Federal Regulatory Agencies
Here's a look at documents from federal regulatory agencies
Federal Regulatory Agencies
Featured Stories
FDIC Announces Six Senior Leadership Appointments
WASHINGTON, Oct. 26 -- The Federal Deposit Insurance Corporation issued the following news release:
* * *
FDIC Announces Six Senior Leadership Appointments
*
WASHINGTON--The Federal Deposit Insurance Corporation (FDIC) today announced the appointment of the following personnel to serve in senior leadership positions:
Cynthia Sjoberg Radway has been appointed Deputy to the Chairman and Chief Operating Officer to lead the FDIC's internal operations. Ms. Radway most recently served at the Department of Homeland Security (DHS) as Chief Financial Officer for the Federal Emergency Management Agency ... Show Full Article WASHINGTON, Oct. 26 -- The Federal Deposit Insurance Corporation issued the following news release: * * * FDIC Announces Six Senior Leadership Appointments * WASHINGTON--The Federal Deposit Insurance Corporation (FDIC) today announced the appointment of the following personnel to serve in senior leadership positions: Cynthia Sjoberg Radway has been appointed Deputy to the Chairman and Chief Operating Officer to lead the FDIC's internal operations. Ms. Radway most recently served at the Department of Homeland Security (DHS) as Chief Financial Officer for the Federal Emergency Management Agencyand prior to that as Chief Operating Officer of the U.S. Secret Service. She previously held executive positions at the Department of Justice and other DHS Components, and holds a bachelor's and master's degree from Johns Hopkins University.
Janie Faulkner has been appointed Senior Counsel to the Chairman. Ms. Faulkner most recently served as Staff Director to the U.S. Senate Committee on Banking, Housing and Urban Affairs. Prior to her public service, she was a financial services lawyer at Covington & Burling LLP and Davis Polk & Wardwell LLP. Ms. Faulkner holds a bachelor's degree from the University of North Carolina at Chapel Hill and a law degree from the Emory School of Law.
Michael Overmyer has been appointed Senior Counsel to the Chairman. Mr. Overmyer most recently served as Senior Special Counsel in the FDIC's Legal Division. Prior to joining the FDIC, he served as a financial regulatory attorney at JPMorgan Chase & Co. and Davis Polk & Wardwell LLP. Mr. Overmyer holds a bachelor's degree from Northwestern University, a master's degree in international affairs from Columbia University's School of International and Public Affairs, and a law degree from Columbia Law School.
Ryan Rappa has been appointed Senior Counsel to the Chairman. Mr. Rappa most recently served as senior advisor to the Under Secretary for Domestic Finance at the United States Department of Treasury. He previously served as Senior Special Counsel for Complex Financial Institutions in the FDIC's Legal Division, and prior to his public service, Mr. Rappa was an associate at Allen & Overy. Mr. Rappa holds a bachelor's degree from Harvard University and a law degree from the University of Illinois College of Law.
Mark Buresh has been appointed Deputy General Counsel for the Regulation and Policy Branch in the Legal Division. Mr. Buresh joins the FDIC from the Federal Reserve Board's Legal Division, where most recently he was Senior Special Counsel in the Banking Regulation and Policy Group. He holds a bachelor's degree from Cornell University and a law degree from the University of Michigan Law School.
Dean Conway has been appointed Deputy General Counsel for the Litigation Branch in the Legal Division. Mr. Conway most recently was a shareholder in Carlton Fields' national securities litigation and enforcement practice. Previously, he spent more than two decades at the U.S. Securities and Exchange Commission, including most recently as Assistant Chief Litigation Counsel and previously as Counsel to Commissioner Elad Roisman. He holds a bachelor's degree from the University of Notre Dame and a law degree from the George Washington University Law School.
***
Original text here: https://www.fdic.gov/news/press-releases/2026/fdic-announces-six-senior-leadership-appointments
* * *
FDIC Announces Six Senior Leadership Appointments
*
WASHINGTON--The Federal Deposit Insurance Corporation (FDIC) today announced the appointment of the following personnel to serve in senior leadership positions:
Cynthia Sjoberg Radway has been appointed Deputy to the Chairman and Chief Operating Officer to lead the FDIC's internal operations. Ms. Radway most recently served at the Department of Homeland Security (DHS) as Chief Financial Officer for the Federal Emergency Management Agency ... Show Full Article WASHINGTON, Oct. 26 -- The Federal Deposit Insurance Corporation issued the following news release: * * * FDIC Announces Six Senior Leadership Appointments * WASHINGTON--The Federal Deposit Insurance Corporation (FDIC) today announced the appointment of the following personnel to serve in senior leadership positions: Cynthia Sjoberg Radway has been appointed Deputy to the Chairman and Chief Operating Officer to lead the FDIC's internal operations. Ms. Radway most recently served at the Department of Homeland Security (DHS) as Chief Financial Officer for the Federal Emergency Management Agencyand prior to that as Chief Operating Officer of the U.S. Secret Service. She previously held executive positions at the Department of Justice and other DHS Components, and holds a bachelor's and master's degree from Johns Hopkins University.
Janie Faulkner has been appointed Senior Counsel to the Chairman. Ms. Faulkner most recently served as Staff Director to the U.S. Senate Committee on Banking, Housing and Urban Affairs. Prior to her public service, she was a financial services lawyer at Covington & Burling LLP and Davis Polk & Wardwell LLP. Ms. Faulkner holds a bachelor's degree from the University of North Carolina at Chapel Hill and a law degree from the Emory School of Law.
Michael Overmyer has been appointed Senior Counsel to the Chairman. Mr. Overmyer most recently served as Senior Special Counsel in the FDIC's Legal Division. Prior to joining the FDIC, he served as a financial regulatory attorney at JPMorgan Chase & Co. and Davis Polk & Wardwell LLP. Mr. Overmyer holds a bachelor's degree from Northwestern University, a master's degree in international affairs from Columbia University's School of International and Public Affairs, and a law degree from Columbia Law School.
Ryan Rappa has been appointed Senior Counsel to the Chairman. Mr. Rappa most recently served as senior advisor to the Under Secretary for Domestic Finance at the United States Department of Treasury. He previously served as Senior Special Counsel for Complex Financial Institutions in the FDIC's Legal Division, and prior to his public service, Mr. Rappa was an associate at Allen & Overy. Mr. Rappa holds a bachelor's degree from Harvard University and a law degree from the University of Illinois College of Law.
Mark Buresh has been appointed Deputy General Counsel for the Regulation and Policy Branch in the Legal Division. Mr. Buresh joins the FDIC from the Federal Reserve Board's Legal Division, where most recently he was Senior Special Counsel in the Banking Regulation and Policy Group. He holds a bachelor's degree from Cornell University and a law degree from the University of Michigan Law School.
Dean Conway has been appointed Deputy General Counsel for the Litigation Branch in the Legal Division. Mr. Conway most recently was a shareholder in Carlton Fields' national securities litigation and enforcement practice. Previously, he spent more than two decades at the U.S. Securities and Exchange Commission, including most recently as Assistant Chief Litigation Counsel and previously as Counsel to Commissioner Elad Roisman. He holds a bachelor's degree from the University of Notre Dame and a law degree from the George Washington University Law School.
***
Original text here: https://www.fdic.gov/news/press-releases/2026/fdic-announces-six-senior-leadership-appointments
Nevada Logistics Company to Pay Over $396,000 to Resolve EEOC Religious Harassment Charge
WASHINGTON, Oct. 26 -- The Equal Employment Opportunity Commission issued the following news release:
* * *
Nevada Logistics Company to Pay Over $396,000 to Resolve EEOC Religious Harassment Charge
*
RENO, Nev. -- A third-party logistics company based in Reno, agreed to pay more than $396,000 to settle a 2025 charge alleging religious harassment claims investigated by the U.S. Equal Employment Opportunity Commission (EEOC), the federal agency announced today.
The EEOC's investigation found reasonable cause to believe that soon after hire, an employee at ITS Logistics faced harassment based ... Show Full Article WASHINGTON, Oct. 26 -- The Equal Employment Opportunity Commission issued the following news release: * * * Nevada Logistics Company to Pay Over $396,000 to Resolve EEOC Religious Harassment Charge * RENO, Nev. -- A third-party logistics company based in Reno, agreed to pay more than $396,000 to settle a 2025 charge alleging religious harassment claims investigated by the U.S. Equal Employment Opportunity Commission (EEOC), the federal agency announced today. The EEOC's investigation found reasonable cause to believe that soon after hire, an employee at ITS Logistics faced harassment basedon his Jewish identity from co-workers and managers. This included frequent comments based on offensive stereotypes concerning Jewish people as well as antisemitic postings that both co-workers and managers received and participated in. Given management's involvement in the harassment, the employee's reports to managers, and the absence of any corrective response, the employee concluded that further reporting of the harassment would be futile and resigned. An employer tolerating such alleged conduct violates Title VII of the Civil Rights Act of 1964, which prohibits discrimination, including harassment, because of an individual's religion.
