,i #aag? ,,congress #b;d ,session ,h4 ,r4 #igji ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,janu>y #c1 #bjbc,mr4 ,graves ( ,l\isiana introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,transportation & ,infra/ructure ,a ,,bill ,to direct ! ,adm9i/rator ( ! ,f$]al ,aviation ,adm9i/ration to issue regulations1 policy1 & guidance to ensure ! safety ( ! aviation sy/em1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,protect+ ! ,safety ( ,air ,traffic ,control & ! ,aviation ,sy/em ,act4 #b4 ,f9d+s ,congress f9ds ! foll[+3 7#a7 ,s9ce its e/abli%m5t 9 #aieh1 ! ,f$]al ,aviation ,adm9i/ration1 orig9ally nam$ ! ,f$]al ,aviation ,ag5cy1 has be5 responsible =-- 7,a7 promot+ ! safe flight ( civil aircraft 9 air comm]ce2 7,b7 ensur+ ! safe1 secure1 & effici5t use ( ! national airspace sy/em & provision ( air navigation s]vices2 & 7,c7 ov]see+ ! c]tification & cont9u$ airwor?9ess ( aircraft & o!r a]onautical products4 7#b7 ,congress has repeat$ly task$ ! ,f$]al ,aviation ,adm9i/ration ) responsibility = secur+ ! national airspace sy/em1 includ+ ! air traffic control sy/em1 airspace managem5t1 civil aircraft1 & a]onautical products & articles ?r\gh safety regulation & ov]sight4 ,^! m&ates h r\t9ely includ$ protect+ aga9/ associat$ cyb] ?reats affect+ aviation safety or ! ,adm9i/ration's provision ( safe1 secure1 & effici5t air navigation s]vices & airspace managem5t4 7#c7 ,9 #bjjc1 ,congress pass$ ! ,vision #ajj--;,c5tury ( ,aviation ,reau?orization ,act1 :i* direct$ ! ,f$]al ,aviation ,adm9i/ration to develop & submit a report on an integrat$ plan to ensure t ! ,next ,g5]ation ,air ,transportation ,sy/em meets future air transportation safety1 security1 mobility1 effici5cy1 & capacity ne$s4 7#d7 ,9 #bjab1 ,congress pass$ ! ,,faa ,mod]nization & ,re=m ,act ( #bjab1 :i* direct$ ! ,f$]al ,aviation ,adm9i/ration to develop a ,next,gen ,implem5tation ,plan ) a detail$ description ( h[ ! ag5cy is implem5t+ ! ,next ,g5]ation ,air ,transportation ,sy/em1 & cont+5cy plans = deal+ ) ! degradation ( ! ,sy/em 9 ! ev5t ( a natural disa/]1 major equipm5t failure1 or act ( t]rorism4 7#e7 ,9 #bjaf1 ,congress pass$ ! ,,faa ,ext5sion1 ,safety1 & ,security ,act ( #bjaf1 :i* e/abli%$ requirem5ts = ! ,f$]al ,aviation ,adm9i/ration to enhance ! national airspace sy/em's cyb]security & includ$ m&ates = ! ,adm9i/ration to-- 7,a7 develop a cyb]security /rategic plan2 7,b7 coord9ate ) o!r ,f$]al ag5cies to id5tify cyb] vuln]abilities2 7,c7 develop a cyb] ?reat model2 & 7,d7 complete a compreh5sive1 /rategic policy framework to id5tify & mitigate cyb]security risks to ! air traffic control sy/em4 7#f7 ,9 #bjah1 ,congress pass$ ! ,,faa ,reau?orization ,act ( #bjah :i*-- 7,a7 au?oriz$ fund+ = ! con/ruction ( ,f$]al ,aviation ,adm9i/ration facilities d$icat$ to improv+ ! cyb]security ( ! national airspace sy/em2 7,b7 requir$ ! ,f$]al ,aviation ,adm9i/ration to publi% a #e-ye> roadmap = ! introduction ( civil unmann$ aircraft sy/ems into ! national airspace sy/em ) an update on ! advancem5t ( te*nologies ne$$ to integrate unmann$ aircraft sy/ems into ! national airspace sy/em1 includ+ decision mak+ by adaptive sy/ems & cyb] physical sy/ems security2 7,c7 requir$ ! ,f$]al ,aviation ,adm9i/ration to develop a plan to all[ = ! implem5tation ( unmann$ aircraft sy/ems traffic managem5t s]vices1 includ+ an assessm5t ( cyb]security protections1 data integrity1 & national & homel& security b5efits ( su* a sy/em2 7,d7 m&at$ t ! ,f$]al ,aviation ,adm9i/ration consid] revis+ ,f$]al ,aviation ,adm9i/ration regulations reg>d+ airwor?9ess c]tification to address cyb]security = avionics sy/ems1 includ+ s(tw>e compon5ts & to require t aircraft avionics sy/ems us$ = flight guidance or aircraft control be secur$ aga9/ unau?oriz$ access & t avionics sy/ems be protect$ f unau?oriz$ ext]nal & int]nal access2 7,e7 requir$ ! ,f$]al ,aviation ,adm9i/ration to review & update its compreh5sive1 /rategic policy framework = cyb]security to assess ! degree to :i* ! framework id5tifies & addresses kn[n cyb]security risks associat$ ) ! aviation sy/em1 & evaluate exi/+ %ort- & long-t]m objectives = address+ cyb]security risks to ! national airspace sy/em2 7,f7 creat$ a ,*ief ,te*nology ,(fic] position )9 ! ,f$]al ,aviation ,adm9i/ration to be responsible =1 among o!r ?+s1 coord9at+ ! implem5tation1 op]ation1 ma9t5ance1 & cyb]security ( te*nology programs relat+ to ! air traffic control sy/em ) ! aviation indu/ry & o!r ,f$]al ag5cies2 7,g7 direct$ ! ,national ,academy ( ,sci5ces to /udy ! cyb]security work=ce ( ! ,f$]al ,aviation ,adm9i/ration 9 ord] to develop recomm5dations to increase ! size1 quality1 & div]sity ( su* work=ce2 & 7,h7 requir$ ! ,f$]al ,aviation ,adm9i/ration to develop a compreh5sive plan to attract1 develop1 tra91 & reta9 tal5t$ individuals 9 ! fields ( sy/ems eng9e]+1 sy/ems ar*itecture1 sy/ems integration1 digital communications1 & cyb]security4 7#g7 ,congress has task$ ! ,f$]al ,aviation ,adm9i/ration ) be+ ! prim>y ,f$]al ag5cy to assess & address ! ?reats pos$ f cyb] incid5ts relat+ to ,unit$ ,/ates ,gov]nm5t-provid$ air traffic control & air traffic managem5t s]vices & ! ?reats pos$ f cyb] incid5ts relat+ to civil aircraft1 a]onautical products & articles1 aviation networks1 aviation sy/ems1 s]vices1 & op]ations1 & ! aviation indu/ry4 7#h7 ,s9ce #bjje1 ! ,f$]al ,aviation ,adm9i/ration has be5 address+ cyb] vuln]abilities 9 civil aircraft & a]onautical products & articles dur+ ! safety c]tification process4 7#i7 ,congress has receiv$ & review$ te/imony1 brief+s1 & docum5tation on ! pot5tial risks ( cyb] incid5ts relat+ to ,f$]al ,aviation ,adm9i/ration-provid$ air navigation s]vices & airspace managem5t1 civil aircraft1 a]onautical products & articles1 aviation networks1 aviation sy/ems1 s]vices1 & op]ations1 & ! aviation indu/ry4 ,?is te/imony & docum5tation demon/rate ! complicat$ & increas+ly int]connect$ relation%ip betwe5 aviation safety2 ! safe1 secure1 & effici5t provision ( air navigation s]vices2 & cyb]security = bo? ,f$]al ,aviation ,adm9i/ration-provid$ air navigation s]vices & airspace managem5t1 & civil aircraft1 a]onautical products & articles1 aviation networks1 aviation sy/ems1 s]vices1 & op]ations4 7#aj7 ,?is te/imony & docum5tation also demon/rate ! ne$ = ! ,f$]al ,aviation ,adm9i/ration to issue specific regulations1 policy1 & guidance t are /&>diz$ & h>moniz$1 :]e appropriate & consi/5t ) ! int]e/s ( safety 9 air comm]ce & national security ) key int]national p>tn]s & ,int]national ,civil ,aviation ,organization4 #c4 ,national airspace sy/em1 air traffic control1 & airspace managem5t safety ,section #ajf7;f77#b7 ( title #di1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 subp>agraph 7,a77ii7 by /rik+ & ma9t5ance & ins]t+ ma9t5ance1 & security 7includ+ cyb]security72 & 7#b7 9 subp>agraph 7,d7 by ins]t+ or any o!r ,f$]al ag5cy aft] ,dep>tm5t ( ,transportation4 #d4 ,aviation product