Targeted Cybersecurity Rules for EAS Participants
In a Report and Order adopted on June 25, 2026, and released on June 29, 2026 (FCC 26-38), the Federal Communications Commission established mandatory, targeted cybersecurity safeguards for Emergency Alert System (EAS) participants. The requirements apply to EAS equipment, studio transmitter link (STL) equipment, and any remotely managed equipment that routes, processes, or inserts content into a participant's programming stream.
The Commission's action responds directly to cyber incidents where threat actors exploited remotely accessible equipment in broadcast signal processing systems to broadcast unauthorized audio and alert tones. Rather than imposing broad cybersecurity risk management plans, the Commission selected three foundational cybersecurity hygiene measures.
- Password Security: Mandates changing factory-set default passwords prior to operation, using strong passwords (minimum of 15 characters without dictionary words) or sufficient alternative authentication measures (such as look-up secrets, out-of-band devices, or cryptographic authenticators), prohibiting password reuse across other systems, and changing credentials upon suspicion of compromise.
- Patch and Upgrade Management: Requires prompt testing and installation of security patches and security-related software and firmware upgrades issued by manufacturers.
- Network Segmentation: Mandates placing vulnerable and remotely accessible equipment behind a network firewall or using comparable network segmentation (such as VLANs or DMZs) to restrict remote management access exclusively to authorized users and devices.
- Implementation Timeframe: Compliance is required within 60 days following publication in the Federal Register.
Docket Termination and Grant of NAB Petition
The Commission terminated the broader 2022 Alerting Security rulemaking proceeding in PS Docket No. 22-329. After reviewing the record, the FCC determined that mandating comprehensive annual cybersecurity risk management plans and breach reporting would place disproportionate financial and administrative burdens on participants, particularly smaller and noncommercial broadcasters, without offering commensurate security gains beyond specific technical controls.
Additionally, the Commission granted the Petition for Rulemaking filed by the National Association of Broadcasters (NAB) on March 31, 2025. In doing so, the Commission commenced a rulemaking proceeding exploring the permissive use of software-based EAS solutions in place of dedicated physical hardware appliances.
- Termination of PS Docket No. 22-329 closing the 2022 Alerting Security NPRM proceeding.
- Formal grant of NAB's Petition for Rulemaking under 47 CFR § 1.407.
Proposals in the Further Notice of Proposed Rulemaking
The accompanying Further Notice of Proposed Rulemaking (FNPRM) in PS Docket Nos. 25-224, 15-94, and 15-91 seeks public input on a series of technical and regulatory proposals designed to enhance the reliability, geographical accuracy, and effectiveness of both EAS and Wireless Emergency Alerts (WEA).
- EAS Message Authentication: Proposing to require EAS participants to configure their equipment to reject Common Alerting Protocol (CAP) messages that do not contain a valid digital signature, while seeking comment on methods and feasibility for authenticating legacy audio-encoded EAS protocol alerts.
- Universal Alert Message Identifier: Proposing a universal identifier for WEA messages to suppress duplicate alerts when consumer devices switch between network technologies or roam across service providers.
- Consistent WEA Retransmission: Proposing that participating Commercial Mobile Service (CMS) providers rebroadcast active WEA messages once every 60 seconds throughout the alert duration, while ceasing retransmission 5 minutes prior to expiration for 24-hour alerts.
- Eliminating WEA Geotargeting Exceptions: Proposing to sunset legacy network and device exceptions and eliminate the 0.1-mile overshoot exception for devices with location services disabled, requiring location fixes for incoming WEAs while restricting data usage and ensuring immediate data deletion.
- Permissive EAS Software: Proposing rules to permit software-based EAS encoders and decoders operating at local participant facilities (such as studios, transmitter sites, or headends), excluding cloud-based architectures, and establishing a 72-hour repair notification window under 47 CFR § 11.35.
- Retiring 90-Character WEA Messages: Proposing to sunset the requirement for CMS providers to transmit 90-character versions of alert messages, standardizing exclusively on the 360-character maximum format.
- Standardized Symbology and Earthquake TTS: Seeking comment on standardized incident symbology for EAS visual crawls and WEA displays, as well as mandatory text-to-speech announcement for ShakeAlert earthquake early warnings.
Procedural Matters and Comment Deadlines
The proceeding is designated as permit-but-disclose under the Commission's ex parte rules. Comments on the Further Notice of Proposed Rulemaking are due 30 days after publication in the Federal Register, and reply comments are due 60 days after Federal Register publication.
Submissions may be filed electronically via the FCC's Electronic Comment Filing System (ECFS) under PS Docket Nos. 25-224, 15-94, and 15-91.
- Comment Deadline: 30 days after Federal Register publication.
- Reply Comment Deadline: 60 days after Federal Register publication.
- Bureau Contacts: George Donato and David Kirschner, Public Safety and Homeland Security Bureau.