Station Compliance›Field Notes

If you are reading this before September 29, you are not late — you still have time, and the kit is built for exactly this. The rest of the page is still worth two minutes, because it tells you what the actual exposure is, which is not what most people assume.

The first thing to understand about missing this deadline is that you did not miss a filing.

There is no form, no certification and no box to tick at renewal for this rule. The FCC's 2022 proposal would have required a cybersecurity risk management plan and a yearly certification filed with the Commission — that version is what most of the industry reacted to, and it is not what was adopted. What survived is three operational requirements and nothing to send anybody.

Updated September 24, 2026 — one correction to the above. An earlier version of this page said there was "no ETRS-style database entry." That is true of § 11.35(d) itself and it was a careless way to put it, because ETRS Form One is due from every EAS Participant on October 30, 2026, and the National EAS Test runs November 17. Those obligations are separate from this rule and have always existed — but a reader could easily have taken that sentence to mean ETRS was nothing to worry about, five weeks before it is due. It is not, and the rest of this page has been updated accordingly.

So on September 30, nothing happened. No system flagged your station. No letter is in the post. Nobody at the Commission knows one way or the other.

That is genuinely good news, and it is also the trap. A deadline with no filing attached is a deadline that produces no consequence on the day and full consequence later, at a moment you do not choose.

What "late" actually means here

You are not late in the sense of a missed quarterly issues/programs list, where the gap is visible in the public file forever and a renewal reviewer can count the days.

You are late in the sense that there is now a rule in Part 11 that your facility does not satisfy, and that fact becomes relevant whenever someone looks. Realistically that is one of five moments:

1. An FCC inspection, which for most small stations means an agent who came for something else.
2. A complaint, from a competitor, a former employee, or a listener.
3. Licence renewal, where the certification you sign covers compliance with the Commission's rules generally.
4. An actual incident — someone gets into your automation or your EAS box and puts something on your air.
5. The National EAS Test on November 17, 2026, when every station in the country exercises this equipment on the same afternoon. Not an inspection, and nobody should sell it to you as one — but it is the whole industry running a live test on the gear this rule covers, seven weeks after the deadline, with the Commission watching.

The fourth is the one that matters, and it is the reason the rule exists. The Commission built § 11.35(d) on a documented record of broadcast hijackings, and it wrote the rule because education alone had not stopped them. If a station is hijacked after September 29 and the investigation finds the box still on its factory password, the missed deadline stops being a paperwork question.

The order to do this in

Not the order the rule lists them. The order that removes the most exposure per hour, which is different.

1. The port forwarding list on your router. Tonight.

Pull up every forwarding rule, not just the ones you believe are broadcast-related. Most stations have entries nobody has reviewed in years, pointing at gear nobody remembers exposing. This single step removes more real risk than everything else on this page combined, it costs nothing, and it takes twenty minutes.

Anything pointing at automation, the STL, the EAS unit, the processor or the transmitter remote should not be reachable from the open internet. If you need remote access, that is what a VPN is for.

2. Passwords on anything that reaches your air.

Fifteen characters, no dictionary words, not reused anywhere else. Start with the EAS box, then the STL, then automation. If you find gear with no password set at all — and you might, some common STL units ship that way — that is a different and more urgent problem than a weak one.

3. Gear that cannot take 15 characters.

Plenty of broadcast equipment cannot. This is not a dead end: the rule permits alternative authentication measures that are "reasonably sufficient to mitigate the risk of unauthorized access." Put the device behind something that can authenticate properly, then write down what you did and why. That record is the entire value of the exception — an undocumented workaround and a device you forgot about look identical a year later.

4. Patches.

Everything in the chain gets current. You are allowed to test before deploying, provided testing starts promptly and finishes on a timeframe consistent with industry practice. "We are testing it" is a defensible position. "We have not looked since 2021" is not.

5. The firewall or segmentation.

Last, because it is the one that may cost real money and take real time — and because steps 1 through 4 remove most of the practical risk while you arrange it. The rule does not say buy a firewall; it names network segmentation as an equal path.

What this looks like a month from now

If you work that list, you are compliant. Late, undocumented as late, and compliant.

The thing worth avoiding is the middle state: knowing about the rule, having done nothing, and having no plan. That is the position that is hard to explain if anyone ever asks, and it is the position most stations that miss this deadline would otherwise still be in at Christmas — not from indifference, but because the deadline passed without producing a single piece of paper to react to.

This year there is at least something to react to. ETRS Form One is due October 30 and the National EAS Test is November 17. Neither is a § 11.35(d) filing and neither asks you to certify this work — but both put a date on the calendar in the weeks after the deadline, and a date on the calendar is the only thing that reliably moves a job nobody is chasing you about. If you need a deadline to work to, use that one.

The free reference on § 11.35(d) covers the rule text line by line, and the equipment guide covers what counts as program chain in a small facility. If you would rather have it worked out than explained, that is the other thing I do.