Congressional watchdog says aviation cybersecurity gaps at TSA and FAA fall short of federal standards

A congressional watchdog report released Tuesday warns that cybersecurity practices tied to civil aviation have key shortfalls, and that the Transportation Security Administration and the Federal Aviation Administration are not fully meeting applicable federal standards. The report describes a risk landscape in which aviation stakeholders receive mixed indicates about expectations while agencies still have gaps in how cybersecurity responsibilities are implemented and tracked.

According to the report summarized by The Washington Times, oversight of aviation-related cyber risk involves both TSA and the FAA, with responsibilities that span operational systems and the broader aviation information environment. The watchdog’s central concern is that the agencies’ current approach does not consistently align with federal cybersecurity requirements, leaving areas where protections may be incomplete or uneven across programs.

The report also characterizes communication and coordination as a problem, saying stakeholders are receiving inconsistent guidance. In practice, such gaps can complicate how aviation organizations plan remediation, budgeting, and implementation timelines when the federal expectations they are being asked to meet are not clearly defined or uniformly enforced.

The watchdog findings place additional scrutiny on how federal agencies validate that cybersecurity controls are in place and working as intended, rather than simply documenting policies on paper. The report’s emphasis on falling short of federal standards suggests the agencies face issues in measurement, reporting, or the ability to demonstrate compliance with established requirements.

The report arrives as aviation continues to rely on complex technology for safety-critical operations and passenger-facing services, increasing the potential operational consequences of cyber incidents. While federal requirements exist to drive risk management across agencies, the watchdog’s account indicates that aviation cybersecurity governance has not fully caught up with those standards.

No specific legislative or regulatory actions were described in the reporting summarized in the article, but the watchdog’s warnings to Congress indicate lawmakers may seek hearings, targeted inquiries, or agency follow-up requests tied to cybersecurity implementation and compliance timelines.

The agencies’ next steps, as characterized by the report, would likely involve addressing identified gaps, strengthening coordination, and improving how expectations are communicated to affected aviation stakeholders, in order to bring aviation cybersecurity practices in line with federal requirements.