Under the terms of the conciliation agreement, the company agreed to provide $96,135.54 in back pay and $300,000 in compensatory damages to the former employee, and implement strong injunctive relief that includes updating their anti-discrimination and anti-harassment policies and procedures; creating a recordkeeping mechanism to track complaints; providing extensive training to employees, supervisors, managers, and HR personnel; and providing regular reporting to EEOC on its compliance with the agreement for a period of three years.
"This case underscores the importance of employers taking swift action to address religious harassment," said Andrea Lucas, Chair of the EEOC. "The EEOC remains firmly committed to protecting workers from unlawful religious discrimination and ensuring employers fulfill their obligations to prevent and correct workplace harassment."
"Antisemitism and other forms of religious harassment have no place in the workplace. We commend ITS Logistics for resolving this matter and for investing in meaningful, proactive measures to ensure a workplace free from discrimination and harassment," said Christopher Green, director of the EEOC's San Francisco District. "By participating in the conciliation process, this employer worked with us to reach an appropriate remedy for the worker and demonstrated a strong commitment to fostering a positive and equitable workplace for current and future employees."
"It was crushing to face antisemitic harassment at my first job out of college," said the employee who filed the charge. "This experience taught me something I will carry forever: when you are targeted for nothing more than who you are, your silence only protects the harassers. With the EEOC's help, I walked away from this with justice and real changes to the workplace to ensure this never happens to anyone else."
Company representative Scott Pruneau said, "Any type of discriminatory comments or harassment based on an employee's religious beliefs is not tolerated in our workplace. ITS is committed to a culture of inclusion and treating all employees fairly. We appreciate the EEOC's involvement in this matter."
Since January 2025, the EEOC has taken over 40 public actions to defend employees' religious liberty, including filing lawsuits, resolving lawsuits via consent decrees, and resolving charges via public conciliations and other forms of pre-litigation settlements.
***
Original text here: https://www.eeoc.gov/newsroom/nevada-logistics-company-pay-over-396000-resolve-eeoc-religious-harassment-charge
* * *
Nevada Logistics Company to Pay Over $396,000 to Resolve EEOC Religious Harassment Charge
*
RENO, Nev. -- A third-party logistics company based in Reno, agreed to pay more than $396,000 to settle a 2025 charge alleging religious harassment claims investigated by the U.S. Equal Employment Opportunity Commission (EEOC), the federal agency announced today.
The EEOC's investigation found reasonable cause to believe that soon after hire, an employee at ITS Logistics faced harassment based ... Show Full Article WASHINGTON, Oct. 26 -- The Equal Employment Opportunity Commission issued the following news release: * * * Nevada Logistics Company to Pay Over $396,000 to Resolve EEOC Religious Harassment Charge * RENO, Nev. -- A third-party logistics company based in Reno, agreed to pay more than $396,000 to settle a 2025 charge alleging religious harassment claims investigated by the U.S. Equal Employment Opportunity Commission (EEOC), the federal agency announced today. The EEOC's investigation found reasonable cause to believe that soon after hire, an employee at ITS Logistics faced harassment basedon his Jewish identity from co-workers and managers. This included frequent comments based on offensive stereotypes concerning Jewish people as well as antisemitic postings that both co-workers and managers received and participated in. Given management's involvement in the harassment, the employee's reports to managers, and the absence of any corrective response, the employee concluded that further reporting of the harassment would be futile and resigned. An employer tolerating such alleged conduct violates Title VII of the Civil Rights Act of 1964, which prohibits discrimination, including harassment, because of an individual's religion.
Under the terms of the conciliation agreement, the company agreed to provide $96,135.54 in back pay and $300,000 in compensatory damages to the former employee, and implement strong injunctive relief that includes updating their anti-discrimination and anti-harassment policies and procedures; creating a recordkeeping mechanism to track complaints; providing extensive training to employees, supervisors, managers, and HR personnel; and providing regular reporting to EEOC on its compliance with the agreement for a period of three years.
"This case underscores the importance of employers taking swift action to address religious harassment," said Andrea Lucas, Chair of the EEOC. "The EEOC remains firmly committed to protecting workers from unlawful religious discrimination and ensuring employers fulfill their obligations to prevent and correct workplace harassment."
"Antisemitism and other forms of religious harassment have no place in the workplace. We commend ITS Logistics for resolving this matter and for investing in meaningful, proactive measures to ensure a workplace free from discrimination and harassment," said Christopher Green, director of the EEOC's San Francisco District. "By participating in the conciliation process, this employer worked with us to reach an appropriate remedy for the worker and demonstrated a strong commitment to fostering a positive and equitable workplace for current and future employees."
"It was crushing to face antisemitic harassment at my first job out of college," said the employee who filed the charge. "This experience taught me something I will carry forever: when you are targeted for nothing more than who you are, your silence only protects the harassers. With the EEOC's help, I walked away from this with justice and real changes to the workplace to ensure this never happens to anyone else."
Company representative Scott Pruneau said, "Any type of discriminatory comments or harassment based on an employee's religious beliefs is not tolerated in our workplace. ITS is committed to a culture of inclusion and treating all employees fairly. We appreciate the EEOC's involvement in this matter."
Since January 2025, the EEOC has taken over 40 public actions to defend employees' religious liberty, including filing lawsuits, resolving lawsuits via consent decrees, and resolving charges via public conciliations and other forms of pre-litigation settlements.
***
Original text here: https://www.eeoc.gov/newsroom/nevada-logistics-company-pay-over-396000-resolve-eeoc-religious-harassment-charge
Independent Inspector General Credits CPSC Leadership with Reversing Longstanding Management Failures
WASHINGTON, Oct. 26 -- The Consumer Product Safety Commission issued the following news release:
* * *
Independent Inspector General Credits CPSC Leadership with Reversing Longstanding Management Failures
*
Watchdog recognizes decisive leadership, greater accountability, and progress in addressing years of institutional deficiencies
WASHINGTON, D.C. - In a newly released report, the U.S. Consumer Product Safety Commission's (CPSC) independent Inspector General recognized progress under Acting Chairman Peter A. Feldman's leadership in addressing longstanding management deficiencies, strengthening ... Show Full Article WASHINGTON, Oct. 26 -- The Consumer Product Safety Commission issued the following news release: * * * Independent Inspector General Credits CPSC Leadership with Reversing Longstanding Management Failures * Watchdog recognizes decisive leadership, greater accountability, and progress in addressing years of institutional deficiencies WASHINGTON, D.C. - In a newly released report, the U.S. Consumer Product Safety Commission's (CPSC) independent Inspector General recognized progress under Acting Chairman Peter A. Feldman's leadership in addressing longstanding management deficiencies, strengtheningaccountability, and improving agency operations.
In his Management and Performance Challenges for Fiscal Year 2027, Inspector General Christopher W. Dentel identified improvement in the agency's leadership and management culture:
"Historically, a recurring issue at the CPSC, and one which has compounded the difficulty in adequately addressing the CPSC's other challenges, has been the 'tone at the top' of the agency. I am happy to report that current senior leadership has taken steps to reverse this trend."
The Inspector General further observed that "current senior leadership has demonstrated a willingness to embrace change and act decisively," and cited progress across several areas:
Accountability and performance: Establishing performance metrics and dashboards, adopting a new strategic plan focused on measurable outcomes, and strengthening oversight of agency programs and personnel.
Enforcement and modernization: Creating an Analytic Center of Excellence to identify unsafe products and target illegal shipments, while advancing modernization of the agency's injury surveillance systems.
Internal controls and risk management: Updating longstanding agency policies, issuing 11 new directives, strengthening agency-wide risk assessments, and improving management oversight.
Operational efficiency: Advancing the relocation of CPSC headquarters to a smaller federal facility in Washington, D.C., reducing the agency's physical footprint by approximately 30 percent.
Regarding the agency's progress in strengthening enterprise risk management, the Inspector General concluded, "[W]e have been impressed by the progress that we have observed to date."
Acting Chairman Feldman issued the following statement:
"Addressing the institutional health of this agency has been one of my highest priorities. For too long, serious deficiencies in management, internal controls, financial oversight, and accountability were allowed to persist without adequate attention from senior agency leadership. These are not merely administrative concerns. They directly affect our ability to protect American consumers and responsibly steward taxpayer resources.