safety 7a7 ,cyb]security /&>ds ,section #ddgja7;a7 ( title #di1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 p>agraph 7#a7 by ins]t+ cyb]security1 aft] quality ( "w12 & 7#b7 9 p>agraph 7#e7-- 7,a7 by ins]t+ cyb]security & aft] /&>ds =2 & 7,b7 by /rik+ proc$ure & ins]t+ proc$ures4 7b7 ,exclusive rulemak+ au?ority ,section #ddgja ( title #di1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 7g7 ,exclusive rulemak+ au?ority ,not)/&+ any o!r provision ( law & except z provid$ 9 section #djaca1 to ! ext5t t a provision ( law au?orizes any ,f$]al ag5cy t is n ! ,dep>tm5t ( ,transportation1 or compon5t !re(1 to issue regulations "u su* provision = purposes ( assur+ civil aircraft1 aircraft eng9e1 propell]1 & appliance cyb]security1 ! ,adm9i/rator ( ! ,f$]al ,aviation ,adm9i/ration %all h ! exclusive au?ority to prescribe regulations subject to su* provision4 4 #e4 ,airports 7a7 ,9 g5]al ,section #ddgjf7;b7 ( title #di1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 p>agraph 7#a7 by /rik+ & at ! end2 7#b7 9 p>agraph 7#b7 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7#c7 by add+ at ! end ! foll[+3 7#c7 su* cyb]security /&>ds z ! ,adm9i/rator may prescribe4 4 7b7 ,classification ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,transportation %all revise section #ae4e ( title #di1 ,code ( ,f$]al ,regulations1 to classify in=mation ab\t cyb]security /&>ds = airports hold+ an airport op]at+ c]tificate issu$ "u section #ddgjf ( title #di1 ,unit$ ,/ates ,code1 z s5sitive security in=mation4 #f4 ,f$]al ,aviation ,adm9i/ration regulations1 policy1 & guidance 7a7 ,9 g5]al ,*apt] #dja ( title #di1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+ new section3 #djaca4 ,national airspace sy/em cyb] ?reat managem5t process 7a7 ,e/abli%m5t ,! ,adm9i/rator ( ! ,f$]al ,aviation ,adm9i/ration %all e/abli% a national airspace sy/em cyb] ?reat managem5t process to protect ! national airspace sy/em cyb] environm5t1 includ+ ! safety1 security1 & effici5cy ( ! airspace managem5t s]vices provid$ by ! ,adm9i/ration4 7b7 ,issues ,to be address$ ,9 e/abli%+ ! national airspace sy/em cyb] ?reat managem5t process "u subsection 7a71 ! ,adm9i/rator %all1 at a m9imum-- 7#a7 monitor ! national airspace sy/em cyb] environm5t2 7#b7 9 consultation ) appropriate ,f$]al ag5cies1 evaluate ! cyb] ?reat l&scape = ! national airspace sy/em1 includ+ updat+ su* evaluation on bo? annual & ?reat-bas$ timel9es2 7#c7 conduct national airspace sy/em cyb] incid5t analyses2 7#d7 create a cyb] common op]at+ picture = ! national airspace sy/em cyb] environm5t2 7#e7 det]m9e :e!r1 & if s h[1 to conduct active cyb] def5se2 7#f7 coord9ate national airspace sy/em cyb] incid5t responses ) o!r appropriate ,f$]al ag5cies2 7#g7 track cyb] incid5t detection1 response1 mitigation implem5tation1 recov]y1 & closure2 7#h7 e/abli% a process to collect relevant national airspace sy/em cyb] incid5t data f int]nal & ext]nal /akehold]s2 & 7#i7 any o!r matt] ! ,adm9i/rator det]m9es appropriate4 7c7 ,def9itions ,9 ?is section1 ! foll[+ def9itions apply3 7#a7 ,active cyb] def5se ,! t]m active cyb] def5se means ! use ( cyb] en=cem5t capabilities t actively int]dict ! movem5t or process+ ( data to mitigate a cyb] ?reat4 7#b7 ,cyb] common op]at+ picture ,! t]m cyb] common op]at+ picture means ! correlation ( a detect$ cyb] incid5t or cyb] ?reat 9 ! national airspace sy/em & o!r op]ational anomalies to provide a holi/ic view ( pot5tial cause & impact4 7#c7 ,cyb] environm5t ,! t]m cyb] environm5t means ! in=mation environm5t consi/+ ( ! int]dep5d5t networks ( in=mation te*nology infra/ructures & resid5t data1 includ+ ! int]net1 telecommunications networks1 comput] sy/ems1 & emb$d$ processors & controll]s4 7#d7 ,cyb] incid5t ,! t]m cyb] incid5t means an action t creates noticeable degradation1 disruption1 or de/ruction to ! cyb] environm5t (-- 7,a7 ! national airspace sy/em2 7,b7 civil aircraft in=mation1 data1 networks1 sy/ems1 s]vices1 op]ations & te*nology2 or 7,c7 a]onautical products & articles4 7#e7 ,cyb] ?reat ,! t]m cyb] ?reat means ! ?reat ( an action t1 if c>ri$ out1 w\ld con/itute a cyb] incid5t1 an int5tional unau?oriz$ electronic int]action1 or an electronic attack4 7#f7 ,electronic attack ,! t]m electronic attack means ! use ( electromagnetic spectrum en]gy to imp$e op]ations 9 ! cyb] environm5t1 includ+ ?r\gh te*niques su* z jamm+ or spo(+4 7#g7 ,int5tional unau?oriz$ electronic int]action ,! t]m int5tional unau?oriz$ electronic int]action means an int5tional & unau?oriz$ attempt to cause a safety or o!r negative impact on aircraft op]ations by-- 7,a7 modify+ an a]onautical database2 7,b7 corrupt+ s(tw>e2 or 7,c7 access+ an aircraft or a]onautical sy/em us+ an int]net connection or o!r =m ( electronic connection4 7#h7 ,national airspace sy/em cyb] environm5t ,! t]m national airspace sy/em cyb] environm5t means ! network+ & comput+ te*nology infra/ructures & data us$ to p]=m air navigation s]vices 7includ+ air traffic control & air traffic managem5t s]vices71 includ+ ! int]net1 telecommunications networks1 comput] sy/ems1 & emb$d$ processors & controll]s4 4 7b7 ,cl]ical am5dm5t ,! analysis = *apt] #dja ( title #di1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #djaca4 ,national airspace sy/em cyb] ?reat managem5t process4 4 #g4 ,civil aircraft cyb]security aviation rulemak+ committee 7a7 ,9 g5]al ,n lat] ?an #ij days aft] ! date ( enactm5t ( ?is ,act1 ! ,adm9i/rator ( ! ,f$]al ,aviation ,adm9i/ration %all conv5e an aviation rulemak+ committee on civil aircraft cyb]security to conduct a review & develop f9d+s & recomm5dations on cyb]security /&>ds = civil aircraft1 aircraft gr\nd support in=mation sy/ems1 & a]onautical products & articles4 7b7 ,duties ,! ,adm9i/rator %all-- 7#a7 n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 submit to ,congress a report bas$ on ! f9d+s ( ! aviation rulemak+ committee conv5$ "u subsection 7a72 & 7#b7 n lat] ?an #ahj days aft] ! date ( submission ( ! report "u p>agraph 7#a71 issue a notice ( propos$ rulemak+ bas$ on any cons5sus recomm5dations rea*$ by su* committee4 7c7 ,composition ,! aviation rulemak+ committee conv5$ "u subsection 7a7 %all consi/ ( memb]s appo9t$ by ! ,adm9i/rator1 includ+ repres5tatives (-- 7#a7 aircraft manufactur]s2 7#b7 air c>ri]s2 7#c7 ! ,f$]al ,aviation ,adm9i/ration2 7#d7 su* ,f$]al ag5cies z ! ,adm9i/rator consid]s appropriate2 & 7#e7 aviation safety exp]ts ) specific k ( aircraft cyb]security4 7d7 ,memb] access to s5sitive security in=mation ,n lat] ?an #fj days aft] ! date ( a memb]'s appo9tm5t "u subsection 7c71 ! ,adm9i/rator %all det]m9e if !re is cause = ! memb] to be re/rict$ f possess+ s5sitive security in=mation4 ,^u a det]m9ation ( no cause be+ f\nd reg>d+ ! memb]1 & ^u ! memb] volunt>ily sign+ a nondisclosure agreem5t1 ! memb] may be grant$ access to s5sitive security in=mation t is relevant to ! memb]'s duties on ! aviation rulemak+ committee4 ,! memb] %all protect ! s5sitive security in=mation 9 accordance ) "p #aebj ( title #di1 ,code ( ,f$]al ,regulations4 7e7 ,prohibition on comp5sation ,! memb]s ( ! aviation rulemak+ committee conv5$ "u subsection 7a7 %all n receive pay1 all[ances1 or b5efits f ! ,gov]nm5t by reason ( _! s]vice on su* committee4 7f7 ,consid]ations ,! ,adm9i/rator %all direct su* committee to consid]-- 7#a7 exi/+ cyb]security /&>ds1 regulations1 policies1 & guidance1 includ+ ^? f o!r ,f$]al ag5cies2 7#b7 ?reat- & risk-bas$ security approa*es us$ by ! aviation indu/ry1 includ+ ! assessm5t ( ! pot5tial co/s & b5efits ( cyb]security actions2 7#c7 data ga!r$ f cyb]security report+2 7#d7 data ga!r$ f safety report+2 7#e7 ! ne$ to accommodate ! div]sity ( op]ations & sy/ems on aircraft & among/ air c>ri]s2 7#f7 ! ne$ to h>monize or deconflict propos$ & exi/+ /&>ds1 regulations1 policies1 & guidance ) o!r ,f$]al /&>ds1 regulations1 policies1 & guidance2 7#g7 design approval hold] aircraft network security guidance = op]ators2 7#h7 ! ne$ = su* /&>ds1 regulations1 policies1 & guidance z appli$ to civil aircraft in=mation1 data1 networks1 sy/ems1 s]vices1 op]ations1 & te*nology2 7#i7 updates ne$$ to airwor?9ess regulations & sy/ems safety assessm5t me?ods us$ to %[ compliance ) airwor?9ess requirem5ts = design1 function1 in/allation1 & c]tification ( civil aircraft1 a]onautical products & articles1 & aircraft networks2 7#aj7 updates ne$$ to air c>ri] op]at+ & ma9t5ance regulations to ensure cont9u$ adh]5ce ) processes & proc$ures e/abli%$ 9 airwor?9ess regulations to provide cyb]security protections = aircraft sy/ems1 includ+ = cont9u$ airwor?9ess2 7#aa7 policies & proc$ures to coord9ate ) o!r ,f$]al ag5cies1 includ+ intellig5ce ag5cies1 & ! aviation indu/ry 9 %>+ in=mation & analyses relat$ to cyb] ?reats to civil aircraft in=mation1 data1 networks1 sy/ems1 s]vices1 op]ations1 & te*nology & a]onautical products & articles2 7#ab7 ! response ( ! ,adm9i/rator & aviation indu/ry to1 & recov]y f1 cyb] incid5ts1 includ+ by coord9at+ ) o!r ,f$]al ag5cies1 includ+ intellig5ce ag5cies2 7#ac7 processes = memb]s ( ! aviation indu/ry to volunt>ily report to ! ,f$]al ,aviation ,adm9i/ration cyb] incid5ts t may affect aviation safety 9 a mann] t protects trade secrets & s5sitive bus9ess in=mation2 7#ad7 ! unique nature ( ! aviation indu/ry1 includ+ aircraft networks1 aircraft sy/ems1 & a]onautical products1 & ! int]connect$ness ( cyb]security & aviation safety2 7#ae7 appropriate cyb]security controls = aircraft networks1 aircraft sy/ems1 & a]onautical products & articles to protect aviation safety1 includ+ airwor?9ess2 7#af7 m9imum /&>ds = protect+ civil aircraft1 a]onautical products & articles1 aviation networks1 aviation sy/ems1 s]vices1 & op]ations f cyb] ?reats & cyb] incid5ts2 7#ag7 int]national collaboration1 :]e appropriate & consi/5t ) ! int]e/s ( aviation safety 9 air comm]ce & national security1 ) o!r civil aviation au?orities1 int]national aviation & /&>ds organizations1 & any o!r appropriate entities to protect civil aviation f cyb] incid5ts & cyb] ?reats2 7#ah7 ! recomm5dations & implem5tation ( ! ,aircraft ,sy/em ,in=mation ,security_/,protection report ( ! aviation rulemak+ advisory committee submitt$ on ,augu/ #bb1 #bjbb2 & 7#ai7 any o!r matt] ! ,adm9i/rator det]m9es appropriate4 7g7 ,def9itions ,! def9itions set =? 9 section #djaca ( title #di1 ,unit$ ,/ates ,code 7z add$ by ?is ,act71 apply to ?is section4