FAA + NTSB cyber-incident reporting requirements + processes: (a) cybersecurity incidents affecting aircraft + air traffic control + safety of flight must be reported to the FAA per AC 119-1 + the operator OpsSpec + per FAA Order 1370.123A for FAA systems; (b) cybersecurity events with safety implications fall within National Transportation Safety Board (NTSB) reporting scope under 49 CFR Part 830 'Notification + Reporting of Aircraft Accidents or Incidents'; (c) coordination with CISA via the Aviation Information Sharing and Analysis Center (A-ISAC) for cyber-threat intelligence sharing; (d) FAA's role in the federal Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) covered-entity reporting regime for aviation operators - 72-hour cyber-incident reporting + 24-hour ransom-payment reporting to CISA. The 2025 CIRCIA Final Rule implementation creates the FIRST mandatory federal cyber-incident reporting regime applying broadly to aviation operators + ground-handling + aircraft maintenance + airport operators + air carriers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.