Aviation Cybersecurity: What the TSA Directive Means for Part 135 Operators

The TSA cybersecurity amendment applies to Part 121, 135, 125, and 129 operators. It requires an approved cybersecurity implementation plan, continuous monitoring and detection procedures, patch management obligations, and incident reporting protocols.

Many Part 135 operators do not realize they fall under this directive. If you hold a Part 135 certificate, you likely have cybersecurity compliance obligations.

Your plan must identify critical systems (operational technology, flight planning systems, communication systems, customer data systems), assess cybersecurity risks, define protective measures, and establish incident response procedures.

For small Part 135 operators, critical systems typically include: your flight scheduling/dispatch software, EFB systems, satellite tracking, crew communication platforms, and customer booking systems.

The directive requires continuous monitoring of critical systems for cybersecurity threats. This does not necessarily mean enterprise-grade SOC monitoring — but it does require documented procedures for detecting and responding to anomalies.

Patch management means keeping all critical software systems updated with security patches within defined timelines. Document your patch management process and maintain evidence of patch application.

TSA cybersecurity violations carry penalties up to $13,910 per day per violation. For an operator without an approved implementation plan, daily exposure can accumulate rapidly.

The TSA conducts compliance reviews and expects operators to demonstrate not just a written plan, but active implementation with evidence of monitoring, patching, and incident response capability.