From September 29, 2026, the FCC's program chain security rule, 47 CFR § 11.35(d), applies to broadcasters. Its password requirement is the part most stations are auditing this month.
What the rule asks of a password
On internet-connected equipment in the program chain, a password must:
- be at least 15 characters
- contain no dictionary words
- not be reused on any other account, equipment, application or service
- replace the default before the equipment is used, and be changed if there is reason to think it is compromised
The rule also allows other authentication, such as one-time codes or cryptographic keys, where that is reasonably sufficient. It does not require multi-factor sign-in or scheduled password changes.
For the full rule, what equipment it reaches and how to document it, Station Compliance has a plain-English guide to the 15-character rule.
Is traffic software covered?
The rule names equipment that routes, processes or inserts content: EAS gear, studio-transmitter links, automation, processors, RDS encoders and remote controls. Traffic software produces the log your automation plays, but it does not itself put audio on the air. So it sits beside the program chain rather than in it.
That distinction will not matter much in practice. When an engineer is checking every password that touches the air, the traffic system's login is on the list.
What Cartwright does
- New passwords need 15 characters. That applies when an account is created, when a password is changed, and to the temporary passwords Cartwright makes for new staff.
- Older, shorter passwords still sign in once. Cartwright then asks for a new one straight away, so nobody is locked out on the day they update.
- It refuses the obvious ones. A password containing the username or the person's name, or one of the passwords that get tried first, is turned down with a reason.
What Cartwright cannot check for you is reuse. It has no way to know whether the same password guards your automation or your email. That part is a station habit, and a password manager is the easy way to keep it.
Cartwright runs on your own computer and is reached over the station's network, not the open internet. That is a smaller surface to begin with, but it is not a reason to skip the audit.