Kerry Lynch stepped into the role of editor of the&nbsp;Aviation International News&nbsp;monthly magazine in May 2022 after serving with&nbsp;AIN&nbsp;for eight years. She joined&nbsp;AIN&nbsp;in December 2014 as a senior editor covering Washington and business aviation news. She has also served on Convention News teams, including as editor of&nbsp;HAI Convention News. Lynch previously spent 25 years with Aviation Week. During her time there, she reported for and later steered&nbsp;The Weekly of Business Aviation, oversaw business aviation content on the&nbsp;Aviation Week Intelligence Network, served on the&nbsp;Show News&nbsp;staff, and held roles as the Washington columnist for&nbsp;Business &amp; Commercial Aviation&nbsp;and&nbsp;Overhaul &amp; Maintenance&nbsp;monthly magazines. In 2021 she was honored with the National Business Aviation Association Platinum Wing Award for lifetime achievement in journalism and was the 2004 recipient of the National Air Transportation Association’s Aviation Journalism Excellence Award. She also has been a recipient of an Aerospace Media Award for business aviation (2022) and NBAA Gold Wing Award (2003, 2024). Lynch graduated from The Ohio State University with a bachelor of arts in journalism.

Editor, AIN monthly magazine

Kerry Lynch

The FAA has proposed updating airworthiness standards for transport category aircraft, engines, and propellers to guard against potential cybersecurity threats. Applying to FAR Parts 25, 33, and 35, the <a href="https://www.federalregister.gov/documents/2024/08/21/2024-17916/equipment-systems-and-network-information-security-protection">proposal</a> released yesterday would outline requirements for type certification and continued airworthiness to protect equipment, systems, and networks against “intentional unauthorized electronic interactions” (IUEI) that could compromise safety.
Under the proposal, manufacturers or others seeking certification would be required to identify, assess, and mitigate potential hazards and develop instructions for continued airworthiness to protect the aircraft and its components while in service.
According to the FAA, much of the proposal reflects currently required practices. Only most of those requirements were established through special conditions. “Thus, the impact on applicants and operators [of the proposal] would not be significant,” the agency said. “The intended effect of this action is to reduce the costs and time necessary to certify new and changed products and harmonize FAA regulatory requirements with the regulations that other civil aviation authorities are using to address cybersecurity vulnerability.”
These regulations are increasingly necessary, the FAA added, because newer aircraft have designs with much more system integration and connectivity, including to outside sources such as field loadable software, maintenance laptops, airport gate link networks, USB devices, portable electronic flight bags, and GPS, cellular, and satellite communications. “Regulators and industry must constantly monitor the cybersecurity threat environment in order to identify and mitigate new threat sources.”
As far as addressing cybersecurity risks, the FAA noted, this began with the Boeing 787. “Since then, the FAA has issued special conditions to address IUEI in every new transport-category airplane certification project and relevant design change,” the agency said.
These conditions have required applicants to show that their designs provide for isolation from or protection against unauthorized access; show that the designs prevent inadvertent and malicious changes; and establish procedures to maintain cybersecurity protections.
But the FAA determined that addressing these concerns would be better through a single rule rather than a series of special exemptions and ultimately tasked the aviation rulemaking advisory committee (ARAC) to develop recommendations. The ARAC’s aircraft systems information security/protection working group—co-chaired by the General Aviation Manufacturers Association (GAMA)—submitted recommendations, including those for harmonization with international regulations, in August 2016.
Since then, EASA has developed its own requirements, and the U.S. Congress has weighed in, directing the FAA to develop rules. The FAA said the proposal implements the ARAC recommendations, as well as harmonizes with the corresponding EASA standards. Importantly, it will reduce the need for special conditions, which can delay or add to the cost of certification programs.
“We are pleased that the FAA got this NRPM out of the building and adopted the recommendations provided by the ARAC in 2016,” said Jens Hennig, v-p of operations for GAMA. “The rulemaking moving forward is important for several reasons, including shifting from the current process of issuing special conditions for connected systems on transport category airplanes—which is cumbersome and takes agency and industry resources—but also to close out a regulatory difference between US and EU, which has caused validation challenges.”
This is part of a series of actions that the FAA has been taking surrounding cybersecurity. Hennig explained that Part 23 has previously addressed cybersecurity and pointed out that the FAA also recently issued a policy statement for Parts 27 and 29, covering helicopters.
Comments on the proposal issued yesterday are due October 21, while those on the policy statement for helicopters are due September 2.

News about bills, laws, regulations and other governmental decisions affecting aviation and aerospace. Topics include FAA re-authorizations, taxes on fuel and aviation activities, environmental legislation, ICAO decisions, governmental mediation of labor conflicts and World Trade Organization disputes and decisions.

FAA Proposes Cybersecurity Protections for Large Aircraft Certification

Proposal codifies requirements the FAA has been issuing through special conditions

The FAA has released a long-awaited proposal to incorporate cybersecurity protections into certification requirements for large aircraft, engines, and props.

FAA Proposes Cybersecurity Protections for Certification

2024 Corporate Aviation Leadership Summit

Robert Sancetta

News and issues relating to business, corporate and private aviation, primarily regarding turbine-engine-powered airplanes and helicopters. Subjects include aircraft, engines, maintenance, operations, personnel, acquisitions, accidents, safety, security, and training.

If a pilot has to ask, they probably should stay grounded for now

AINsight: Could You Be Too Sick to Fly?

AmyWilder

News and issues relating to the aerospace industry that are related to the science, engineering and business of flight in space involving civil, industrial and military applications, and similar topics related to flight in the atmosphere of the Earth that are not covered more directly by other AINonline subject channels. In other words, both astronautical and aeronautical subjects, except for those aeronautical topics that are specifically covered elsewhere on this website.

Coalition questions Ligado’s device availability claims 

NBAA, Others Push FCC To Probe Ligado Compliance Claims

Matt Thurber

News and information about crew, passenger, aircraft and airport security issues.

Participants' information is no longer subject to Freedom of Information Act requests

FAA Updates ADS-B Privacy ICAO Address Program

News about simulators and training procedures, as well as workforce.

But new color vision testing will still go into effect January 1

FAA Delays Aeromed Certification Policy Change

Curt Epstein

News and information on safety procedures and concerns.

Enhanced vigilance will last until mid-January

Mexico’s AFAC Ramps Up Ramp Inspections

News and issues relating to international air transport and cargo carriers, national airlines and regional airlines, including aircraft, engines, personnel, acquisitions, accidents, safety, security and training.

In this article

More In Regulations and Government

AINsight: Could You Be Too Sick to Fly?

If a pilot has to ask, they probably should stay grounded for now

NBAA, Others Push FCC To Probe Ligado Compliance Claims

Coalition questions Ligado’s device availability claims

FAA Updates ADS-B Privacy ICAO Address Program

Participants' information is no longer subject to Freedom of Information Act requests

FAA Delays Aeromed Certification Policy Change

But new color vision testing will still go into effect January 1

Mexico’s AFAC Ramps Up Ramp Inspections

Enhanced vigilance will last until mid-January

Graves Set To Continue as House Transportation Chair

A pilot, Graves is active in general aviation

Former Bizjet Escrow Exec Sentenced in Drug Scheme

Judge gives sentence of 16 years in federal prison

NBAA: Be Prepared for Ownership Reporting Requirements

Legal experts caution that further court action could be ahead

AIN Products

SUBSCRIPTIONS

RESOURCES

ABOUT AIN