CISA Critical Infrastructure Sector

Venues, stadiums and large gatherings

A venue’s exposure is not constant. It spikes on event day, when the crowd is densest, the airspace restriction is temporary, and the people who would have to act are the most stretched. The assessment has to be built around the event, not the building.

Where The Exposure Is

Four things that make this sector different.

TEMPORARY AIRSPACE

Event-driven flight restrictions exist, but they are temporary, poorly understood by the flying public, and unenforceable by the venue itself. Knowing a restriction applies is not the same as being able to do anything about a breach.

CROWD DENSITY

The consequence of even a small aircraft coming down is set by what is underneath it. Nowhere else does the same platform carry such different risk depending on the hour.

COMPRESSED DECISION WINDOW

On event day the window between detection and consequence is minutes. Procedure that has never been rehearsed under load will not hold in it.

SHARED AUTHORITY

Venue security, contracted staff, local law enforcement and federal partners all hold part of the response. The gap is rarely the sensor. It is who is authorized to make the call.

Regulatory Context

EVENT-DAY RESTRICTIONS

FDC NOTAM 4/3621 designates National Defense Airspace under section 352 of Public Law 108-7, as amended by section 521 of Public Law 108-199. It bans drone flight at or below 3,000 feet AGL within 3 nautical miles of a stadium seating 30,000 or more during MLB games, NFL regular and post-season games, NCAA Division I football games and major motor speedway events, from one hour before the scheduled start until one hour after the event ends. Violations carry criminal penalties under 49 U.S.C. 46307. Separate restrictions cover the Super Bowl and 2026 FIFA World Cup venues. Section 935 of the FAA Reauthorization Act of 2024 also lets law enforcement request drone-only temporary flight restrictions for open-air gatherings of 30,000 or more at eligible venues, filed at least 30 days ahead. The DHS SAFETY Act (6 U.S.C. 441 to 444, 6 CFR Part 25) is a separate, voluntary program in which Designation or Certification gives liability protection for a vetted security program, and a number of stadiums hold it.

Enforcement of the airspace restriction rests with federal authorities, not the venue. What a venue can own is detection, documentation, a rehearsed procedure and a working relationship with the agencies that hold enforcement authority, including, since the SAFER SKIES Act, certified state and local law enforcement agencies that may act against drone threats at mass gatherings. That is what an assessment is scoped to establish, including documentation suitable for a SAFETY Act submission where one is sought.

How An Engagement Applies Here

The same four pillars, scoped to this environment.

01 OPERATIONSView pillarManaged detection and monitoring against the plan, plus intelligence briefings on what is actually being seen over the venue on event day.
02 ASSESSMENTSView pillarA DVRA to establish real exposure, threat profile and gap register. The baseline everything else is decided from.
03 RESPONSEView pillarMitigation strategy and TTP development, tabletop exercises against the real chain of command, and forensics after an incident.
04 TRAININGView pillarCertification paths so the capability stays with your personnel rather than leaving with a contractor.

Common questions

Has ClearPoint worked with organizations in this sector?

This page describes how our method applies to the environment, not a client list. ClearPoint does not publish client or engagement records.

What does an engagement here usually start with?

A DVRA. It establishes the baseline: what is actually flying over the venue, what it can reach, and where detection or procedure breaks down. Every subsequent decision depends on it.

Do we need detection equipment running at every event?

Almost certainly not at the same level throughout. An assessment run before procurement can reduce the equipment bill rather than increase it. Coverage should follow exposure, and a venue’s exposure differs sharply between a quiet weekday and a sold-out event day.

Can you stop a drone over our facility?

No. In the United States, mitigating a drone is limited to federal agencies with statutory authority and, since July 2026, to state and local law enforcement and correctional agencies certified under the SAFER SKIES Act. ClearPoint does not mitigate. ClearPoint detects, tracks, assesses, documents, trains and coordinates with the agencies that hold that authority.