CISA Critical Infrastructure Sector
Defense industrial base
Cleared contractor facilities carry security obligations that most sectors never touch: classified holdings, export-controlled hardware and processes, and program details that a client or a regulator expects to stay on the ground.
Where The Exposure Is
Four things that make this sector different.
EXPORT-CONTROLLED VISUAL ACCESS
Under ITAR and the EAR, letting a foreign person see controlled technical data can itself count as a release. Overhead observation of a test yard or assembly line raises that question directly.
CLEARED FACILITY EXPECTATIONS
NISPOM requires cleared contractors to protect classified information and to run an annual self-inspection, which is the natural place to account for collection from the air. A drone is an outside collection method that most self-inspections were not written to cover.
PROGRAM VISIBILITY
Prototype hardware, test articles and outdoor range activity are frequently visible only from above. Ground-level fencing and badge control do nothing to close that angle.
LIMITED SELF-HELP
A contractor cannot act against a drone over its own plant on its own initiative, even where DoD has authorized contractors with security duties at designated mission facilities under the FY2026 NDAA. The gap between noticing a threat and being allowed to act on it has to be planned for in advance.
Regulatory Context
Cleared contractors operate under NISPOM (32 CFR Part 117), which requires protection of classified information, an annual self-inspection and an annual senior management certification submitted to DCSA. CMMC (32 CFR Part 170) has been in Phase 1, self-assessments, since November 10, 2025. Phase 2 third-party assessments were suspended in July 2026 with no new date announced. DFARS 252.204-7012 still requires NIST SP 800-171 controls and 72-hour cyber incident reporting.
Under the FY2026 NDAA, 10 U.S.C. 130i lets DoD authorize contractors with security duties at designated DoD-mission facilities, but that authority does not extend to a contractor acting on its own to mitigate a drone over its own plant. A DVRA is written to inform the NISPOM self-inspection’s treatment of outside collection risk, including aerial imagery or RF collection over cleared areas. CMMC and DFARS 7012 are cybersecurity rules and have only a thin connection to drone activity.
How An Engagement Applies Here
The same four pillars, scoped to this environment.
Common questions
Has ClearPoint worked with organizations in this sector?
This page describes how our method applies to the environment, not a client list. ClearPoint does not publish client or engagement records.
What does an engagement here usually start with?
A DVRA. It establishes what is actually flying over the facility, where controlled hardware or processes are visible from common approach angles, and where the security plan has a gap against that exposure.
Does ClearPoint handle cleared or classified programs?
The assessment method does not require access to classified program details. It looks at what is observable from outside the facility and at how that observation intersects with export control and NISPOM obligations, which can be scoped without ClearPoint needing a clearance itself.
Can a contractor act against a drone over its own facility?
No, in nearly all cases. Even where DoD has authorized contractors with security duties at designated mission facilities under 10 U.S.C. 130i, a contractor cannot mitigate a drone on its own initiative outside that authorization. Planning has to account for that gap rather than assume it away.
Can you stop a drone over our facility?
No. In the United States, mitigating a drone is limited to federal agencies with statutory authority and, since July 2026, to state and local law enforcement and correctional agencies certified under the SAFER SKIES Act. ClearPoint does not mitigate. ClearPoint detects, tracks, assesses, documents, trains and coordinates with the agencies that hold that authority.
Start with the decision you need to make.
Whether you’re evaluating drone risk or ready to assess a specific site, we’ll help you identify the next step.