Supply chain integrity audits for foreign adversary-controlled aviation certificate holders

(a) Directed review Not later than 270 days after the date of enactment of this Act, the Administrator of the Federal Aviation Administration, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the Secretary of Defense, shall conduct a comprehensive supply chain integrity audit of all avionics systems, flight control systems, and aircraft engine control systems (including full authority digital engine control systems) that are designed, manufactured, or maintained by any covered general aviation entity that is owned, controlled, or directed by a foreign person from a country of concern and that holds any of the following: (1) A production certificate issued pursuant to part 21 of title 14, Code of Federal Regulations. (2) A parts manufacturer approval issued pursuant to part 21 of title 14, Code of Federal Regulations. (3) A technical standard order authorization issued pursuant to part 21 of title 14, Code of Federal Regulations. (b) Scope The audit required under subsection (a) shall assess— (1) whether any such system contains unauthorized hardware components, embedded firmware, or software code capable of enabling remote access, data exfiltration, or operational interference by a foreign person; (2) whether existing FAA certification processes are adequate to detect such components; and (3) whether any mitigation agreements in effect with respect to such entities adequately address supply chain integrity risks. (c) Technical assistance In carrying out the audit required under subsection (a), the FAA Administrator and the Director of the Cybersecurity and Infrastructure Security Agency may request technical assistance from the Director of the National Security Agency and the Director of the Defense Advanced Research Projects Agency, including hardware forensic analysis, firmware reverse engineering, and adversarial threat assessment support. The Director of the National Security Agency and the Director of the Defense Advanced Research Projects Agency are authorized to provide such assistance consistent with their respective statutory authorities. (d) Remedial authority Upon a finding that any system audited under subsection (a) contains a component described in subsection (b)(1), the FAA Administrator may, consistent with part 39 of title 14, Code of Federal Regulations, issue an airworthiness directive requiring inspection, modification, or replacement of the affected system. (e) Report Not later than 1 year after the date of enactment of this Act, the FAA Administrator shall submit to the relevant congressional committees a report, which may include a classified annex, describing the findings of the audit and any remedial actions taken or recommended.