"Much work remains, but I value the Inspector General's independent oversight and appreciate his recognition of the progress we have made. An effective consumer protection agency must also be a well-managed institution. That is the agency we are building."
While the report continues to identify enterprise risk management, resource management, and information technology security as challenges, the Inspector General acknowledges that current leadership inherited longstanding deficiencies that will take time to address. He nevertheless credits agency leadership with making progress toward building "a more transparent, efficient, effective, and accountable agency."
Read the full report: Management and Performance Challenges for Fiscal Year 2027, CPSC Office of Inspector General, October 21, 2026 (Report No. 27-O-01), https://oig.cpsc.gov/reports/top-management-challenges/management-and-performance-challenges-fiscal-year-2027
About the U.S. CPSC
***
Original text here: https://www.cpsc.gov/Newsroom/News-Releases/2027/Independent-Inspector-General-Credits-CPSC-Leadership-with-Reversing-Longstanding-Management-Failures (TNSmrp)
* * *
Independent Inspector General Credits CPSC Leadership with Reversing Longstanding Management Failures
*
Watchdog recognizes decisive leadership, greater accountability, and progress in addressing years of institutional deficiencies
WASHINGTON, D.C. - In a newly released report, the U.S. Consumer Product Safety Commission's (CPSC) independent Inspector General recognized progress under Acting Chairman Peter A. Feldman's leadership in addressing longstanding management deficiencies, strengthening ... Show Full Article WASHINGTON, Oct. 26 -- The Consumer Product Safety Commission issued the following news release: * * * Independent Inspector General Credits CPSC Leadership with Reversing Longstanding Management Failures * Watchdog recognizes decisive leadership, greater accountability, and progress in addressing years of institutional deficiencies WASHINGTON, D.C. - In a newly released report, the U.S. Consumer Product Safety Commission's (CPSC) independent Inspector General recognized progress under Acting Chairman Peter A. Feldman's leadership in addressing longstanding management deficiencies, strengtheningaccountability, and improving agency operations.
In his Management and Performance Challenges for Fiscal Year 2027, Inspector General Christopher W. Dentel identified improvement in the agency's leadership and management culture:
"Historically, a recurring issue at the CPSC, and one which has compounded the difficulty in adequately addressing the CPSC's other challenges, has been the 'tone at the top' of the agency. I am happy to report that current senior leadership has taken steps to reverse this trend."
The Inspector General further observed that "current senior leadership has demonstrated a willingness to embrace change and act decisively," and cited progress across several areas:
Accountability and performance: Establishing performance metrics and dashboards, adopting a new strategic plan focused on measurable outcomes, and strengthening oversight of agency programs and personnel.
Enforcement and modernization: Creating an Analytic Center of Excellence to identify unsafe products and target illegal shipments, while advancing modernization of the agency's injury surveillance systems.
Internal controls and risk management: Updating longstanding agency policies, issuing 11 new directives, strengthening agency-wide risk assessments, and improving management oversight.
Operational efficiency: Advancing the relocation of CPSC headquarters to a smaller federal facility in Washington, D.C., reducing the agency's physical footprint by approximately 30 percent.
Regarding the agency's progress in strengthening enterprise risk management, the Inspector General concluded, "[W]e have been impressed by the progress that we have observed to date."
Acting Chairman Feldman issued the following statement:
"Addressing the institutional health of this agency has been one of my highest priorities. For too long, serious deficiencies in management, internal controls, financial oversight, and accountability were allowed to persist without adequate attention from senior agency leadership. These are not merely administrative concerns. They directly affect our ability to protect American consumers and responsibly steward taxpayer resources.
"Much work remains, but I value the Inspector General's independent oversight and appreciate his recognition of the progress we have made. An effective consumer protection agency must also be a well-managed institution. That is the agency we are building."
While the report continues to identify enterprise risk management, resource management, and information technology security as challenges, the Inspector General acknowledges that current leadership inherited longstanding deficiencies that will take time to address. He nevertheless credits agency leadership with making progress toward building "a more transparent, efficient, effective, and accountable agency."
Read the full report: Management and Performance Challenges for Fiscal Year 2027, CPSC Office of Inspector General, October 21, 2026 (Report No. 27-O-01), https://oig.cpsc.gov/reports/top-management-challenges/management-and-performance-challenges-fiscal-year-2027
About the U.S. CPSC
***
Original text here: https://www.cpsc.gov/Newsroom/News-Releases/2027/Independent-Inspector-General-Credits-CPSC-Leadership-with-Reversing-Longstanding-Management-Failures (TNSmrp)
FTC and State Partners Sue Dollar General for Charging Consumers More than Advertised for Many Products
WASHINGTON, Oct. 26 -- The Federal Trade Commission issued the following news release:
* * *
FTC and State Partners Sue Dollar General for Charging Consumers More than Advertised for Many Products
*
The Federal Trade Commission, joined by 20 states, sued Dollar General Corporation for engaging in long-running deceptive pricing practices by routinely charging customers more at the register than the prices displayed on shelves, price tags and advertisements, costing consumers millions of dollars.
Twenty states joined the FTC in filing a complaint, alleging that Dollar General has, for years, ... Show Full Article WASHINGTON, Oct. 26 -- The Federal Trade Commission issued the following news release: * * * FTC and State Partners Sue Dollar General for Charging Consumers More than Advertised for Many Products * The Federal Trade Commission, joined by 20 states, sued Dollar General Corporation for engaging in long-running deceptive pricing practices by routinely charging customers more at the register than the prices displayed on shelves, price tags and advertisements, costing consumers millions of dollars. Twenty states joined the FTC in filing a complaint, alleging that Dollar General has, for years,repeatedly mislabeled prices, overcharged consumers and failed to correct the issue despite extensive corporate knowledge of the problem. The states joining the FTC lawsuit include Alabama, Arizona, Arkansas, California, Connecticut, Florida, Illinois, Iowa, Kansas, Louisiana, Michigan, Mississippi, Nebraska, New Jersey, North Carolina, Ohio, Oklahoma, Tennessee, Utah and Wisconsin.
"Dollar General has betrayed the trust of millions of American consumers and imposed significant financial harm on communities and consumers who are already struggling to make their paychecks last," said Christopher Mufarrige, Director of the FTC's Bureau of Consumer Protection. "The FTC's action underscores the agency's commitment to lowering costs for consumers by stopping deceptive pricing practices that harm Americans."
Dollar General operates more than 21,000 stores nationwide and markets itself as a low-priced alternative to large discount and big-box retailers. The company sells thousands of household items at low prices, which are critical to its low- and fixed-income customers who rely on the accuracy of Dollar General's pricing.
According to the complaint:
* Thousands of Dollar General stores have taken advantage of vulnerable shoppers by extracting millions of dollars in unlawful overcharges with insufficient safeguards to prevent the practice.
* Dollar General received tens of thousands of complaints from consumers across the country who say the company did not honor the advertised price, demonstrating widespread consumer harm and confirming that customers nationwide have been charged more than the advertised price.
* Dollar General knows that it harms consumers by charging more at the register than the prices it advertises, as reflected by the numerous complaints it has received.
Despite being made aware of the problem, Dollar General has failed to implement policies and practices to adequately address the problem.
The FTC and states allege these practices violate the FTC Act, the Gramm-Leach-Bliley Act and state laws.
The Commission vote authorizing the staff to file the complaint was 2-0. The complaint was filed in the U.S. District Court for the Middle District of Tennessee.
NOTE: The Commission files a complaint when it has "reason to believe" that the named defendants are violating or are about to violate the law and it appears to the Commission that a proceeding is in the public interest. The case will be decided by the court.
***
Original text here: https://www.ftc.gov/news-events/news/press-releases/2026/10/ftc-state-partners-sue-dollar-general-charging-consumers-more-advertised-many-products
* * *
FTC and State Partners Sue Dollar General for Charging Consumers More than Advertised for Many Products
*
The Federal Trade Commission, joined by 20 states, sued Dollar General Corporation for engaging in long-running deceptive pricing practices by routinely charging customers more at the register than the prices displayed on shelves, price tags and advertisements, costing consumers millions of dollars.
Twenty states joined the FTC in filing a complaint, alleging that Dollar General has, for years, ... Show Full Article WASHINGTON, Oct. 26 -- The Federal Trade Commission issued the following news release: * * * FTC and State Partners Sue Dollar General for Charging Consumers More than Advertised for Many Products * The Federal Trade Commission, joined by 20 states, sued Dollar General Corporation for engaging in long-running deceptive pricing practices by routinely charging customers more at the register than the prices displayed on shelves, price tags and advertisements, costing consumers millions of dollars. Twenty states joined the FTC in filing a complaint, alleging that Dollar General has, for years,repeatedly mislabeled prices, overcharged consumers and failed to correct the issue despite extensive corporate knowledge of the problem. The states joining the FTC lawsuit include Alabama, Arizona, Arkansas, California, Connecticut, Florida, Illinois, Iowa, Kansas, Louisiana, Michigan, Mississippi, Nebraska, New Jersey, North Carolina, Ohio, Oklahoma, Tennessee, Utah and Wisconsin.
