August 18, 2026
by John Baich, SECC Chair & CBA ABIP Inspector
Sangre de Cristo Broadcast Consulting, LLC
We are just about six weeks from the new FCC Cybersecurity requirements. As expected, the Federal Communications Commission (FCC) issued a Final Rule in the Federal Register on July 31, 2026, designed to protect the Emergency Alert System (EAS) from hijacking, unauthorized access, and cyberattacks by foreign adversaries and cybercriminals. The rule takes effect on September 29, 2026.
Mandatory Cybersecurity Controls
EAS Participants must implement three primary technical safeguards across all EAS equipment, studio-transmitter link (STL) equipment, and remotely managed signal-processing gear:
- Password Hygiene & Authentication: Default passwords must be changed prior to operation. Passwords must be at least 15 characters long, non-dictionary based and not reused across multiple accounts. Alternatively, participants may implement equivalent robust authentication (e.g., multi-factor authentication or cryptographic tokens).
- Software & Firmware Patching: Participants are required to promptly test and apply security patches and updates issued by equipment manufacturers.
- Network Segmentation & Firewalls: Systems must use firewalls or comparable network segmentation practices to restrict remote administrative access strictly to authorized devices and users.
