Air Traffic Control North America Aviation Safety & Regulation Policy & Regulation Cybersecurity (Cyber Threats & Protection)

DOT OIG audit: FAA delinquent on cybersecurity baseline controls for high-impact air traffic control systems

The Department of Transportation Office of Inspector General says the FAA has not implemented baseline security controls for a significant share of its “high-impact” air-traffic-control systems—meaning critical elements of the National Airspace System have run with known cybersecurity gaps. The audit frames persistent compliance shortcomings and urges corrective action.

Discovered 2026-04-12T21:04:59.869097-07:00 | 2026-04-12T21:04:59.869097-07:00

Briefing

What Hype is tracking

Cybersecurity controls are not being treated as a basic requirement across the FAA’s most critical ATC systems, increasing operational risk even without an attack event (see related context on FAA’s next-gen ATC software platform selection in FAA short-lists competitors for next-gen ATC software platform as DOT prepares additional funding request).
For operators and avionics/ATC suppliers, the audit signals gaps that can affect procurement requirements, integration plans, and acceptance timelines as modernization rolls forward.
The findings add to a broader pattern of FAA oversight strain highlighted in other DOT watchdog reviews, including resourcing-related weaknesses that undermine safety oversight (DOT watchdog: FAA staffing shortfalls weakened oversight of United Airlines maintenance).

Reported By

aeroxplorer.com AINonline fdd.org