[From SBE National] The FCC released new rules intended to increase security against cyberattacks on broadcast program streams. Broadcasters must comply with the new FCC rules by September 29, 2026. The new rules establish three requirements designed to increase cybersecurity, and will apply to any device in the signal chain that is connected to the internet, which includes EAS, automation systems, processors, STL, RDS encoders, and transmitters:
- specified password hygiene measures;
- prompt testing and installation of security patches and upgrades; and
- limiting remote access via network firewalls or “comparable network segmentation.”
The FCC order states that default passwords for devices must be changed before any use that broadcasts to the public. Passwords used must employ a minimum of 15 characters, must not use dictionary words, and must not be reused for other accounts, equipment, applications, and services that the station uses. Passwords must also be changed whenever a station “has reason to believe that the password has been compromised.”

