; (B) terminate not more than 3 years after the date of enactment of this section; and (C) be subject to any guidelines issued by the Director. (d) Report Not later than 4 years after the date of enactment of this section, the Director shall publish the results of the study conducted under subsection (a) and the pilot program established under subsection (c) on a publicly available website. 331. GAO report on cybersecurity of commercial aviation avionics (a) In general The Comptroller General shall conduct a review on the consideration, identification, and inclusion of aircraft cybersecurity into the strategic framework for aviation security as part of the FAA’s cybersecurity strategy. (b) Contents of the review The review required by subsection (a) shall assess— (1) how onboard aircraft cybersecurity risks and vulnerabilities are defined and accounted for in the strategy aviation security framework, particularly in pillar 2 of that framework to protect and defend FAA networks and systems to mitigate risks to FAA missions and service delivery ; (2) how onboard aircraft cybersecurity, particularly of the aircraft avionics, is considered, incorporated, and prioritized in the cybersecurity strategy pursuant to section 509 of the FAA Reauthorization Act of 2018 ( 49 U.S.C. 44903 note); (3) how roles and responsibilities for aircraft and ground systems cybersecurity are differentiated and enforced between the Transportation Security Agency and the FAA; (4) how aircraft and ground systems cybersecurity vulnerabilities are being identified and prioritized for mitigation, particularly considering the commercial technology ecosystem