Beginning September 29, 2026, new FCC cybersecurity requirements take effect for Emergency Alert System (EAS) Participants, including radio and television broadcasters.
The new rules are intended to protect broadcast facilities and the Emergency Alert System from unauthorized access, cyberattacks, and the transmission of false emergency alerts.
Per a notice from the Alabama Broadcasters Association, the FCC's Public Safety Bureau has published answers to several frequently asked questions about the EAS cybersecurity password requirements ahead of the September 29 deadline. Key clarifications:
Does the password requirement apply to all IP-connected broadcast equipment?
No. It applies only to EAS equipment, studio-transmitter link (STL) equipment, and other remotely managed equipment that routes, processes, or inserts content into the program stream — not every piece of IP-connected gear in the chain.
What if a piece of covered equipment can't support a 15-character password?
It may use an alternative authentication method that provides equal or better security, such as the methods recognized under NIST's Digital Identity Guidelines (look-up secrets, out-of-band devices, one-time passwords, or cryptographic authentication). If no such option exists, the equipment must be replaced or the station must obtain a waiver from the Commission.
Does a firewall or VPN satisfy the password requirement?
No. The password requirement and the network-segmentation requirement are independent. Equipment behind a firewall or VPN still needs its own strong password or equally secure alternative authentication.
Can multiple devices behind the same firewall share one password?
No. Every covered device needs its own unique password or equally secure alternative authentication — not one password reused across several devices.
Are dictionary words ever allowed?
Yes, as part of a multiword passphrase that is 15 characters or longer. Only a single dictionary word used alone is prohibited, since those are easily cracked through brute force.
Do we have to replace equipment that no longer receives security updates?
Not solely for that reason. But the FCC strongly encourages replacing end-of-life or obsolete remotely managed equipment, and a lack of updates doesn't excuse a station from its other EAS compliance obligations.
Guidance on selecting and configuring firewalls was not addressed in this FAQ; the ABA has indicated a separate document on that topic is forthcoming.
New password requirements
The FCC now requires broadcasters to secure EAS equipment, studio–transmitter link (STL) equipment, and other remotely managed equipment that routes, processes, or inserts content into the station's programming.
When passwords are used to secure covered equipment, they must:
- Be at least 15 characters long
- Not consist of a single dictionary word alone
- Not be reused for other accounts, equipment, applications, or services
- Replace any factory or default password before equipment is used to broadcast
- Be changed whenever there is reason to believe the password has been compromised
The FCC also permits other authentication methods that provide comparable protection against unauthorized access.
More than passwords
Keep covered equipment updated. Security patches and security-related software and firmware updates issued by equipment manufacturers must be installed promptly. Updates may be tested before deployment, provided testing begins promptly and is completed within a timeframe consistent with industry best practices.
Protect equipment from unauthorized network access. Covered equipment must be protected by a firewall or comparable network-segmentation method that limits remote management access to authorized users and authorized devices.
These requirements apply not only to EAS encoder/decoders, but also to STL equipment and remotely managed equipment that routes, processes, or inserts content into the station's programming.
Generate an FCC-compliant password
The generator on this page creates random passwords that meet the FCC's password requirements: 15 or more characters, never a single dictionary word alone.
Generate a different password for each device or system. FCC rules prohibit reusing a password used to comply with these requirements across other accounts, equipment, applications, or services.
Important: generating a compliant password addresses only the password portion of the FCC's cybersecurity requirements. Broadcasters remain responsible for complying with the FCC's requirements for software and firmware updates, network security, and access control.
Need help getting your station compliant?
MaxxKonnect can help. Broadcast cybersecurity isn't simply an IT issue. It requires an understanding of how broadcast systems, EAS equipment, STLs, automation, audio-over-IP networks, remote control systems, processors, codecs, transmitters, and other critical systems work together.
The broadcast engineers at MaxxKonnect are uniquely qualified to help stations evaluate their facilities and bring their systems into compliance with the FCC's new cybersecurity requirements. We can assist with:
- Identifying equipment covered by the new FCC requirements
- Reviewing and securing equipment credentials
- Identifying default, weak, or reused passwords
- Reviewing firmware and software versions and security updates
- Evaluating firewalls, VLANs, network segmentation, and remote-access methods
- Identifying equipment unnecessarily exposed to the public internet
- Securing EAS, STL, automation, AoIP, codec, processing, remote-control, and other broadcast systems
- Documenting findings and recommended corrective actions
- Helping stations maintain compliance with applicable FCC technical rules and regulations
Whether you operate one station or an entire group, MaxxKonnect can help evaluate your facility, identify potential compliance issues, and develop a practical path forward without disrupting your broadcast operation.
Don't wait until an FCC inspection to find out there's a problem.
About the rule
These requirements were adopted in FCC 26-38, Modernization of the Nation's Alerting Systems / Protecting the Nation's Communications Systems from Cybersecurity Threats, and are incorporated into 47 CFR § 11.35(d).
This website and password generator are provided as a convenience to broadcasters and do not constitute legal or regulatory advice. Broadcasters remain responsible for determining and maintaining compliance with all applicable FCC rules and regulations.