CISA Critical Infrastructure Sector

Counter-drone for manufacturing facilities

Plants and process lines put proprietary operations on open display to anyone above them. Line layouts, tooling, throughput and even in-progress prototypes can be documented from the air in a single pass, without setting foot on the property. Most facilities have no way to detect that pass, let alone decide what to do about it.

Where The Exposure Is

Four things that make this sector different.

VISIBLE OPERATIONS

Process lines, yard layouts and outdoor storage are legible from directly above in a way a ground-level fence line never reveals.

NO MANDATORY SECURITY RULE

There is no federal security regulation specific to this sector, and CISA’s guidance for it is voluntary. Posture depends entirely on what each facility decides to do on its own.

EXPORT-CONTROLLED WORK

Plants producing defense articles or controlled technical data carry a narrower but sharper exposure: visual access to that work by a foreign person can itself be a controlled release.

CAMPUS-STYLE SITES

Large plants often combine production, outdoor laydown and logistics yards inside one perimeter, spreading exposure across areas with very different sensitivity.

Regulatory Context

VOLUNTARY POSTURE, WITH A SHARPER EXPORT-CONTROL EDGE

There is no mandatory federal security regulation for critical manufacturing facilities in general, and CISA’s guidance for the sector is voluntary. OSHA’s Process Safety Management standard (29 CFR 1910.119) applies to certain hazardous processes, but it is a workplace safety rule, not a security rule, and it does not address aerial observation.

Where a plant handles defense articles or export-controlled technical data, the exposure sharpens considerably. The International Traffic in Arms Regulations (22 CFR Parts 120 to 130) and the Export Administration Regulations (15 CFR Parts 730 to 774) govern who may access controlled technical data and articles, and visual access to controlled technical data by a foreign person can count as a release under those rules.

Where a DVRA applies: for most facilities, it is voluntary due diligence filling the space a mandatory sector rule does not occupy. For facilities with export-controlled operations, it adds a specific check on whether controlled hardware, processes or technical data can be observed or photographed from the air, a question worth checking directly.

How An Engagement Applies Here

The same four pillars, scoped to this environment.

01 OPERATIONSView pillarManaged detection and monitoring across plant grounds, yards, and logistics areas, with intelligence briefings on what is actually observed overhead.

02 ASSESSMENTSView pillarA DVRA establishing the site baseline, what is visible from above, and where export-controlled areas may need a tighter answer than the rest of the plant.

03 RESPONSEView pillarMitigation strategy and TTP development, tabletop exercises against an observed-incursion scenario, and forensics after an incident.

04 TRAININGView pillarCertification paths so plant security and export compliance personnel retain the capability rather than depending on outside support.

Common questions

Has ClearPoint worked with organizations in this sector?

This page describes how our method applies to the environment, not a client list. ClearPoint does not publish client or engagement records.

Is drone detection required for our facility?

Not by federal regulation. There is no mandatory federal security rule for critical manufacturing facilities generally, and CISA’s guidance is voluntary. Where a plant handles export-controlled work, the exposure is different: aerial observation of controlled technical data or hardware by a foreign person can itself raise an ITAR or EAR concern, independent of any security mandate.

What does an engagement here usually start with?

A DVRA. It establishes what is actually visible from above, what a viewer could learn about your process or your export-controlled work, and where detection has a gap.

Can you stop a drone over our facility?

No. In the United States, mitigating a drone is limited to federal agencies with statutory authority and, since July 2026, to state and local law enforcement and correctional agencies certified under the SAFER SKIES Act. ClearPoint does not mitigate. ClearPoint detects, tracks, assesses, documents, trains and coordinates with the agencies that hold that authority.

Does this overlap with our ITAR compliance program?

It can, but a DVRA is not a substitute for ITAR or EAR compliance counsel. It looks specifically at whether controlled hardware, processes or data can be observed or photographed from the air, a question most export compliance programs were not built to answer.

CAPABILITYDVRAThe five-stage assessment method and what each stage leaves behind. PILLAR 02AssessmentsRed teaming, tabletop exercises, threat and technology briefings. SECTORSAll 16 CISA sectorsWhere else this applies, and what exposure looks like there.