CISA Critical Infrastructure Sector
Nuclear plant drone security
Reactor sites and material transport operate under some of the most demanding security oversight of any sector, and a specific reporting duty for unmanned aircraft is already on the books. Plant security has no authority to act against a drone. It has an obligation to report it, on a clock.
Where The Exposure Is
Four things that make this sector different.
A REPORTING CLOCK ALREADY EXISTS
Suspicious drone overflight must be reported within 4 hours under an existing NRC rule. Meeting that clock depends on detecting the activity in the first place, not on the reporting rule itself.
DESIGN BASIS THREAT GAP
The NRC’s design basis threat, the standard reactor security is built against, does not include aircraft. Drone activity sits outside the threat the site was engineered to defend, by definition.
NO SITE MITIGATION AUTHORITY
Plant security personnel cannot act against a drone themselves. Overflight restriction depends entirely on FAA airspace rules, and detection and documentation are what a site controls directly.
MATERIAL IN TRANSPORT
Nuclear material moves between sites under its own security requirements. A transport route is a moving target with none of a reactor site’s fixed perimeter protections.
Regulatory Context
NRC regulations at 10 CFR 73.55 require power reactor licensees to protect against the design basis threat defined in 10 CFR 73.1, which does not include aircraft. Separately, 10 CFR 73.1215 requires licensees to report suspicious unmanned aircraft activity within 4 hours, a requirement in force since January 8, 2024. DOE and NNSA nuclear facilities are protected under a distinct authority, 10 U.S.C. 6227.
A DVRA supports the 73.1215 reporting procedure and documents drone-related vulnerabilities that sit outside the design basis threat, without claiming the NRC requires drone defense as such.
How An Engagement Applies Here
The same four pillars, scoped to this environment.
Common questions
Has ClearPoint worked with organizations in this sector?
This page describes how our method applies to the environment, not a client list. ClearPoint does not publish client or engagement records.
What does an engagement here usually start with?
A DVRA. It establishes what the site’s current detection posture actually catches against the 4-hour reporting clock, and where the gaps sit relative to the design basis threat.
Does the 10 CFR 73.1215 reporting duty mean the site must have detection technology?
The rule requires reporting suspicious unmanned aircraft activity within 4 hours. It does not specify how a site detects that activity in the first place, which is why detection capability and documented procedure matter in practice even though the rule is silent on the method.
Can plant security act against a drone directly?
No. Plant security personnel have no drone mitigation authority. Overflight restriction relies on FAA airspace rules, and any mitigation authority rests with federal agencies and certified state and local law enforcement, not with site personnel.
Can you stop a drone over our facility?
No. In the United States, mitigating a drone is limited to federal agencies with statutory authority and, since July 2026, to state and local law enforcement and correctional agencies certified under the SAFER SKIES Act. ClearPoint does not mitigate. ClearPoint detects, tracks, assesses, documents, trains and coordinates with the agencies that hold that authority.
Start with the decision you need to make.
Whether you’re evaluating drone risk or ready to assess a specific site, we’ll help you identify the next step.