September 29 Compliance Deadline for New EAS Requirements

Under recently-adopted rules, EAS Participants have until September 29 to begin employing the following security controls with respect to EAS equipment, studio transmitter link equipment, and any remotely managed equipment that routes, processes, or inserts content into the transmission of the EAS Participant’s programming:

(1) Prior to any use to broadcast to the public, EAS Participants must change any default password, use strong passwords, and change any password if the EAS Participant has reason to believe that the password has been compromised. A strong password is any password that has a minimum of 15 characters and does not use dictionary words. Instead of using a strong password, EAS Participants may use alternative authentication measures, such as look-up secrets, out-of-band devices, single- or multi-factor one-time password devices, or single- or multi-factor cryptographic authentication, that are reasonably sufficient to mitigate the risk of unauthorized access. Passwords employed to comply with this requirement may not be reused for the EAS Participant’s other accounts, equipment, applications, or services.

(2) Install security patches and security-related software and firmware updates issued by equipment manufacturers promptly after those patches or upgrades become available. Security patches and security related software and firmware updates issued by equipment manufacturers may be tested before they are installed, provided that the testing begins promptly and is completed in a timeframe that is consistent with industry best practices.

(3) Use a network firewall or comparable network segmentation practice that limits remote management access to authorized devices and authorized users.