CISA Critical Infrastructure Sector
Chemical facility drone security
Chemical production, storage and transport sites hold hazards that are legible from the air: tank farms, containment berms, rail spurs and process units all read clearly from a few hundred feet up. An unauthorized overflight of a facility handling a listed chemical is not a curiosity. It is a security event worth detecting and documenting, and many sites have no documented way to detect or record one.
Where The Exposure Is
Four things that make this sector different.
VISIBLE HAZARD
Tank farms, containment and process units are identifiable by type and scale from directly overhead, in a way a fence line survey never reveals.
A REGULATORY GAP
The federal program that once set baseline chemical facility security requirements has been unenforceable for several years. Many sites are operating on a security posture that was never revisited for it.
MULTI-MODAL SITES
Rail spurs, marine terminals and truck racks sit inside the same perimeter as production. Each mode carries its own inspection regime, and none of them was built with the air domain in mind.
CONSEQUENCE AT DISTANCE
A release from a listed chemical facility can affect a community well beyond the fence line, which is why the exposure question here is bigger than the site itself.
Regulatory Context
The Chemical Facility Anti-Terrorism Standards (CFATS, 6 CFR Part 27) has been unenforceable since its statutory authority lapsed on July 28, 2023, and it has not been reauthorized. In its absence, the EPA Risk Management Program (40 CFR Part 68) still applies to stationary sources holding more than a threshold quantity of a listed chemical, requiring a hazard assessment, a prevention program and an emergency response plan, updated at least every five years. It is an accident-prevention rule, not a security rule, and it does not mention drones.
Chemical facilities located at ports fall separately under the Maritime Transportation Security Act (33 CFR Part 105), which requires a facility security assessment and a Coast Guard-approved facility security plan, audited annually and valid for five years. CISA’s ChemLock program is voluntary. Chemical facilities and oil refineries are also named as eligible site types under the FAA’s proposed Section 2209 rule (91 FR 24650), which is not yet final.
Where a DVRA applies: at chemical facilities regulated under MTSA, it feeds directly into the MTSA facility security assessment and its annual audit. Elsewhere, in the absence of a reauthorized CFATS, it is voluntary work that fills the gap the lapsed program left,, not compliance with a federal security mandate.
How An Engagement Applies Here
The same four pillars, scoped to this environment.
Common questions
Has ClearPoint worked with organizations in this sector?
This page describes how our method applies to the environment, not a client list. ClearPoint does not publish client or engagement records.
Is CFATS still in effect for our facility?
No. CFATS has been unenforceable since its statutory authority lapsed in July 2023, and it has not been reauthorized. That does not remove the underlying hazard. The EPA Risk Management Program still applies to sites holding more than a threshold quantity of a listed chemical, and drone exposure belongs in the site’s voluntary security review rather than in the RMP itself even without a reinstated security mandate.
What does an engagement here usually start with?
A DVRA. It establishes what is actually flying over the site, what a viewer could learn about your process from above, and where detection or procedure has a gap.
Can you stop a drone over our facility?
No. In the United States, mitigating a drone is limited to federal agencies with statutory authority and, since July 2026, to state and local law enforcement and correctional agencies certified under the SAFER SKIES Act. ClearPoint does not mitigate. ClearPoint detects, tracks, assesses, documents, trains and coordinates with the agencies that hold that authority.
Do you recommend specific detection hardware?
No. ClearPoint holds no hardware line. A DVRA identifies what a site actually needs, and technology decisions follow the assessment rather than a vendor relationship.
Start with the decision you need to make.
Whether you’re evaluating drone risk or ready to assess a specific site, we’ll help you identify the next step.