,,ii #aafth ,,congress #ast ,session ,s4 #baha ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #ah1 #bjai,mr4 ,markey 7for himself and ,mr4 ,blumenthal7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require the disclosure of information relating to cyberattacks on aircraft systems and maintenance and ground support systems for aircraft1 to identify and address cybersecurity vulnerabilities to the ,united ,states commercial aviation system1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cybersecurity ,standards for ,aircraft to ,improve ,resilience ,act of #bjai or the ,cyber ,,air ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,covered air carrier ,the term covered air carrier means an air carrier or a foreign air carrier 7as those terms are defined in section #djajb of title #di1 ,united ,states ,code74 7#b7 ,covered manufacturer ,the term covered manufacturer means an entity that-- 7,a7 manufactures or otherwise produces aircraft and holds a production certificate under section #ddgjd7;c7 of title #di1 ,united ,states ,code2 or 7,b7 manufactures or otherwise produces electronic control1 communications1 maintenance1 or ground support systems for aircraft4 7#c7 ,cyberattack ,the term cyberattack means the unauthorized access to aircraft electronic control or communications systems or maintenance or ground support systems for aircraft1 either wirelessly or through a wired connection4 7#d7 ,critical software systems ,the term critical software systems means software systems that can affect control over the operation of an aircraft4 7#e7 ,entry point ,the term entry point means the means by which signals to control a system on board an aircraft or a maintenance or ground support system for aircraft may be sent or received4 #c4 ,disclosure of cyberattacks by the aviation industry 7a7 ,in general ,not later than #bgj days after the date of the enactment of this ,act1 the ,secretary of ,transportation shall prescribe regulations requiring covered air carriers and covered manufacturers to disclose to the ,federal ,aviation ,administration any attempted or successful cyberattack on any system on board an aircraft1 whether or not the system is critical to the safe and secure operation of the aircraft1 or any maintenance or ground support system for aircraft1 operated by the air carrier or produced by the manufacturer1 as the case may be4 7b7 ,use of disclosures by the ,federal ,aviation ,administration ,the ,administrator of the ,federal ,aviation ,administration shall use the information obtained through disclosures made under subsection 7a7 to improve the regulations required by section #d and to notify air carriers1 aircraft manufacturers1 and other ,federal agencies of cybersecurity vulnerabilities in systems on board an aircraft or maintenance or ground support systems for aircraft4 #d4 ,incorporation of cybersecurity into requirements for air carrier operating certificates and production certificates 7a7 ,regulations ,not later than #bgj days after the date of the enactment of this ,act1 the ,secretary of ,transportation1 in consultation with the ,secretary of ,defense1 the ,secretary of ,homeland ,security1 the ,attorney ,general1 the ,federal ,communications ,commission1 and the ,director of ,national ,intelligence1 shall prescribe regulations to incorporate requirements relating to cybersecurity into the requirements for obtaining an air carrier operating certificate or a production certificate under chapter #ddg of title #di1 ,united ,states ,code4 7b7 ,requirements ,in prescribing the regulations required by subsection 7a71 the ,secretary shall-- 7#a7 require all entry points to the electronic systems of each aircraft operating in ,united ,states airspace and maintenance or ground support systems for such aircraft to be equipped with reasonable measures to protect against cyberattacks1 including the use of isolation measures to separate critical software systems from noncritical software systems2 7#b7 require the periodic evaluation of the measures described in paragraph 7#a7 for security vulnerabilities using best security practices1 including the appropriate application of techniques such as penetration testing1 in consultation with the ,secretary of ,defense1 the ,secretary of ,homeland ,security1 the ,attorney ,general1 the ,federal ,communications ,commission1 and the ,director of ,national ,intelligence2 and 7#c7 require the measures described in paragraph 7#a7 to be periodically updated based on the results of the evaluations conducted under paragraph 7#b74 #e4 ,managing cybersecurity risks of consumer communications equipment 7a7 ,in general ,the ,commercial ,aviation ,communications ,safety and ,security ,leadership ,group established by the memorandum of understanding between the ,department of ,transportation and the ,federal ,communications ,commission entitled ,framework for ,,dot-,,fcc ,coordination of ,commercial ,aviation ,communications ,safety and ,security ,issues and dated ,january #bi1 #bjaf 7in this section known as the ,leadership ,group71 shall be responsible for evaluating the cybersecurity vulnerabilities of broadband wireless communications equipment designed for consumer use on board aircraft operated by covered air carriers that is installed before1 on1 or after1 or is proposed to be installed on or after1 the date of the enactment of this ,act4 7b7 ,responsibilities ,to address cybersecurity risks arising from malicious use of communications technologies on board aircraft operated by covered air carriers1 the ,leadership ,group shall-- 7#a7 ensure the development of effective methods for preventing foreseeable cyberattacks that exploit broadband wireless communications equipment designed for consumer use on board such aircraft2 and 7#b7 require the implementation by covered air carriers1 covered manufacturers1 and communications service providers of all technical and operational security measures that are deemed necessary and sufficient by the ,leadership ,group to prevent cyberattacks described in paragraph 7#a74 7c7 ,report required ,not later than one year after the date of the enactment of this ,act1 and annually thereafter1 the ,leadership ,group shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,transportation and ,infrastructure of the ,house of ,representatives a report on-- 7#a7 the technical and operational security measures developed to prevent foreseeable cyberattacks that exploit broadband wireless communications equipment designed for consumer use on board aircraft operated by covered air carriers2 and 7#b7 the steps taken by covered air carriers1 covered manufacturers1 and communications service providers to implement the measures described in paragraph 7#a74