"Dollar General has betrayed the trust of millions of American consumers and imposed significant financial harm on communities and consumers who are already struggling to make their paychecks last," said Christopher Mufarrige, Director of the FTC's Bureau of Consumer Protection. "The FTC's action underscores the agency's commitment to lowering costs for consumers by stopping deceptive pricing practices that harm Americans."
Dollar General operates more than 21,000 stores nationwide and markets itself as a low-priced alternative to large discount and big-box retailers. The company sells thousands of household items at low prices, which are critical to its low- and fixed-income customers who rely on the accuracy of Dollar General's pricing.
According to the complaint:
* Thousands of Dollar General stores have taken advantage of vulnerable shoppers by extracting millions of dollars in unlawful overcharges with insufficient safeguards to prevent the practice.
* Dollar General received tens of thousands of complaints from consumers across the country who say the company did not honor the advertised price, demonstrating widespread consumer harm and confirming that customers nationwide have been charged more than the advertised price.
* Dollar General knows that it harms consumers by charging more at the register than the prices it advertises, as reflected by the numerous complaints it has received.
Despite being made aware of the problem, Dollar General has failed to implement policies and practices to adequately address the problem.
The FTC and states allege these practices violate the FTC Act, the Gramm-Leach-Bliley Act and state laws.
The Commission vote authorizing the staff to file the complaint was 2-0. The complaint was filed in the U.S. District Court for the Middle District of Tennessee.
NOTE: The Commission files a complaint when it has "reason to believe" that the named defendants are violating or are about to violate the law and it appears to the Commission that a proceeding is in the public interest. The case will be decided by the court.
***
Original text here: https://www.ftc.gov/news-events/news/press-releases/2026/10/ftc-state-partners-sue-dollar-general-charging-consumers-more-advertised-many-products
FCC: COMMISSIONER GOMEZ URGES BROADCASTERS TO PUSH BACK ON ELECTION-YEAR INTIMIDATION
WASHINGTON, Oct. 24 (TNSida) -- The Federal Communications Commission issued the following news release:
* * *
October 23, 2026
COMMISSIONER GOMEZ URGES BROADCASTERS TO PUSH BACK ON ELECTION-YEAR INTIMIDATION
In letter to NAB, Gomez says reporting on polls this Administration dislikes does not meet the legal bar for news distortion or broadcast hoax investigations
-
WASHINGTON--FCC Commissioner Anna M. Gomez today sent a letter to National Association of Broadcasters (NAB) President and CEO Curtis LeGeyt sounding the alarm on the FCC's recent suggestion that broadcasters who air polls this ... Show Full Article WASHINGTON, Oct. 24 (TNSida) -- The Federal Communications Commission issued the following news release: * * * October 23, 2026 COMMISSIONER GOMEZ URGES BROADCASTERS TO PUSH BACK ON ELECTION-YEAR INTIMIDATION In letter to NAB, Gomez says reporting on polls this Administration dislikes does not meet the legal bar for news distortion or broadcast hoax investigations - WASHINGTON--FCC Commissioner Anna M. Gomez today sent a letter to National Association of Broadcasters (NAB) President and CEO Curtis LeGeyt sounding the alarm on the FCC's recent suggestion that broadcasters who air polls thisAdministration dislikes could face a news distortion or broadcast hoax investigation. With the midterms less than two weeks away, the letter urges NAB to make sure every station understands what the law actually requires before that threat has its intended chilling effect.
"This Administration is running a coordinated, government-wide effort to reshape the media into its sanctioned messenger, and the Federal Communications Commission has become one of its most active instruments," wrote Commissioner Gomez.
The letter explains that news distortion and broadcast hoax cases require proof of deliberate distortion of a factual report or knowingly false information about a crime or catastrophe.
"Reporting the results of a poll this Administration happens to dislike does not come close to meeting those standards," Gomez added.
Commissioner Gomez also reminded broadcasters what the public interest standard means.
"This agency does not get to redefine the public interest standard as whatever happens to serve the political interests of whoever is in power. That standard was written into the law to protect the audiences these stations are licensed to serve, not the officials who regulate them."
The letter also points to other recent Commission actions on political programming and advertising affecting broadcasters.
"Your members did not sign up to serve as an arm of any political campaign, and they should not be made to choose between their license and their integrity," Commissioner Gomez concluded.
Read the full letter here (https://www.fcc.gov/sites/default/files/gomez-letter-nab.pdf).
* * *
Original text here: https://docs.fcc.gov/public/attachments/DOC-426167A1.pdf
* * *
October 23, 2026
COMMISSIONER GOMEZ URGES BROADCASTERS TO PUSH BACK ON ELECTION-YEAR INTIMIDATION
In letter to NAB, Gomez says reporting on polls this Administration dislikes does not meet the legal bar for news distortion or broadcast hoax investigations
-
WASHINGTON--FCC Commissioner Anna M. Gomez today sent a letter to National Association of Broadcasters (NAB) President and CEO Curtis LeGeyt sounding the alarm on the FCC's recent suggestion that broadcasters who air polls this ... Show Full Article WASHINGTON, Oct. 24 (TNSida) -- The Federal Communications Commission issued the following news release: * * * October 23, 2026 COMMISSIONER GOMEZ URGES BROADCASTERS TO PUSH BACK ON ELECTION-YEAR INTIMIDATION In letter to NAB, Gomez says reporting on polls this Administration dislikes does not meet the legal bar for news distortion or broadcast hoax investigations - WASHINGTON--FCC Commissioner Anna M. Gomez today sent a letter to National Association of Broadcasters (NAB) President and CEO Curtis LeGeyt sounding the alarm on the FCC's recent suggestion that broadcasters who air polls thisAdministration dislikes could face a news distortion or broadcast hoax investigation. With the midterms less than two weeks away, the letter urges NAB to make sure every station understands what the law actually requires before that threat has its intended chilling effect.
"This Administration is running a coordinated, government-wide effort to reshape the media into its sanctioned messenger, and the Federal Communications Commission has become one of its most active instruments," wrote Commissioner Gomez.
The letter explains that news distortion and broadcast hoax cases require proof of deliberate distortion of a factual report or knowingly false information about a crime or catastrophe.
"Reporting the results of a poll this Administration happens to dislike does not come close to meeting those standards," Gomez added.
Commissioner Gomez also reminded broadcasters what the public interest standard means.
"This agency does not get to redefine the public interest standard as whatever happens to serve the political interests of whoever is in power. That standard was written into the law to protect the audiences these stations are licensed to serve, not the officials who regulate them."
The letter also points to other recent Commission actions on political programming and advertising affecting broadcasters.
"Your members did not sign up to serve as an arm of any political campaign, and they should not be made to choose between their license and their integrity," Commissioner Gomez concluded.
Read the full letter here (https://www.fcc.gov/sites/default/files/gomez-letter-nab.pdf).
