- GAO has identified cybersecurity oversight and risk management gaps at the FAA and TSA
- TSA lacks clearly defined cybersecurity responsibilities and relies on an outdated 2018 cybersecurity roadmap
- FAA did not include all cybersecurity activities and costs in the budget data submitted to OMB
The Government Accountability Office has identified gaps in the Federal Aviation Administration’s and Transportation Security Administration’s aviation cybersecurity efforts and issued five recommendations to enhance oversight and risk management.
With DHS ramping up investments in border security, AI and cyber defense, the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 12 will bring together agency leaders and industry executives to discuss what’s next. Register now!
What Cybersecurity Gaps Did GAO Identify?
In a report published Thursday, GAO said the FAA has outlined the roles of entities responsible for implementing its cybersecurity goals and objectives, while TSA has not clearly established comparable responsibilities. TSA’s 2018 Cybersecurity Roadmap is also outdated and does not align with the latest Department of Homeland Security Cybersecurity Strategy.
GAO also found that the FAA did not report all cybersecurity activities and costs in its fiscal 2024 through 2026 budget data submitted to the Office of Management and Budget. The agency omitted spending figures for its Information Security/Cybersecurity Program, which covers research and development work.
The findings come as the Trump administration develops broader cybersecurity initiatives focused on securing federal systems and critical infrastructure.
How Is FAA Addressing Cybersecurity Risks?
FAA’s procedures for certifying aircraft and authorizing system security align with federal and industry standards aimed at reducing cybersecurity threats to avionics and ground systems, GAO found. However, the agency’s Zero Trust Implementation Plan lacked detailed transition steps for its R&D operating environment, meeting just three of seven National Institute of Standards and Technology practices GAO had identified. The watchdog also found that the FAA had fully carried out three of seven objectives supporting its cybersecurity strategy’s goal of protecting and defending its networks and systems.
What Did GAO Recommend?
GAO issued five recommendations, including that TSA update its Cybersecurity Roadmap to define roles and responsibilities and that FAA strengthen its budget reporting process, revise its zero trust plan and ensure its Cybersecurity Steering Committee carries out monitoring as planned. The Departments of Homeland Security and Transportation agreed with the recommendations directed to their respective agencies.
