Aviation Cybersecurity: Enhanced Air Safety Requires FAA to Better Mitigate Threats to Aircraft Communications

Executive Summary

The GAO review finds significant gaps in FAA preparedness against electromagnetic spectrum-related threats — including spoofing and jamming — that affect the National Airspace System (NAS) and international flight routes. FAA has not completed risk and mitigation assessments, updated security documentation, or established a defined, real-time monitoring and detection capability for all spectrum-related threats. These shortcomings create immediate operational risk for systems and communications that depend on radio frequency signals and text-based aviation messaging, and therefore raise near-term procurement and program activity across multiple market segments named in the event tags.

Contractors in the tagged segments should expect increased demand for services that close those gaps: risk and mitigation assessments, spectrum threat detection and monitoring, stronger authentication/encryption for aviation communication applications, improved security documentation and assessment/authorization work, and enhanced collaboration and information-sharing mechanisms between FAA, federal partners, and non-federal aviation stakeholders. Agencies and programs listed in the event tags (for example DOT, FAA, DHS (Department of Homeland Security), CISA, DOD, NIST) and the compliance surfaces identified (for example NIST 800-53, NIST Cybersecurity Framework, FISMA, NIST 800-171 (NIST Special Publication 800-171), FAA Order 1370.121, TSA Security Directives) will be the likely context for requirements and proposals; specific solicitations and timelines are TBD pending source review.

Impact Matrix

Cybersecurity

• Risk Level: High
• Opportunity: Demand for cybersecurity architecture, implementation, and consolidation services that address spectrum-related attack vectors and secure text-based aviation communications. Relevant NAICS codes (from tags): 541330, 541512, 541513, 541519, 541715. Common contract vehicles (from tags): OASIS+, 8(a) STARS III, Alliant 2, SEWP. Agencies named in tags: DOT, FAA, DHS, CISA, DOD, NIST.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare offerings for authentication/encryption improvements, protocol hardening for text messaging used in aviation, and end-to-end cybersecurity services mapped to the compliance surfaces listed in the event tags.
• Competitive Edge: Demonstrate integrated expertise across aviation comms and federal cybersecurity frameworks (NIST 800-53, NIST CSF, NIST 800-171, FISMA) and include testable pilot demonstrations addressing spoofing/jamming scenarios.

Aviation Security

• Risk Level: High
• Opportunity: Services that strengthen operational safety by addressing vulnerabilities in aircraft-ground communications and aviation stakeholder coordination. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Offer solutions that tie cybersecurity controls to operational mitigations, and support FAA in updating security documentation and incident response playbooks for aviation operations.
• Competitive Edge: Build proposals that tie technical controls to measurable safety outcomes and stakeholder coordination processes.

Electromagnetic Spectrum Management

• Risk Level: Critical
• Opportunity: Technical and advisory work to assess, monitor, and mitigate spectrum-related threats (spoofing, jamming). Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Position capabilities for spectrum monitoring, interference localization, and mitigation strategy development; prepare to support FAA-led assessments and documentation updates.
• Competitive Edge: Offer combined RF engineering and cyber threat modeling services that demonstrate end-to-end threat scenarios and mitigations.

Radio Frequency Communications

• Risk Level: Critical
• Opportunity: Engineering, hardening, and monitoring solutions for RF-dependent systems in the NAS. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare RF resilience assessments, anti-jamming strategies, and integration plans for legacy and modernized comms equipment.
• Competitive Edge: Provide validated testing and field demonstration capabilities for RF spoofing/jamming detection and mitigation.

Network Security

• Risk Level: High
• Opportunity: Upgrades to network architectures and monitoring to detect spectrum-influenced anomalies and protect text-based aviation messaging systems. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Map network controls and telemetry to the identified threats and to compliance regimes cited in tags; prepare to deploy intrusion/behavioral detection tuned for aviation messaging patterns.
• Competitive Edge: Integrate network telemetry with RF/spectrum sensing for cross-domain detection of anomalies.