* * *
Original text here: https://docs.fcc.gov/public/attachments/DOC-426167A1.pdf
FCC Public Safety & Homeland Security Bureau Issues Public Notice: Bureau Highlights Cybersecurity Best Practices for Communications Service Providers
WASHINGTON, Oct. 24 (TNSdock) -- The Federal Communications Commission Public Safety and Homeland Security Bureau issued the following public notice (Docket No. DA 26-1109):
* * *
With this Public Notice, the Public Safety and Homeland Security Bureau (Bureau) of the Federal Communications Commission (FCC or Commission) highlights best practices for broadcasters and telecommunications service providers (collectively, communications service providers) discussed at the Commission's May 14 and 15, 2026 cybersecurity workshops./1 The workshops brought together experts from the Commission, federal ... Show Full Article WASHINGTON, Oct. 24 (TNSdock) -- The Federal Communications Commission Public Safety and Homeland Security Bureau issued the following public notice (Docket No. DA 26-1109): * * * With this Public Notice, the Public Safety and Homeland Security Bureau (Bureau) of the Federal Communications Commission (FCC or Commission) highlights best practices for broadcasters and telecommunications service providers (collectively, communications service providers) discussed at the Commission's May 14 and 15, 2026 cybersecurity workshops./1 The workshops brought together experts from the Commission, federalpartners, and industry to raise awareness of emerging cybersecurity risks, share and promote best practices, and highlight opportunities for public-private partnership to strengthen cybersecurity and improve incident response across the communications sector./2
I. THREAT LANDSCAPE
The communications sector is a key component of U.S. critical infrastructure and must be resilient to cyberattacks intended to disrupt communications services or exfiltrate sensitive commercial or personal data./3 Telecommunications infrastructure is of particular interest to threat actors, as it is both a target and an attack path: the Internet is the "highway" through which cyberattacks are conveyed, and the telecommunications sector undergirds other critical lifeline functions, such as energy, water, transportation, and finance./4 As a result, communications sector entities, including communications service providers, face growing dangers from criminal groups, foreign state actors, hacktivists, and insider threats./5 Criminal groups are the most likely to be disruptive or destructive to communications service providers in the near-term, while foreign state actors are more likely to "burrow in" to communications service providers' systems for strategic advantage in the future./6
There are multiple ways a threat actor can gain access to communications networks to cause operational disruptions, control systems or services, or exfiltrate data./7 For example, threat actors might engage in social engineering techniques, like impersonating a help desk employee or contractor to gather credentials (e.g., through voice phishing or "vishing"), or attempt to gain access through a compromised link in an e-mail (phishing)./8 Once access is acquired, malicious actors can use ransomware, a type of malicious software, to encrypt a target system's data before demanding a ransom or extorting the victim to decrypt it./9
For broadcasters, unauthorized access can lead to tampering with broadcasts, hijacking transmissions, and manipulating Emergency Alert System (EAS) encoders/decoders./10 The effects of a successful cyberattack can have devastating consequences for a broadcast station. A cyberattack might result in dead air or the broadcast of programming inserted by the threat actor,/11 which could include offensive, obscene, or false information and subject the broadcaster to reputational harm or potential liability./12
For telecommunications service providers, the risks include data loss and disruptions in service continuity and emergency communications./13 Small telecommunications service providers can be critical for connectivity, especially in rural areas./14 Small telecommunications service providers also often inherit the security posture of their vendors, and vulnerabilities in small providers may create risks for the entire sector. This makes robust planning, coordination, and collaboration critically important./15
II. CYBERSECURITY BEST PRACTICES
In general, communications service providers should consult the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), which can help providers better understand, assess, prioritize, and communicate their cybersecurity risk management strategy./16 Providers should implement the below best practices to better mitigate cyber risk.
Develop a Cybersecurity Risk Management Plan. A coherent and thoughtful cybersecurity risk management plan can help shift a provider's security posture from reactive to proactive, allowing it to prioritize threats and make smarter, cost-effective security investments./17 Preparing for cyberattacks as an organization takes buy-in from all internal stakeholders, from technical teams to senior leadership, but it may also include external parties, such as trusted vendors, cyber insurance providers, outside counsel, and marketing/public relations firms./18 To guard against ransom, extortion, and harassment, a cybersecurity risk management plan may include implementing certain practices to reduce the target attack surface for threat actors, including restricting help desk password and multi-factor authentication (MFA) resets without involving a person's manager (to prevent help desk misuse) or prohibiting employees from saving personal contacts on work infrastructure (to prevent the threat actor from using them as leverage)./19
When developing a risk management plan, providers should assess their supply chain risks, including those posed by vendors and other third parties, as attackers are increasingly moving upstream from the communications service provider to target customers or other third parties whose systems are connected with those of the provider./20 Providers should engage with vendors to understand the baseline security of their products or services, potential vulnerabilities, and how they are addressing those vulnerabilities./21 Establishing a line of communication with vendors can facilitate collaboration when situations arise that affect third-party systems and require rapid restoration of the network to a trusted state./22
Conduct a Risk Assessment and Prioritize Critical Assets. Prioritizing protections based on risk can guide your organization's approach in bite-sized, attainable steps that are not overwhelming./23 First, create an inventory to understand what assets are in your network, who is responsible for them, and what their potential attack surfaces and vulnerabilities may be./24 A visual diagram or map of your systems and connections between them can help you determine what is critical, what is exposed, and where there are dependencies./25 After completing your inventory, implement risk-based security controls for each asset: compare the likelihood of a compromise and the amount of harm that could arise from that compromise./26 If the amount of harm that could arise is very high, then that asset is likely one of your "crown jewels" that you should protect at the outset./27 If an asset is highly vulnerable, but its compromise would not expose anything critical to your operations, other assets should likely be addressed first./28 In the case of older/legacy devices that are no longer able to be updated or patched, consider whether the risk of that device being compromised outweighs the cost to protect or replace it./29
Two ways to help keep up with potential vulnerabilities and mitigate risk include: (1) checking the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities Catalog to see if CISA has already identified an exploitable vulnerability "in the wild,"/30 which can help your organization understand how to take steps to address the vulnerability, and (2) using an automated vulnerability scanning system./31 It is important to assess and reassess your controls routinely after the first implementation, and to start early to prospectively build in effective protections over time./32
Practice Basic Cyber Hygiene. There are simple and accessible cybersecurity protections that all organizations, as well as individuals, can implement quickly with high impact./33 These practices contribute to traditional "perimeter-based network security," which focuses on preventing attackers from breaching the outer boundary of a network./34
Identity Management, Authentication, and Access Controls. Begin with the "low hanging fruit," such as password security. Ensure that users, services, and hardware are authenticated securely by changing default and test/configuration passwords, enabling MFA, and ensuring passwords and passphrases are complex./35 When applying basic access controls, consider what information employees should or do have access to and implement firewalls to protect against malicious traffic and restrict sensitive information to only those employees who need it./36
Software and Hardware Updates. Software and hardware should be maintained or replaced. Providers should ensure that they have adopted and documented a patch management process. Prioritize updating critical software and equipment - especially those that are exposed to the public Internet./37 Software updates should be tested before deployment to ensure they are safe and that the software operates as expected prior to use, and patches should be implemented as needed./38 For older/legacy devices that can no longer be updated or patched, consider replacing the device, as the cost of a compromise could be greater than the cost of procuring replacement equipment./39
Data Backups. For data security, use encryption to protect the confidentiality and integrity of network communications. Regularly back up your organization's data and test your backups to ensure they are reliable./40 Consider securely storing backups offline or offsite for additional protection.
