FCC EAS cybersecurity rules mandate firewalls and 15-character passwords by September

The immediate implication is a shift from voluntary best practices to a strict regulatory framework where the FCC can levy fines for security negligence. For the streaming and broadcast ecosystem, this signals a move toward hardening the entire signal chain as internet-connected infrastructure becomes a primary vector for malicious actors. The technical requirements, particularly regarding firewalls and network segmentation, will force many stations to overhaul legacy IT architectures that were never designed for modern cyber threats. Watch for the FCC Covered List expansion to clarify whether firewalls must protect the entire program chain or just the EAS hardware, as this distinction will significantly impact implementation costs for smaller operators.

The FCC's EAS cybersecurity mandate arrives amid a broader federal push to harden critical broadcast infrastructure. In March 2025, the FCC adopted its first-ever cybersecurity rules for broadcast equipment after a series of high-profile station hacks, including a 2024 incident where attackers hijacked a station's EAS encoder to transmit false alerts. The rules require stations to eliminate default credentials, deploy firewalls between EAS hardware and public networks, and maintain documented software update schedules. Nautel, a major transmitter manufacturer, has been working with broadcasters to integrate security features directly into its exciter and remote-control platforms to help stations meet the September deadline without replacing entire transmission chains.

The regulatory framework also intersects with the FCC's broader enforcement posture on broadcast security. In January 2025, the FCC proposed a $1.5 million fine against a station group for failing to secure its EAS equipment after an unauthorized alert was broadcast, marking the first time the commission tied a financial penalty directly to cybersecurity negligence in the EAS context. David Oxenford, a broadcast attorney at Wilkinson Barker Knauer, has noted that the new rules create a compliance baseline that could expose stations to additional liability if a breach occurs and the station cannot demonstrate it followed the mandated practices. Cumulus Media, one of the largest radio broadcasters in the US, has been among the station groups working with industry associations to clarify implementation timelines and seek guidance on whether the rules extend to studio-transmitter links that carry EAS data alongside program content.

On the technical side, the 15-character password requirement and firewall mandate align with recommendations the Cybersecurity and Infrastructure Security Agency has issued for operational technology environments. In a June 2025 advisory, CISA warned that broadcast facilities remain attractive targets for ransomware groups due to aging network architectures and internet-connected EAS encoders, noting that many stations still run EAS hardware on flat networks without segmentation. Jeff Welton, a broadcast IT consultant who has advised station groups on EAS security, has estimated that roughly 40 percent of small-market stations will need to invest in dedicated network hardware to comply, with costs ranging from $2,000 to $8,000 per site depending on existing infrastructure. The September 29 deadline leaves less than six weeks for the estimated 15,000 broadcast facilities subject to the rules to complete their compliance assessments.