomings and provide a status update within 180 days.
- Persistent weaknesses heighten the aviation sector’s vulnerability to nation‑state cyberattacks aimed at disrupting U.S. operations abroad.
Overview of the GAO Report
The Government Accountability Office released a Thursday audit highlighting that the agencies charged with safeguarding the U.S. aviation system—namely the Federal Aviation Administration (FAA) and the Transportation Security Administration (TSA)—have only partially implemented essential cybersecurity improvements. The report warns that lingering weaknesses persist at a moment when nation‑state hackers are increasingly probing ways to destabilize American society to deter U.S. involvement in foreign conflicts. It stresses that commercial flight operations depend on tightly linked onboard and ground‑based systems within the National Airspace System (NAS), making them inherently more susceptible to exploitation.
FAA Cybersecurity Strategy Implementation Gaps
The FAA’s 2020 Cybersecurity Strategy set seven objectives under the network‑protection goal of defending agency networks, including those that steer aircraft through U.S. airspace. Auditors found that the agency has fully achieved only three of those objectives: enhancing threat intelligence collection and dissemination, improving threat detection and mitigation, and integrating cybersecurity research into defensive efforts. The remaining four objectives—strengthening monitoring, detection, and response capabilities; refining user access controls and activity monitoring; aligning security controls with NIST guidelines; and deploying a zero‑trust architecture—remain incomplete or only partially addressed.
Specific Deficiencies in Monitoring, Access Controls, and NIST Alignment
Among the unmet goals, the FAA lagged notably in establishing near‑real‑time cyber monitoring for 35 critical systems that still lack such capability. The agency also fell short on improving user access controls and monitoring user activity, which are vital for preventing insider threats and unauthorized access. Furthermore, the FAA has not fully aligned its security controls with the National Institute of Standards and Technology’s (NIST) frameworks, leaving gaps in standardized risk management practices. These shortcomings collectively hinder the FAA’s ability to detect intrusions swiftly and enforce least‑privilege principles across its environment.
Zero‑Trust Architecture Efforts Stalled
Zero‑trust architecture, regarded by experts as a cornerstone for limiting lateral movement after a breach, remains an unfinished initiative for the FAA. GAO’s audit revealed that the agency’s zero‑trust migration plan omits crucial details about applying the model to research and development (R&D) systems and fails to incorporate all of NIST’s zero‑trust recommendations. Specifically, the plan lacks a NIST‑prescribed description of how the FAA will identify and protect assets in its R&D environment and does not include monitoring mechanisms for the zero‑trust policy engine that autonomously grants or denies access. Without full alignment with NIST best practices across all operating environments, the FAA cannot guarantee comprehensive cybersecurity risk management during NAS modernization.
TSA’s Undefined Cybersecurity Responsibilities
While the FAA focuses on aircraft safety and air traffic guidance, the TSA is tasked with regulating cybersecurity practices at‑based airline operations, covering network protection and incident reporting. However, the GAO found that the TSA has yet to specify how it will fulfill those responsibilities or to designate the offices and teams responsible for achieving its cybersecurity goals. This lack of definition has sparked concern across the aviation sector, with stakeholders questioning the agency’s capacity to enforce cybersecurity standards effectively.
Stakeholder Concerns and Role Confusion
Interviews with eleven selected aviation stakeholders revealed widespread unease about the clarity of the TSA’s role. One airline asserted that the TSA “lacked the resources, authority, and expertise to properly regulate cybersecurity,” while three other stakeholders noted that TSA regulations issued in March 2023 created confusion because they believed the FAA remained their cybersecurity regulator. A 2024 law later clarified that the FAA holds exclusive authority to issue cybersecurity rules for civil aircraft, but the prior ambiguity had already eroded confidence in the TSA’s regulatory capability.
Interconnectivity Leading to Overlapping Roles
The GAO warned that the deep interconnectivity between the systems regulated by the TSA (airport and airline ground networks) and those overseen by the FAA (airborne flight‑control and navigation systems) creates an appearance of overlapping responsibilities. Until the TSA updates its Cybersecurity Roadmap to explicitly delineate its aviation cybersecurity duties, the agency cannot fully hold relevant entities accountable or drive continuous improvements. Clear role separation is essential to avoid duplication of effort and to ensure that vulnerabilities in either domain are not overlooked.
GAO Recommendations and Agency Responses
Based on its findings, GAO urged the TSA to revise its cybersecurity plan, communicate updates to stakeholders, and clarify its responsibilities. For the FAA, auditors recommended completing a comprehensive zero‑trust migration plan that aligns with all NIST guidance, improving oversight of the overall cybersecurity strategy, and addressing the four outstanding network‑protection objectives. The Department of Homeland Security, which oversees the TSA, accepted the TSA‑specific recommendation and pledged to modernize the agency’s cybersecurity plan by the end of May 2027. The Department of Transportation, overseeing the FAA, agreed to implement the four FAA‑focused recommendations and committed to delivering a status update to GAO within 180 days.
Implications for Aviation Security Amid Nation‑State Threats
The report underscores that persistent cybersecurity weaknesses in the FAA and TSA leave the nation’s aviation infrastructure exposed to sophisticated adversaries. Nation‑state actors seeking to undermine U.S. influence abroad could target the NAS to disrupt air travel, compromise flight‑safety data, or erode public confidence. Because aviation safety depends on the seamless, secure interaction of airborne and ground‑based systems, any gap—whether in monitoring, access control, zero‑trust enforcement, or regulatory clarity—creates a potential entry point for exploitation. Timely remediation of the identified deficiencies is therefore critical to safeguarding both national security and the reliability of the commercial aviation sector.
Conclusion
The GAO audit paints a picture of an aviation cybersecurity posture that is progressing but still incomplete. While the FAA has made strides in threat intelligence and detection, significant work remains in monitoring, access controls, NIST alignment, and zero‑trust deployment. Simultaneously, the TSA must articulate its regulatory role and build the capacity to enforce cybersecurity standards across airports and airlines. Addressing these gaps, as outlined by GAO’s recommendations and accepted by the overseeing departments, will be essential to fortify the National Airspace System against the growing specter of state‑sponsored cyber threats. Only through coordinated, transparent, and fully resourced efforts can the United States ensure the resilience of its aviation infrastructure in an increasingly hostile cyber landscape.