Employee Training. Train employees and contractors on proper cyber hygiene practices. Employees should know how to perform the basic cyber hygiene tasks described above (e.g., practicing password hygiene, using MFA, avoiding phishing scams, installing equipment and software updates promptly, and backing up data consistent with company policies). Additionally, ensure employees know how to recognize common attacks and who to contact should problems arise. They should also be encouraged to reach out to those contacts as soon as possible to enable the organization to get ahead of a cyber problem or avoid it altogether./41
Scale Up: Implement a Zero Trust Strategy. While traditional perimeter security is important, recent foreign state-sponsored cyber incidents like Salt Typhoon have underscored the importance of implementing additional controls beyond basic cyber hygiene, such as a "zero trust" security strategy./42 A zero trust strategy accounts for potential "insider threats" by assuming the adversary is already inside the network and restricting accounts, programs, and systems to the bare minimum permissions needed for a user to do their job effectively (i.e., least privilege per-request)./43 In addition to least privilege per-request, network segmentation is another pillar of zero trust./44 Segmentation can make it harder for threat actors to access key data. For example, a firewall can help separate essential systems and prevent a cyber threat actor from moving laterally from one part of a network to another, causing widespread damage./45 Ultimately, when segmenting your network, think about the service provided by each specific function (e.g., corporate/backend vs. customer-facing) and whether they need to be connected, and separate those functions accordingly, where possible./46
For broadcasters, for example, segmentation can help protect the EAS encoder/decoder from cyber threats. Because Internet connectivity is required to reach the Common Alerting Protocol (CAP) and for EAS servers to transmit EAS alerts, segmentation for EAS equipment can include creating a firewall that only allows the encoder/decoder to talk to CAP servers, denying all other inbound traffic./47 In accordance with a zero trust strategy, a broadcaster should secure the communications pathway between the studio and the transmitter, and can use a virtual private network (VPN) or some combination of other encryption capabilities via tunneling./48
Continuously Monitor for Indicators of Compromise. Monitoring is key to knowing when something abnormal is happening in your network./49 Continuous monitoring can also alert you when unknown devices or services have been connected to your network./50 For example, every time a user logs in, accesses a file, or makes changes to your system, they leave a digital record. Monitoring consists of logging these records, collecting the logs in a central location, and reviewing the logs in real time, or near real time, to create a clear picture of normal, baseline behavior./51 Having this baseline allows for deviations or unauthorized behavior to be quickly detected. Reducing the number of connections between critical systems can also enable your organization to better monitor those connections, with the added benefit of helping your organization save on monitoring expenses./52
III. INCIDENT RESPONSE
Develop a Cyber Incident Response Plan. Make a cyber incident response plan part of your overall cybersecurity risk management strategy, and practice implementing the plan in advance to avoid having to invent a strategy in the midst of a cyber incident./53 Your response plan should cover the lifecycle of a cyber incident, from detection to containment, investigation, mitigation, remediation, and restoration. Having a response plan in place can help ensure that evidence is preserved, a response timeline is documented, and an out-of-band option (e.g., Signal or WhatsApp) is established to communicate internally when your system might be vulnerable. All business functions (e.g., security, IT, legal, communications) should be included in your response plan. Establishing a core cyber response team can also help ensure that each function's role and responsibilities are clear to enable a rapid response./54 The incident response plan should also allow for anyone who has a stake in a particular cyber incident (e.g., human resources (HR) for an insider issue or where HR data is compromised, a person with a good relationship with a vendor where the vendor is part of the cyber issue)./55 What your organization uncovers during a cyber incident will change over time, so develop a plan that anticipates activating additional teams as needed./56
The plan may only need to be a few pages long with a quick start guide and a flow chart of what do to after detecting a potential cyber incident, but it should include triggers to escalate decision-making as soon as there is suspicion of a cyber incident; waiting for confirmation of an intrusion may be too late to effectively contain and mitigate a threat actor./57 Response planning also bolsters other cybersecurity protections to minimize disruptions to your business, especially for "zero day" attacks that leverage previously unknown vulnerabilities./58
Contain, Investigate, Mitigate. After a cyber incident has been detected, responsive action should prioritize containment (e.g., resetting credentials, isolating affected systems, implementing machine-level containment, blocking malicious traffic)./59 An investigation into the root cause of the incident is also important to find the attacker's entry point, track lateral movement, and identify any data that may have been exfiltrated or compromised. While taking an entire machine out of service may address operational concerns, failing to uncover the root cause could lead to a "whack-a-mole" issue of continuous breaches./60 During incident response, providers should keep their risk thresholds in mind, to ensure that containment and mitigation actions are taken in order of urgency. Response teams should pay attention to which parts of the network are being affected (e.g., back office vs. subscriber network), and whether customer or company devices have been affected, to inform containment and future recovery actions./61 Determining and documenting what went wrong in a post-incident forensic report can help businesses and public safety authorities prepare for similar attacks in the future. Prior collaboration and coordination can improve the effectiveness of the response, which can, in turn, increase the speed of recovery./62
Remediate and Restore. Recovering from a cyber incident includes restoring assets affected by the incident and returning to normal business operations quickly to reduce the impacts of the incident on your organization's systems and the public./63 Communications--internally, externally, and with the government--during incident response are also vitally important. Information that is shared should be as complete and accurate as possible. The initial set of facts that the response team learns about the attack is unlikely to be the same as the final set of facts, so your organization's leadership may have to make decisions with imperfect information./64 Recovery should also inform hardening activities or modernization plans to address any residual risk to protect against the incident happening again./65
Federal Assistance. Communications service providers should reach out to federal authorities to report successful cyberattacks and seek assistance as soon as they become aware of an incident. The Federal Bureau of Investigation (FBI) or CISA can assist in tactical monitoring by sharing relevant indicators of compromise, if available./66 Companies can report an incident to the FBI through their local FBI field office,/67 or by submitting a report through the FBI's Internet Crime Complaint Center./68 Communications service providers can also share information with CISA through its secure cyber incident reporting portal, or contact the FCC Operations Center, which can also assist with coordination./69
Ransomware Attacks. While cybersecurity risk management and incident response plans should apply broadly, aspects of the workshops focused on ransomware attacks as one example of a common threat facing providers, especially broadcasters and small- and medium-sized telecommunications service providers./70 For many ransomware attacks, it is the ability to operate that is being held ransom, so one of the most important things a provider can do is ensure it has sufficient backups to recover its ability to operate./71 After some initial investigation, teams may need to consider whether or how to engage with a ransomware threat actor. Having a practiced incident response plan can help teams avoid shutting down a system prematurely, which could have unintended operational consequences, but may also alert a threat actor that it has been detected./72 Providers should also prepare to engage with their local FBI field office and other third parties such as their cyber insurer or auditor when considering whether to engage in negotiations with a ransomware threat actor./73 Responding to a ransomware attack should also include an evaluation of sanctions risk, which law enforcement and outside counsel can also help navigate./74
IV. CYBERSECURITY RESOURCES
Join communities and build relationships that enable your organization to learn about active cybersecurity threats and best practices to secure your systems against those threats./75 For example, the Communications Information Sharing and Analysis Center (COMM-ISAC) is a forum for organizations across the telecommunications industry and government to exchange threat information and share success stories of effective security implementations./76 For broadcasters, the Society of Broadcast Engineers, broadcaster associations, and other ISACs can also act as resources./77 Federal agencies, including the FCC, FBI, NIST, and CISA can also provide resources and support./78 The FBI encourages organizations to get in touch with their local field office as soon as possible if a breach occurs so they can help and share information that can assist in your organization's situation./79 Finally, various communications industry associations and groups can also offer resources and best practices./80 No matter the size or sophistication of your organization, there are resources out there to help you prepare in case an incident happens, for the sake of those who rely on your operations.
The information shared in this Public Notice can also be found in the Bureau's Cybersecurity Best Practices Guide, available at https://www.fcc.gov/sites/default/files/CybersecurityBestPracticesGuide102026.pdf. Additional information about the FCC's cybersecurity workshops is available by following these links: Telecommunications Carrier Workshop: https://www.fcc.gov/news-events/events/2026/05/cybersecurity-workshop-telecommunications-carriers; Broadcaster Workshop: https://www.fcc.gov/news-events/events/2026/05/cybersecurity-workshop-broadcasters.
* * *
Original text plus footnotes here: https://docs.fcc.gov/public/attachments/DA-26-1109A1.pdf
* * *
With this Public Notice, the Public Safety and Homeland Security Bureau (Bureau) of the Federal Communications Commission (FCC or Commission) highlights best practices for broadcasters and telecommunications service providers (collectively, communications service providers) discussed at the Commission's May 14 and 15, 2026 cybersecurity workshops./1 The workshops brought together experts from the Commission, federal ... Show Full Article WASHINGTON, Oct. 24 (TNSdock) -- The Federal Communications Commission Public Safety and Homeland Security Bureau issued the following public notice (Docket No. DA 26-1109): * * * With this Public Notice, the Public Safety and Homeland Security Bureau (Bureau) of the Federal Communications Commission (FCC or Commission) highlights best practices for broadcasters and telecommunications service providers (collectively, communications service providers) discussed at the Commission's May 14 and 15, 2026 cybersecurity workshops./1 The workshops brought together experts from the Commission, federalpartners, and industry to raise awareness of emerging cybersecurity risks, share and promote best practices, and highlight opportunities for public-private partnership to strengthen cybersecurity and improve incident response across the communications sector./2
I. THREAT LANDSCAPE
The communications sector is a key component of U.S. critical infrastructure and must be resilient to cyberattacks intended to disrupt communications services or exfiltrate sensitive commercial or personal data./3 Telecommunications infrastructure is of particular interest to threat actors, as it is both a target and an attack path: the Internet is the "highway" through which cyberattacks are conveyed, and the telecommunications sector undergirds other critical lifeline functions, such as energy, water, transportation, and finance./4 As a result, communications sector entities, including communications service providers, face growing dangers from criminal groups, foreign state actors, hacktivists, and insider threats./5 Criminal groups are the most likely to be disruptive or destructive to communications service providers in the near-term, while foreign state actors are more likely to "burrow in" to communications service providers' systems for strategic advantage in the future./6
There are multiple ways a threat actor can gain access to communications networks to cause operational disruptions, control systems or services, or exfiltrate data./7 For example, threat actors might engage in social engineering techniques, like impersonating a help desk employee or contractor to gather credentials (e.g., through voice phishing or "vishing"), or attempt to gain access through a compromised link in an e-mail (phishing)./8 Once access is acquired, malicious actors can use ransomware, a type of malicious software, to encrypt a target system's data before demanding a ransom or extorting the victim to decrypt it./9
For broadcasters, unauthorized access can lead to tampering with broadcasts, hijacking transmissions, and manipulating Emergency Alert System (EAS) encoders/decoders./10 The effects of a successful cyberattack can have devastating consequences for a broadcast station. A cyberattack might result in dead air or the broadcast of programming inserted by the threat actor,/11 which could include offensive, obscene, or false information and subject the broadcaster to reputational harm or potential liability./12
For telecommunications service providers, the risks include data loss and disruptions in service continuity and emergency communications./13 Small telecommunications service providers can be critical for connectivity, especially in rural areas./14 Small telecommunications service providers also often inherit the security posture of their vendors, and vulnerabilities in small providers may create risks for the entire sector. This makes robust planning, coordination, and collaboration critically important./15
II. CYBERSECURITY BEST PRACTICES
In general, communications service providers should consult the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), which can help providers better understand, assess, prioritize, and communicate their cybersecurity risk management strategy./16 Providers should implement the below best practices to better mitigate cyber risk.
