The U.S. Federal Aviation Administration (FAA) has not fully carried out its strategy for protecting air traffic systems and other critical aviation networks while the Transportation Security Administration (TSA) continues to rely on an outdated cybersecurity plan that does not clearly assign responsibility for securing airlines and airports, according to a new federal audit.
An audit by the Government Accountability Office (GAO), Congress’ investigative arm, found the FAA had fully implemented only three of seven objectives supporting its goal of protecting and defending agency networks.
Work remained incomplete in several areas central to the security of the National Airspace System, including cyber monitoring and response, control over privileged users, compliance with current federal standards, and the transition to zero-trust security.
The findings come as aircraft systems are increasingly connected to air traffic control facilities, weather services, navigation systems, satellites, and other external networks.
Those connections make modern aviation more efficient, but they also create additional points through which an attacker could attempt to gain access or interfere with operations.
GAO said there have been no reported successful cyberattacks on aircraft avionics. The broader aviation sector has nevertheless been repeatedly targeted by state-sponsored actors, financially motivated groups, and hacktivists.
Cybersecurity incidents reported to the Cybersecurity and Infrastructure Security Agency across the aviation subsector rose from 290 in 2020 to 562 in 2022 before declining to 151 in 2024.
The total increased again to 352 in 2025. Those figures cover the wider aviation sector and do not represent successful intrusions into aircraft flight systems.
The vulnerabilities identified in reported incidents included poor software patching, Internet accessible operational technology, unsupported operating systems, insecure remote services, weak network segmentation, and default credentials.
Successful exploitation could disrupt communications with air traffic controllers, alter data used by cockpit systems, interfere with aircraft location information, or allow unauthorized access to aviation networks.
FAA and TSA are the two principal federal agencies responsible for aviation security and resilience, but their roles are different. FAA regulates aircraft safety, oversees the cybersecurity of avionics through its certification process, and operates the ground systems supporting the National Airspace System.
TSA oversees security programs maintained by airports and aircraft operators.
GAO found FAA’s cybersecurity strategy clearly assigned duties to seven agency organizations. TSA’s planning documents did not provide the same clarity.
TSA’s principal Cybersecurity Roadmap dates to 2018 and is no longer aligned with the Department of Homeland Security’s (DHS) current cybersecurity strategy, GAO said.
TSA also has not identified which of its offices are responsible for carrying out its goals, nor does it clearly define the agency’s cybersecurity responsibilities for overseeing airport and airline security programs.
The absence of clearly assigned responsibilities makes it more difficult for TSA to hold its own offices and regulated entities accountable, measure progress, or improve its aviation cybersecurity work, GAO said.
Several aviation industry representatives interviewed by investigators also said they had difficulty understanding TSA’s role. Representatives of one airline told GAO they believed TSA lacked the resources, expertise, and authority needed to regulate cybersecurity properly.
Confusion increased after TSA issued a Joint Emergency Amendment in March 2023 requiring covered airports and aircraft operators to include measures in their security programs to protect critical information technology, operational technology, and business support systems against disruption.
Some industry representatives had assumed that such cybersecurity requirements fell under FAA’s authority. FAA and TSA later worked together on guidance clarifying that resources connected to aircraft airworthiness were excluded from TSA’s requirement.
Congress also granted FAA exclusive authority over the cybersecurity of civil aircraft in the FAA Reauthorization Act of 2024.
Despite the uncertainty surrounding their separate responsibilities, GAO found that FAA and TSA worked effectively together through the Aviation Cyber Initiative, a joint effort involving the departments of Transportation, DHS, and Department of Defense.
The initiative met all eight of GAO’s leading practices for interagency collaboration, including defining common outcomes, assigning leadership, sharing resources, and establishing written agreements.
FAA also received favorable findings in several areas. GAO concluded that the agency’s current and proposed aircraft certification process addressed all of the federal and industry practices auditors identified for protecting avionics against cybersecurity risks.
FAA’s security authorization process for the ground systems it operates in the National Airspace System also met those practices.
The audit found more significant weaknesses in FAA’s plan for moving its networks to a zero-trust architecture.
FAA’s implementation plan fully addressed only three of seven migration practices recommended by the National Institute of Standards and Technology (NIST).
It did not contain detailed transition plans for the agency’s research and development environment and only partially addressed the identification of users, assets, data flows, and business processes across the agency’s other operating environments.
The omission is significant because research and development will support the continuing modernization of the National Airspace System.
GAO said FAA cannot be certain it is comprehensively managing the associated cybersecurity risks without applying zero-trust principles across all its operating environments.
Auditors also found FAA had not fully reported its cybersecurity spending to the Office of Management and Budget.
FAA’s annual budget requests identified several cybersecurity programs, including funding for network protection, secure remote access, authentication systems, and research into tools intended to detect and mitigate attacks on the aviation system.
The agency’s Information Security and Cybersecurity Program received requested funding of $6.4 million for fiscal year 2024, $5.9 million for 2025 and $4.6 million for 2026.
FAA did not include that research program in the cybersecurity spending data it submitted for the government-wide budget process.
Its internal reporting procedure collected information only for investments already listed in a prepopulated spreadsheet and did not direct program offices to add other cybersecurity spending.
FAA officials said the program had been included in the agency’s most recent submission for the fiscal year 2027 budget, but GAO said the agency had not provided evidence supporting that claim as of April.
The incomplete reporting could prevent Congress and executive branch officials from understanding how much FAA is spending on cybersecurity and complicate decisions about future funding, particularly as the agency tests AI, machine learning, and other technologies for aviation modernization.
GAO attributed FAA’s incomplete implementation of its cybersecurity strategy in part to the absence of a comprehensive monitoring process.
Although the strategy required participating offices to align their business plans with its objectives, only one of the seven applicable FAA entities provided evidence that it had done so.
FAA reported that it faced difficulties allocating resources through the federal budget process, recruiting specialized cybersecurity employees, protecting aging infrastructure, and reducing risks to operational technology without disrupting its mission.
While the agency adopted a revised Cybersecurity Strategy in March and now plans to develop a centralized implementation plan and performance measures for tracking progress, GAO said FAA must ensure that its Cybersecurity Steering Committee conducts monitoring and incorporates lessons from the failure to track the earlier strategy.
GAO issued five recommendations. It called on TSA to update its Cybersecurity Roadmap, assign responsibility for carrying out its goals, align the document with the DHS strategy, and communicate the revised plan to nonfederal aviation stakeholders.
The watchdog recommended that FAA capture all cybersecurity spending in its budget reporting, develop transition steps for every operating environment, bring its zero-trust plan into full alignment with NIST guidance, and ensure that implementation of its revised cybersecurity strategy is monitored.
Article Topics
cybersecurity | GAO (Government Accountability Office) | TSA | U.S. Government | zero trust