Critical Infrastructure Protection

• Risk Level: High
• Opportunity: Programs to align aviation sector protections with critical infrastructure practices, focusing on cross-stakeholder coordination and information sharing. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Propose services for governance, documentation updates, and sector-wide exercises that improve coordinated responses to spectrum incidents.
• Competitive Edge: Combine technical remediation services with exercises and policy-support deliverables that address gaps in FAA’s current collaboration practices.

Threat Detection and Monitoring

• Risk Level: Critical
• Opportunity: Development and deployment of real-time monitoring/detection systems for spectrum-related threats across NAS infrastructure. Relevant contract vehicles and NAICS from tags apply.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare sensor, analytics, and SOC-like capabilities for spectrum threat detection; demonstrate how detection informs prioritization and operational response.
• Competitive Edge: Provide end-to-end prototypes showing real-time detection to actionable alerts usable by FAA and aviation operators.

Risk Assessment Services

• Risk Level: High
• Opportunity: Independent and technical risk/mitigation assessments for FAA systems and aviation communications. Relevant NAICS codes from tags: 541330, etc.
• Timeline: Timeline TBD pending source review.
• Action Required: Offer rapid assessment teams to complete missing risk and mitigation assessments and to update required security documentation.
• Competitive Edge: Present standardized assessment methodologies aligned to NIST guidance and aviation-sector practices, enabling faster delivery and repeatable outputs.

Security Assessment and Authorization

• Risk Level: High
• Opportunity: Support for security documentation, authorization packages, and compliance mapping (including NIST frameworks listed in tags). Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare templates and services to bring FAA systems into compliance with relevant federal cybersecurity controls and to produce authorization artifacts.
• Competitive Edge: Offer pre-built control implementation packages for aviation comms subsystems that map to the compliance surfaces named in the event tags.

Incident Response

• Risk Level: High
• Opportunity: Incident response planning, playbooks, and tabletop exercises tailored to spectrum interference and spoofing scenarios affecting aviation operations. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Develop incident response services that integrate spectrum threat detection with operational decision-making and interagency coordination frameworks.
• Competitive Edge: Combine technical containment/forensics capabilities with cross-stakeholder coordination facilitation to shorten time-to-recovery in exercises and real incidents.

Aviation Communications Systems

• Risk Level: Critical
• Opportunity: Remediation and modernization projects to strengthen authentication, encryption, and protocol design for text-based aviation messaging applications. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Position cryptographic, protocol-hardening, and secure messaging solutions; prepare to support FAA in developing and implementing plans to strengthen authentication and data protection.
• Competitive Edge: Demonstrate past results or prototype solutions that reduce spoofing/interception risk in aviation messaging without degrading operational usability.

Air Traffic Control Systems

• Risk Level: Critical
• Opportunity: Upgrades, monitoring, and resilience enhancements for ATC systems vulnerable to spectrum threats. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Offer ATC-focused threat assessments, sensing/monitoring integrations, and response playbooks that reflect spectrum threat scenarios.
• Competitive Edge: Show integration approaches that align ATC operational requirements with spectrum threat detection and mitigation.

Wireless Communications Security

• Risk Level: Critical
• Opportunity: Technical services for securing wireless links that aviation systems rely on, including anti-spoofing and anti-jamming measures. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare technical solutions and test plans to harden wireless links and detect malicious interference.
• Competitive Edge: Provide validated testbeds and measurement data demonstrating resilience improvements against spoofing and jamming.

Cross-Segment Implications

• Spectrum management, RF communications, and wireless security work has direct downstream effects on Aviation Communications Systems and Air Traffic Control Systems: detection and mitigation implemented in one domain will likely require coordinated changes in protocols, network security, and operational procedures across the others.
• Threat Detection and Monitoring capabilities must integrate telemetry from RF/spectrum sensors and networks, requiring cross-segment collaboration between RF engineers, network security teams, and incident response providers.
• Risk Assessment, Security Assessment and Authorization, and Incident Response services will overlap: contractors offering combined assessment-to-remediation packages that explicitly map to the compliance surfaces named in the tags will reduce friction for FAA and partner agencies.
• Improvements to authentication and encryption for text-based aviation applications will require cooperation between cybersecurity, aviation communications, and operational stakeholders to preserve usability while increasing security; procurement may favor teams that can operate across these segments.