Develop a Cybersecurity Risk Management Plan. A coherent and thoughtful cybersecurity risk management plan can help shift a provider's security posture from reactive to proactive, allowing it to prioritize threats and make smarter, cost-effective security investments./17 Preparing for cyberattacks as an organization takes buy-in from all internal stakeholders, from technical teams to senior leadership, but it may also include external parties, such as trusted vendors, cyber insurance providers, outside counsel, and marketing/public relations firms./18 To guard against ransom, extortion, and harassment, a cybersecurity risk management plan may include implementing certain practices to reduce the target attack surface for threat actors, including restricting help desk password and multi-factor authentication (MFA) resets without involving a person's manager (to prevent help desk misuse) or prohibiting employees from saving personal contacts on work infrastructure (to prevent the threat actor from using them as leverage)./19
When developing a risk management plan, providers should assess their supply chain risks, including those posed by vendors and other third parties, as attackers are increasingly moving upstream from the communications service provider to target customers or other third parties whose systems are connected with those of the provider./20 Providers should engage with vendors to understand the baseline security of their products or services, potential vulnerabilities, and how they are addressing those vulnerabilities./21 Establishing a line of communication with vendors can facilitate collaboration when situations arise that affect third-party systems and require rapid restoration of the network to a trusted state./22
Conduct a Risk Assessment and Prioritize Critical Assets. Prioritizing protections based on risk can guide your organization's approach in bite-sized, attainable steps that are not overwhelming./23 First, create an inventory to understand what assets are in your network, who is responsible for them, and what their potential attack surfaces and vulnerabilities may be./24 A visual diagram or map of your systems and connections between them can help you determine what is critical, what is exposed, and where there are dependencies./25 After completing your inventory, implement risk-based security controls for each asset: compare the likelihood of a compromise and the amount of harm that could arise from that compromise./26 If the amount of harm that could arise is very high, then that asset is likely one of your "crown jewels" that you should protect at the outset./27 If an asset is highly vulnerable, but its compromise would not expose anything critical to your operations, other assets should likely be addressed first./28 In the case of older/legacy devices that are no longer able to be updated or patched, consider whether the risk of that device being compromised outweighs the cost to protect or replace it./29
Two ways to help keep up with potential vulnerabilities and mitigate risk include: (1) checking the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities Catalog to see if CISA has already identified an exploitable vulnerability "in the wild,"/30 which can help your organization understand how to take steps to address the vulnerability, and (2) using an automated vulnerability scanning system./31 It is important to assess and reassess your controls routinely after the first implementation, and to start early to prospectively build in effective protections over time./32
Practice Basic Cyber Hygiene. There are simple and accessible cybersecurity protections that all organizations, as well as individuals, can implement quickly with high impact./33 These practices contribute to traditional "perimeter-based network security," which focuses on preventing attackers from breaching the outer boundary of a network./34
Identity Management, Authentication, and Access Controls. Begin with the "low hanging fruit," such as password security. Ensure that users, services, and hardware are authenticated securely by changing default and test/configuration passwords, enabling MFA, and ensuring passwords and passphrases are complex./35 When applying basic access controls, consider what information employees should or do have access to and implement firewalls to protect against malicious traffic and restrict sensitive information to only those employees who need it./36
Software and Hardware Updates. Software and hardware should be maintained or replaced. Providers should ensure that they have adopted and documented a patch management process. Prioritize updating critical software and equipment - especially those that are exposed to the public Internet./37 Software updates should be tested before deployment to ensure they are safe and that the software operates as expected prior to use, and patches should be implemented as needed./38 For older/legacy devices that can no longer be updated or patched, consider replacing the device, as the cost of a compromise could be greater than the cost of procuring replacement equipment./39
Data Backups. For data security, use encryption to protect the confidentiality and integrity of network communications. Regularly back up your organization's data and test your backups to ensure they are reliable./40 Consider securely storing backups offline or offsite for additional protection.
Employee Training. Train employees and contractors on proper cyber hygiene practices. Employees should know how to perform the basic cyber hygiene tasks described above (e.g., practicing password hygiene, using MFA, avoiding phishing scams, installing equipment and software updates promptly, and backing up data consistent with company policies). Additionally, ensure employees know how to recognize common attacks and who to contact should problems arise. They should also be encouraged to reach out to those contacts as soon as possible to enable the organization to get ahead of a cyber problem or avoid it altogether./41
Scale Up: Implement a Zero Trust Strategy. While traditional perimeter security is important, recent foreign state-sponsored cyber incidents like Salt Typhoon have underscored the importance of implementing additional controls beyond basic cyber hygiene, such as a "zero trust" security strategy./42 A zero trust strategy accounts for potential "insider threats" by assuming the adversary is already inside the network and restricting accounts, programs, and systems to the bare minimum permissions needed for a user to do their job effectively (i.e., least privilege per-request)./43 In addition to least privilege per-request, network segmentation is another pillar of zero trust./44 Segmentation can make it harder for threat actors to access key data. For example, a firewall can help separate essential systems and prevent a cyber threat actor from moving laterally from one part of a network to another, causing widespread damage./45 Ultimately, when segmenting your network, think about the service provided by each specific function (e.g., corporate/backend vs. customer-facing) and whether they need to be connected, and separate those functions accordingly, where possible./46
For broadcasters, for example, segmentation can help protect the EAS encoder/decoder from cyber threats. Because Internet connectivity is required to reach the Common Alerting Protocol (CAP) and for EAS servers to transmit EAS alerts, segmentation for EAS equipment can include creating a firewall that only allows the encoder/decoder to talk to CAP servers, denying all other inbound traffic./47 In accordance with a zero trust strategy, a broadcaster should secure the communications pathway between the studio and the transmitter, and can use a virtual private network (VPN) or some combination of other encryption capabilities via tunneling./48
Continuously Monitor for Indicators of Compromise. Monitoring is key to knowing when something abnormal is happening in your network./49 Continuous monitoring can also alert you when unknown devices or services have been connected to your network./50 For example, every time a user logs in, accesses a file, or makes changes to your system, they leave a digital record. Monitoring consists of logging these records, collecting the logs in a central location, and reviewing the logs in real time, or near real time, to create a clear picture of normal, baseline behavior./51 Having this baseline allows for deviations or unauthorized behavior to be quickly detected. Reducing the number of connections between critical systems can also enable your organization to better monitor those connections, with the added benefit of helping your organization save on monitoring expenses./52
III. INCIDENT RESPONSE
Develop a Cyber Incident Response Plan. Make a cyber incident response plan part of your overall cybersecurity risk management strategy, and practice implementing the plan in advance to avoid having to invent a strategy in the midst of a cyber incident./53 Your response plan should cover the lifecycle of a cyber incident, from detection to containment, investigation, mitigation, remediation, and restoration. Having a response plan in place can help ensure that evidence is preserved, a response timeline is documented, and an out-of-band option (e.g., Signal or WhatsApp) is established to communicate internally when your system might be vulnerable. All business functions (e.g., security, IT, legal, communications) should be included in your response plan. Establishing a core cyber response team can also help ensure that each function's role and responsibilities are clear to enable a rapid response./54 The incident response plan should also allow for anyone who has a stake in a particular cyber incident (e.g., human resources (HR) for an insider issue or where HR data is compromised, a person with a good relationship with a vendor where the vendor is part of the cyber issue)./55 What your organization uncovers during a cyber incident will change over time, so develop a plan that anticipates activating additional teams as needed./56
The plan may only need to be a few pages long with a quick start guide and a flow chart of what do to after detecting a potential cyber incident, but it should include triggers to escalate decision-making as soon as there is suspicion of a cyber incident; waiting for confirmation of an intrusion may be too late to effectively contain and mitigate a threat actor./57 Response planning also bolsters other cybersecurity protections to minimize disruptions to your business, especially for "zero day" attacks that leverage previously unknown vulnerabilities./58
