Cyber AIR Act

To require the disclosure of information relating to cyberattacks on aircraft systems and maintenance and ground support systems for aircraft, to identify and address cybersecurity vulnerabilities to the United States commercial aviation system, and for other purposes. 1. Short title This Act may be cited as the Cybersecurity Standards for Aircraft to Improve Resilience Act of 2016 Cyber AIR Act 2. Definitions In this Act: (1) Covered air carrier The term covered air carrier (2) Covered manufacturer The term covered manufacturer (A) manufactures or otherwise produces aircraft and holds a production certificate under section 44704(c) of title 49, United States Code; or (B) manufactures or otherwise produces electronic control, communications, maintenance, or ground support systems for aircraft. (3) Cyberattack The term cyberattack (4) Critical software systems The term critical software systems (5) Entry point The term entry point 3. Disclosure of cyberattacks by the aviation industry (a) In general Not later than 270 days after the date of the enactment of this Act, the Secretary of Transportation shall prescribe regulations requiring covered air carriers and covered manufacturers to disclose to the Federal Aviation Administration any attempted or successful cyberattack on any system on board an aircraft, whether or not the system is critical to the safe and secure operation of the aircraft, or any maintenance or ground support system for aircraft, operated by the air carrier or produced by the manufacturer, as the case may be. (b) Use of disclosures by the Federal Aviation Administration The Administrator of the Federal Aviation Administration shall use the information obtained through disclosures made under subsection (a) to improve the regulations required by section 4 and to notify air carriers, aircraft manufacturers, and other Federal agencies of cybersecurity vulnerabilities in systems on board an aircraft or maintenance or ground support systems for aircraft. 4. Incorporation of cybersecurity into requirements for air carrier operating certificates and production certificates (a) Regulations Not later than 270 days after the date of the enactment of this Act, the Secretary of Transportation, in consultation with the Secretary of Defense, the Secretary of Homeland Security, the Attorney General, the Federal Communications Commission, and the Director of National Intelligence, shall prescribe regulations to incorporate requirements relating to cybersecurity into the requirements for obtaining an air carrier operating certificate or a production certificate under chapter 447 (b) Requirements In prescribing the regulations required by subsection (a), the Secretary shall— (1) require all entry points to the electronic systems of each aircraft operating in United States airspace and maintenance or ground support systems for such aircraft to be equipped with reasonable measures to protect against cyberattacks, including the use of isolation measures to separate critical software systems from noncritical software systems; (2) require the periodic evaluation of the measures described in paragraph (1) for security vulnerabilities using best security practices, including the appropriate application of techniques such as penetration testing, in consultation with the Secretary of Defense, the Secretary of Homeland Security, the Attorney General, the Federal Communications Commission, and the Director of National Intelligence; and (3) require the measures described in paragraph (1) to be periodically updated based on the results of the evaluations conducted under paragraph (2). 5. Annual report on cyberattacks on aircraft systems and maintenance and ground support systems (a) In general Not later than one year after the date of the enactment of this Act, and annually thereafter, the Administrator of the Federal Aviation Administration shall submit to the appropriate committees of Congress a report on attempted and successful cyberattacks on any system on board an aircraft, whether or not the system is critical to the safe and secure operation of the aircraft, and on maintenance or ground support systems for aircraft, that includes— (1) the number of such cyberattacks during the year preceding the submission of the report; (2) with respect to each such cyberattack— (A) an identification of the system that was targeted; (B) a description of the effect on the safety of the aircraft as a result of the cyberattack; and (C) a description of the measures taken to counter or mitigate the cyberattack; (3) recommendations for preventing a future cyberattack; (4) an analysis of potential vulnerabilities to cyberattacks in systems on board an aircraft and in maintenance or ground support systems for aircraft; and (5) recommendations for improving the regulatory oversight of aircraft cybersecurity. (b) Form of report The report required by subsection (a) shall be submitted in unclassified form, but may include a classified annex. 6. Managing cybersecurity risks of consumer communications equipment (a) In general The Commercial Aviation Communications Safety and Security Leadership Group established by the memorandum of understanding between the Department of Transportation and the Federal Communications Commission entitled Framework for DOT–FCC Coordination of Commercial Aviation Communications Safety and Security Issues Leadership Group (b) Responsibilities To address cybersecurity risks arising from malicious use of communications technologies on board aircraft operated by covered air carriers, the Leadership Group shall— (1) ensure the development of effective methods for preventing foreseeable cyberattacks that exploit broadband wireless communications equipment designed for consumer use on board such aircraft; and (2) require the implementation by covered air carriers, covered manufacturers, and communications service providers of all technical and operational security measures that are deemed necessary and sufficient by the Leadership Group to prevent cyberattacks described in paragraph (1). (c) Report required (1) In general Not later than one year after the date of the enactment of this Act, and annually thereafter, the Leadership Group shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Transportation and Infrastructure of the House of Representatives a report on— (A) the technical and operational security measures developed to prevent foreseeable cyberattacks that exploit broadband wireless communications equipment designed for consumer use on board aircraft operated by covered air carriers; and (B) the steps taken by covered air carriers, covered manufacturers, and communications service providers to implement the measures described in subparagraph (A). (2) Form of report The report required by paragraph (1) shall be submitted in unclassified form, but may include a classified annex.

Summary: Cybersecurity Standards for Aircraft to Improve Resilience Act of 2016 or the Cyber AIR Act This bill directs the Department of Transportation (DOT) to require domestic or foreign air carriers and manufacturers of aircraft or electronic control, communications, maintenance, or ground support systems for aircraft to disclose to the Federal Aviation Administration (FAA) any attempted or successful cyberattack against any system on board an aircraft or against any maintenance or ground support system for aircraft. The FAA shall use the information obtained through such disclosures to: (1) improve the regulations (to be prescribed by DOT) to incorporate requirements relating to cybersecurity into the requirements for obtaining an air carrier operating certificate or a production certificate; and (2) notify air carriers, aircraft manufacturers, and other federal agencies of cybersecurity vulnerabilities in systems on board an aircraft or maintenance or ground support systems for aircraft. In prescribing such regulations, DOT must require: (1) all entry points to the electronic systems of each aircraft operating in U.S. airspace and maintenance or ground support systems for such aircraft to be equipped with reasonable measures to protect against cyberattacks; and (2) the periodic evaluation of, and updates to, such measures for security vulnerabilities using best security practices. The FAA must report to Congress annually on attempted and successful cyberattacks against any system on board an aircraft and against maintenance or ground support systems for aircraft. The Commercial Aviation Communications Safety and Security Leadership Group shall: (1) be responsible for evaluating the cybersecurity vulnerabilities of certain broadband wireless communications equipment designed for consumer use on board aircraft; and (2) require the implementation by air carriers, manufacturers, and communications service providers of technical and operational security measures it deems necessary to prevent cyberattacks that exploit such equipment.