Cybersecurity Policy Report, GAO: TSA Should Update Cybersecurity Strategy, (Jul 16, 2026)
The Transportation Security Administration should update its 2018 cybersecurity road map to align it with the Department of Homeland Security’s cybersecurity strategy and “define the agency’s cybersecurity-related roles and responsibilities in overseeing airport and aircraft operator security programs,” the Government Accountability Office said in a report published today.
The report, required by the FAA Reauthorization Act of 2024, examines whether TSA and the Federal Aviation Administration are fulfilling their cybersecurity responsibilities.
“Aircraft depend on avionics and ground systems to get from one place to the next safely. The growing interconnectivity of these aviation systems to support flight operations has increased their exposure to cyber-based threats. As a result, cybersecurity remains a fundamental consideration for FAA and TSA leadership in the aviation subsector,” GAO noted.
“FAA has taken steps to define its roles and responsibilities for aviation cybersecurity, to include overseeing avionics and managing ground systems in the NAS [national airspace system],” it said.
“However, TSA’s Cybersecurity Roadmap does not describe the agency’s cybersecurity-related roles and responsibilities for overseeing airport and aircraft operator security programs or identify the TSA entities responsible for implementing the goals and objectives it outlines. Without clearly defined roles and responsibilities, TSA may be challenged in holding relevant entities accountable or enable continuous improvements to its related efforts,” it said.
“The Administrator of TSA should update the TSA Cybersecurity Roadmap to define the roles and responsibilities for the TSA entities responsible for carrying out the goals and objectives described within it, including for the aviation subsector, and align the roadmap with the DHS Cybersecurity Strategy. The TSA Administrator should communicate its Cybersecurity Roadmap to appropriate non-federal stakeholders,” GAO recommended.
It also recommended that the FAA “update the agency’s cyber budget data request process to ensure that it includes all cybersecurity spending from program offices” and provide more detail in its plan to implement “zero-trust” network architecture. The FAA and TSA agreed with its findings, GAO said.
News: FederalLegislation DataSecurity