Contain, Investigate, Mitigate. After a cyber incident has been detected, responsive action should prioritize containment (e.g., resetting credentials, isolating affected systems, implementing machine-level containment, blocking malicious traffic)./59 An investigation into the root cause of the incident is also important to find the attacker's entry point, track lateral movement, and identify any data that may have been exfiltrated or compromised. While taking an entire machine out of service may address operational concerns, failing to uncover the root cause could lead to a "whack-a-mole" issue of continuous breaches./60 During incident response, providers should keep their risk thresholds in mind, to ensure that containment and mitigation actions are taken in order of urgency. Response teams should pay attention to which parts of the network are being affected (e.g., back office vs. subscriber network), and whether customer or company devices have been affected, to inform containment and future recovery actions./61 Determining and documenting what went wrong in a post-incident forensic report can help businesses and public safety authorities prepare for similar attacks in the future. Prior collaboration and coordination can improve the effectiveness of the response, which can, in turn, increase the speed of recovery./62
Remediate and Restore. Recovering from a cyber incident includes restoring assets affected by the incident and returning to normal business operations quickly to reduce the impacts of the incident on your organization's systems and the public./63 Communications--internally, externally, and with the government--during incident response are also vitally important. Information that is shared should be as complete and accurate as possible. The initial set of facts that the response team learns about the attack is unlikely to be the same as the final set of facts, so your organization's leadership may have to make decisions with imperfect information./64 Recovery should also inform hardening activities or modernization plans to address any residual risk to protect against the incident happening again./65
Federal Assistance. Communications service providers should reach out to federal authorities to report successful cyberattacks and seek assistance as soon as they become aware of an incident. The Federal Bureau of Investigation (FBI) or CISA can assist in tactical monitoring by sharing relevant indicators of compromise, if available./66 Companies can report an incident to the FBI through their local FBI field office,/67 or by submitting a report through the FBI's Internet Crime Complaint Center./68 Communications service providers can also share information with CISA through its secure cyber incident reporting portal, or contact the FCC Operations Center, which can also assist with coordination./69
Ransomware Attacks. While cybersecurity risk management and incident response plans should apply broadly, aspects of the workshops focused on ransomware attacks as one example of a common threat facing providers, especially broadcasters and small- and medium-sized telecommunications service providers./70 For many ransomware attacks, it is the ability to operate that is being held ransom, so one of the most important things a provider can do is ensure it has sufficient backups to recover its ability to operate./71 After some initial investigation, teams may need to consider whether or how to engage with a ransomware threat actor. Having a practiced incident response plan can help teams avoid shutting down a system prematurely, which could have unintended operational consequences, but may also alert a threat actor that it has been detected./72 Providers should also prepare to engage with their local FBI field office and other third parties such as their cyber insurer or auditor when considering whether to engage in negotiations with a ransomware threat actor./73 Responding to a ransomware attack should also include an evaluation of sanctions risk, which law enforcement and outside counsel can also help navigate./74
IV. CYBERSECURITY RESOURCES
Join communities and build relationships that enable your organization to learn about active cybersecurity threats and best practices to secure your systems against those threats./75 For example, the Communications Information Sharing and Analysis Center (COMM-ISAC) is a forum for organizations across the telecommunications industry and government to exchange threat information and share success stories of effective security implementations./76 For broadcasters, the Society of Broadcast Engineers, broadcaster associations, and other ISACs can also act as resources./77 Federal agencies, including the FCC, FBI, NIST, and CISA can also provide resources and support./78 The FBI encourages organizations to get in touch with their local field office as soon as possible if a breach occurs so they can help and share information that can assist in your organization's situation./79 Finally, various communications industry associations and groups can also offer resources and best practices./80 No matter the size or sophistication of your organization, there are resources out there to help you prepare in case an incident happens, for the sake of those who rely on your operations.
The information shared in this Public Notice can also be found in the Bureau's Cybersecurity Best Practices Guide, available at https://www.fcc.gov/sites/default/files/CybersecurityBestPracticesGuide102026.pdf. Additional information about the FCC's cybersecurity workshops is available by following these links: Telecommunications Carrier Workshop: https://www.fcc.gov/news-events/events/2026/05/cybersecurity-workshop-telecommunications-carriers; Broadcaster Workshop: https://www.fcc.gov/news-events/events/2026/05/cybersecurity-workshop-broadcasters.
* * *
Original text plus footnotes here: https://docs.fcc.gov/public/attachments/DA-26-1109A1.pdf
FCC Issues Notice of Violation to BMG Billings
WASHINGTON, Oct. 24 (TNSdock) -- The Federal Communications Commission Enforcement Bureau has issued a notice of violation entitled "In the Matter of BMG Billings, LLC" (File No.: EB-FIELDWR-24-00037341), following an inspection that uncovered multiple Emergency Alert System infractions at four radio stations in Billings, Montana.
The action targets BMG Billings, LLC, the licensee operating KEWF, KRPM, KYSX, and KRSQ. An agent from the Denver Office visited the facilities at 1302 Avenue D, Suite 103, on July 29, 2026, after receiving a complaint.
During the site check, investigators identified ... Show Full Article WASHINGTON, Oct. 24 (TNSdock) -- The Federal Communications Commission Enforcement Bureau has issued a notice of violation entitled "In the Matter of BMG Billings, LLC" (File No.: EB-FIELDWR-24-00037341), following an inspection that uncovered multiple Emergency Alert System infractions at four radio stations in Billings, Montana. The action targets BMG Billings, LLC, the licensee operating KEWF, KRPM, KYSX, and KRSQ. An agent from the Denver Office visited the facilities at 1302 Avenue D, Suite 103, on July 29, 2026, after receiving a complaint. During the site check, investigators identifiedthree specific compliance failures. First, the stations monitored a secondary Emergency Alert System source not assigned to them or listed in the State of Montana Emergency Alert System Plan. Second, the licensee failed to provide signed logs demonstrating that required emergency tests were conducted in accordance with federal rules and operating handbooks. Third, the chief operator failed to take required corrective measures to stop the stations from using the unapproved emergency monitoring source.
Federal officials emphasized that the Emergency Alert System serves a vital public safety role and expects full adherence from broadcast licensees. Issuing this notice does not prevent the agency from taking additional enforcement actions, such as imposing financial penalties.
BMG Billings must submit a written statement within 20 days of the release date. The response must explain the circumstances of each infraction, detail corrective actions taken to prevent repeat occurrences, and provide a timeline for ongoing remedies. Federal regulations require an authorized officer to support the filing with an affidavit or declaration under penalty of perjury.
-- Vidhi Gianani, Targeted News Service
* * *
BMG Billings LLC is based in Cherry Hills Village, Colorado.
* * *
URL: BMG Billings LLC
* * *
Original text here: https://docs.fcc.gov/public/attachments/DA-26-1148A1.pdf
The action targets BMG Billings, LLC, the licensee operating KEWF, KRPM, KYSX, and KRSQ. An agent from the Denver Office visited the facilities at 1302 Avenue D, Suite 103, on July 29, 2026, after receiving a complaint.
During the site check, investigators identified ... Show Full Article WASHINGTON, Oct. 24 (TNSdock) -- The Federal Communications Commission Enforcement Bureau has issued a notice of violation entitled "In the Matter of BMG Billings, LLC" (File No.: EB-FIELDWR-24-00037341), following an inspection that uncovered multiple Emergency Alert System infractions at four radio stations in Billings, Montana. The action targets BMG Billings, LLC, the licensee operating KEWF, KRPM, KYSX, and KRSQ. An agent from the Denver Office visited the facilities at 1302 Avenue D, Suite 103, on July 29, 2026, after receiving a complaint. During the site check, investigators identifiedthree specific compliance failures. First, the stations monitored a secondary Emergency Alert System source not assigned to them or listed in the State of Montana Emergency Alert System Plan. Second, the licensee failed to provide signed logs demonstrating that required emergency tests were conducted in accordance with federal rules and operating handbooks. Third, the chief operator failed to take required corrective measures to stop the stations from using the unapproved emergency monitoring source.
Federal officials emphasized that the Emergency Alert System serves a vital public safety role and expects full adherence from broadcast licensees. Issuing this notice does not prevent the agency from taking additional enforcement actions, such as imposing financial penalties.
BMG Billings must submit a written statement within 20 days of the release date. The response must explain the circumstances of each infraction, detail corrective actions taken to prevent repeat occurrences, and provide a timeline for ongoing remedies. Federal regulations require an authorized officer to support the filing with an affidavit or declaration under penalty of perjury.
-- Vidhi Gianani, Targeted News Service
* * *
BMG Billings LLC is based in Cherry Hills Village, Colorado.
* * *
URL: BMG Billings LLC
* * *
Original text here: https://docs.fcc.gov/public/attachments/DA-26-1148A1.pdf