CISA Critical Infrastructure Sector

Counter-UAS for government facilities

Federal, state and local sites carry a mix of public access, restricted areas and sensitive operations under one roofline. Courts, correctional facilities, administrative campuses and civic buildings each present a different profile to an aircraft overhead, and the security posture is rarely designed with the air domain in mind.

Where The Exposure Is

Four things that make this sector different.

MIXED-ACCESS SITES

A single campus can hold a public lobby, a restricted courtroom and a secure records facility within the same perimeter. Physical security is layered on the ground, but the air above treats all of it the same.

CORRECTIONAL FACILITY RISK

Unauthorized drone activity over a correctional facility carries a distinct threat profile, from contraband delivery to surveillance of perimeter and staff movement. Few have staff assigned to watch the airspace.

PUBLIC PROCEEDINGS

Courts and civic buildings host scheduled public events and proceedings that draw predictable crowds. Predictable gatherings are also predictable targets for reconnaissance from above.

JURISDICTIONAL LAYERING

Federal, state and local facilities can sit blocks apart with different security authorities and different reporting chains. A response plan has to account for who is actually notified, not just who owns the building.

Regulatory Context

LAYERED SECURITY REQUIREMENTS

Federal facilities are governed by “The Risk Management Process: An Interagency Security Committee Standard” (2024 Edition). Each facility is assigned a Facility Security Level from I to V, with risk assessments recurring every 5 years for FSL I and II facilities and every 3 years for FSL III to V facilities. The FAA separately restricts drone operations over certain sensitive federal facilities under 14 CFR 99.7 Special Security Instructions.

Correctional facilities carry their own layer of exposure. 18 U.S.C. 1791 prohibits providing contraband to federal inmates, and many states restrict drone flight near prisons directly, for example Texas Penal Code 38.115 and South Carolina Code 55-1-220. Under the SAFER SKIES Act, certified state and local correctional agencies may now act against drone threats at these sites. A DVRA is designed to document the air-threat input to the recurring Facility Security Level review, without claiming the ISC standard itself mentions drones.

How An Engagement Applies Here

The same four pillars, scoped to this environment.

01 OPERATIONSView pillarManaged detection and monitoring across campus and perimeter areas, plus intelligence briefings tied to scheduled proceedings and events.

02 ASSESSMENTSView pillarA DVRA to establish real exposure across mixed-access facilities, threat profile and gap register. The baseline everything else is decided from.

03 RESPONSEView pillarMitigation strategy and TTP development, tabletop exercises across jurisdictional lines, and forensics after an incident.

04 TRAININGView pillarCertification paths so the capability stays with facility and security personnel rather than leaving with a contractor.

Common questions

Has ClearPoint worked with organizations in this sector?

This page describes how our method applies to the environment, not a client list. ClearPoint does not publish client or engagement records.

What does an engagement here usually start with?

A DVRA. It establishes the baseline: what is actually flying over the facility, what it can reach, and where detection or procedure breaks down. Every subsequent decision depends on it.

How do you handle facilities with multiple jurisdictions or agencies involved?

The tabletop exercise and mitigation planning stages are built around the actual notification and command chain for the facility, including which agency is contacted for which type of incident. That chain is documented as part of the deliverable rather than assumed.

Does a DVRA apply to correctional facilities specifically?

Yes. The threat profile for a correctional facility differs from an administrative building, and the assessment is scoped to reflect that, covering perimeter, yard and airspace approach rather than a generic office campus template.

Can you stop a drone over our facility?

No. In the United States, mitigating a drone is limited to federal agencies with statutory authority and, since July 2026, to state and local law enforcement and correctional agencies certified under the SAFER SKIES Act. ClearPoint does not mitigate. ClearPoint detects, tracks, assesses, documents, trains and coordinates with the agencies that hold that authority.

CAPABILITYDVRAThe five-stage assessment method and what each stage leaves behind. PILLAR 02AssessmentsRed teaming, tabletop exercises, threat and technology briefings. SECTORSAll 16 CISA sectorsWhere else this applies, and what exposure looks like there.