With the FCC’s EAS cybersecurity deadline next week, the Commission has published a FAQ page addressing questions broadcasters have raised about how far the new rule actually reaches. The guidance walks through questions tied to the requirements adopted in June.
Broadcast engineers have raised a range of scope questions on password, patching, and firewall requirements. The first question the FAQ addresses asks whether the password requirements apply to every piece of equipment on a station’s network, or only to EAS gear specifically.
The Commission’s answer narrows the rule’s reach: it covers EAS equipment, studio-transmitter link equipment, and any remotely managed equipment that routes, processes, or inserts content into the program stream, including audio processors, ad insertion systems, and remotely managed transmitters, but not equipment that never touches the program stream.
The FAQ also takes up several more technical questions, including whether equipment that cannot support a 15-character password must be replaced, whether unsupported legacy equipment needs to be swapped out, whether devices behind a firewall or VPN still need to meet the password standard, whether each piece of equipment needs its own unique password, whether broadcasters are responsible for third parties in their program chain, and whether dictionary words can be used in a multiword passphrase.
