CISA Critical Infrastructure Sector
Dams
Spillway gates, intakes, penstocks and control buildings sit in terrain built for water, not for perimeter security. Many projects are remote, road access is limited, and the structures that matter most to a project’s safe operation are also the ones most legible from directly overhead.
Where The Exposure Is
Four things that make this sector different.
CRITICAL STRUCTURES OVERHEAD
Spillway gates, intakes, penstocks and control buildings are readable from the air in a way that a ground patrol along a fence line was never designed to catch.
CONSEQUENCE-TIERED OVERSIGHT
FERC places licensed projects into Security Groups by consequence. The highest-consequence projects carry the most scrutiny, and physical security expectations scale with that tier.
REMOTE APPROACH TERRAIN
Many dams sit at the end of long, unmonitored access roads or in terrain that makes ground-based surveillance difficult. That same terrain does nothing to slow an aircraft.
MIXED OWNERSHIP AND POLICY
FERC-licensed hydropower projects, U.S. Army Corps of Engineers dams and Bureau of Reclamation facilities each answer to a different security framework, which complicates a single, consistent airspace picture across a river system.
Regulatory Context
FERC-licensed hydropower projects are covered by the FERC Security Program for Hydropower Projects, applied through license conditions alongside dam safety inspections under 18 CFR Part 12. Projects are placed into Security Groups 1 to 3 by consequence. Licensees are expected to identify their higher-consequence sites, perform vulnerability assessments, maintain security plans and certify compliance.
Federal dams operated by the U.S. Army Corps of Engineers or the Bureau of Reclamation follow their own agency security policy rather than the FERC program. A DVRA is written to feed the vulnerability assessment and security plan a Security Group 1 or 2 project already has to maintain, with aerial access to spillway gates, intakes and control buildings documented as part of it.
How An Engagement Applies Here
The same four pillars, scoped to this environment.
Common questions
Has ClearPoint worked with organizations in this sector?
This page describes how our method applies to the environment, not a client list. ClearPoint does not publish client or engagement records.
What does an engagement here usually start with?
A DVRA scoped to the project. It establishes what is actually flying over the site, whether spillway gates, intakes and control buildings are visible or reachable from common launch points, and where the existing security plan has a gap.
Does this apply to a FERC Security Group 3 project the same way it does a Group 1?
No. The assessment scope follows the consequence tier. A lower-tier project may need a lighter review focused on a small number of structures, while a Group 1 project warrants a fuller assessment tied directly to its security plan.
Do you work with federal dams, not just FERC-licensed projects?
The method is the same. The framework it plugs into differs. U.S. Army Corps of Engineers and Bureau of Reclamation facilities follow their own agency security policy rather than the FERC Security Program, and the assessment is written to match whichever framework governs the site.
Can you stop a drone over our facility?
No. In the United States, mitigating a drone is limited to federal agencies with statutory authority and, since July 2026, to state and local law enforcement and correctional agencies certified under the SAFER SKIES Act. ClearPoint does not mitigate. ClearPoint detects, tracks, assesses, documents, trains and coordinates with the agencies that hold that authority.
Start with the decision you need to make.
Whether you’re evaluating drone risk or ready to assess a specific site, we’ll help you identify the next step.