Evolving FCC Direction Signals Stronger Cybersecurity Expectations

In March 2026, the U.S. Federal Communications Commission (FCC) expanded its “Covered List” to include consumer-grade routers produced in foreign countries, effectively restricting approval of new models for sale in the United States.

From Vulnerabilities to Systemic Risk

Recent incidents reinforce this concern. Threat actors have repeatedly exploited weaknesses in network edge devices like routers to gain persistent access, conduct surveillance, and pivot into more sensitive environments. These devices are attractive targets because they:

• Sit at the boundary between trusted and untrusted networks
• Often operate with limited monitoring and patching
• Provide broad visibility into network traffic

From a security architecture perspective, routers are not just connectivity tools, they are control points. If compromised, they can become long-term footholds rather than transient vulnerabilities.

The FCC’s move reflects a shift from focusing solely on software vulnerabilities to addressing systemic risks tied to supply chain trust, manufacturing transparency, and lifecycle control.

Implications for Critical Infrastructure

Although the regulation specifically targets consumer-grade routers, its implications extend into industrial and critical infrastructure environments.

First, it reinforces a growing principle:
network components must be evaluated not only for functionality, but for trustworthiness across their entire lifecycle.

Second, it signals increasing regulatory attention on:

• Supply chain origin and transparency
• Hardware-level security assurances
• Long-term maintainability (patching, updates, support)

Finally, it highlights a key architectural lesson:
network devices at trust boundaries can become persistent attack surfaces, particularly when their integrity or origin cannot be fully assured. Relying solely on perimeter devices (especially those exposed to external networks) introduces structural risk.

The convergence of OT and IT creates an attack surface, not unlike a router’s position in home or office networks. Historically, network segmentation and firewalls control traffic between zones. However, these controls remain logically enforced. They rely on configuration, software integrity, and ongoing updates.

In contrast, air-gap concepts and unidirectional architectures approach the problem differently. Instead of filtering traffic, they eliminate unnecessary communication paths entirely. For many OT use cases, this model aligns more closely with operational requirements.

Physical Isolation as a Security Control

Even well-configured firewalls still maintain bidirectional communication capability. Under certain conditions such as misconfiguration, zero-day vulnerabilities, or supply chain compromise, this capability can be exploited. In critical infrastructure, this raises architectural concern.

As a result, there is growing recognition that:

• Logical controls may not fully mitigate systemic risk
• Bidirectional connectivity increases the potential impact of compromise
• Trust assumptions at network boundaries must be minimized

This is why, in high-consequence environments, hardware-enforced separation is increasingly considered alongside traditional controls. By removing the electrical return path, unidirectional gateways or data diodes ensure that no command or control traffic can travel back into protected OT systems. This approach transforms security from a matter of policy enforcement into one of deterministic behavior.

For example, in a typical substation or SCADA architecture, operational data can be transmitted to IT systems, cloud platforms, or monitoring dashboards, but external systems cannot send commands, inject traffic, or establish sessions back into the OT network.

Alignment with Global Regulations

The FCC’s direction does not exist in isolation. It reflects a broader global trend, including:

• The EU’s Radio Equipment Directive (RED) cybersecurity requirements (EN 18031)
• Increasing adoption of IEC 62443, which emphasizes clear separation of zones and controlled conduits, across critical infrastructure sectors

Together, these frameworks are creating a more unified expectation: industrial devices must demonstrate both functional reliability and cybersecurity resilience. In substation and utility environments, where IEC 61850 networks already demand high availability and deterministic performance, this adds another layer: ensuring that network infrastructure is both operationally robust and cyber-resilient.

Security by Design Becomes the Baseline

Global standards such as IEC 62443 and NIST cybersecurity guides also emphasize secure development practices. Rather than relying on secure deployment alone, regulators are increasingly expecting devices to be secure by default, including capabilities such as secure boot and firmware integrity validation, role-based access control (RBAC), and event logging and auditability.

The overall design of compliant systems is moving toward greater scrutiny of device trustworthiness and origin, reduced tolerance for implicit trust in network-connected equipment, and increased emphasis on architectural safeguards over reactive controls.

Lifecycle Responsibility and Patchability

Another emerging theme is ongoing accountability after deployment. Industrial devices are often deployed for 10–20 years, but regulatory expectations are shifting toward:

• Defined firmware update mechanisms
• Vulnerability disclosure processes
• Clear product support lifecycles

This aligns with broader initiatives such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) guidance on secure product development and maintenance, which emphasizes continuous risk management throughout the product lifecycle.

Choosing Infrastructure That Ages Well Under Regulation

As regulatory frameworks evolve, infrastructure owners should consider how today’s design decisions will hold up under future scrutiny.

Some practical considerations include:

1. Favor Deterministic Security Controls

Devices that enforce security through architecture, rather than configuration alone, are less likely to be invalidated by emerging threat models.

2. Evaluate Supply Chain Transparency

Understanding where and how a device is designed, manufactured, and maintained is becoming a baseline requirement, not an optional due diligence step.

3. Minimize Implicit Trust in Network Paths

Architectures that assume bidirectional connectivity everywhere are increasingly difficult to justify. Segmentation should be explicit and enforced, especially between IT and OT.

4. Ensure Interoperability with Secure Architectures

Infrastructure should support standardized protocols, segmentation models, and secure data exchange without introducing unintended pathways. Systems that align with architectures like IEC 62443 zones and conduits enable consistent enforcement of trust boundaries while maintaining operational visibility and scalability.

5. Consider Hardware-Enforced Boundaries

Technologies such as unidirectional gateways provide physical guarantees of data flow direction, eliminating entire classes of remote attack rather than attempting to detect them.

For example, FPGA-based unidirectional gateways like the BIG9000 BlackBear Unidirectional Gateway enforce one-way communication at the physical layer while validating industrial protocols in hardware. This approach aligns with the broader regulatory direction: reducing reliance on software trust and strengthening architectural controls. This allows organizations to maintain operational visibility without introducing inbound risk paths. Instead of relying solely on detecting or blocking threats, this approach focuses on removing entire categories of attack by design.

A Shift Toward Architecture-Level Security

The FCC’s router decision is not just about routers. It reflects a broader transition in cybersecurity thinking—from device-level vulnerabilities to system-level resilience.

For critical infrastructure operators, the takeaway is clear:

Security is no longer defined only by device features or certifications.
It is defined by how the system behaves under compromise.

As regulations continue to evolve, architectures that reduce trust assumptions, enforce clear boundaries, and limit attack propagation will be better positioned not just for compliance, but for long-term operational resilience.