CISA Critical Infrastructure Sector
Water and wastewater systems
Few sectors present as much surface area per staff member. Treatment works, pump stations, reservoirs, intakes and chemical storage are spread across a service territory, frequently unstaffed, frequently adjacent to public land. They can be documented from the air without anyone being challenged.
Where The Exposure Is
Four things that make this sector different.
DISPERSED FOOTPRINT
A single utility may operate dozens of sites across a service area. Physical security is sized for the staffed ones. The air domain does not distinguish between them.
UNSTAFFED FACILITIES
Remote pump stations and reservoir sites can go days without a person present. An overflight there produces no report, because there is nobody to make one.
VISIBLE PROCESS
Treatment trains, chemical storage and containment are legible from above in a way they are not from the fence line. Reconnaissance does not require entry.
PUBLIC ADJACENCY
Reservoirs and watersheds are often recreational land. Lawful, ordinary drone activity and the activity worth worrying about launch from the same places and look identical on the way up.
Regulatory Context
Section 2013 of America’s Water Infrastructure Act of 2018 amended Safe Drinking Water Act section 1433 (42 U.S.C. 300i-2). Community water systems serving more than 3,300 people must complete a risk and resilience assessment covering malevolent acts and natural hazards, including physical barriers, source water, treatment, storage and distribution, monitoring practices, chemical storage and handling, and operations and maintenance. Each system must also prepare an emergency response plan within six months of the assessment, certify both to EPA, and review them at least every five years. The current certification round runs by system size: systems serving 100,000 or more certified the assessment by March 31, 2025, systems serving 50,000 to 99,999 by December 31, 2025, and systems serving 3,301 to 49,999 by June 30, 2026. Wastewater systems carry no equivalent federal mandate, and EPA guidance for them is voluntary. The statute does not mention drones.
A DVRA is scoped as a documented input to the malevolent acts, physical barriers and monitoring practices elements of the next review, rather than a separate exercise run alongside it.
How An Engagement Applies Here
The same four pillars, scoped to this environment.
Common questions
Has ClearPoint worked with organizations in this sector?
This page describes how our method applies to the environment, not a client list. ClearPoint does not publish client or engagement records.
What does an engagement here usually start with?
A DVRA. It establishes the baseline: what is actually flying over the sites, what it can reach, and where detection or procedure breaks down. Every subsequent decision depends on it.
Do we need detection equipment across every site?
Almost certainly not, and an assessment run before procurement can reduce the equipment bill rather than increase it. Coverage should follow exposure, and exposure is rarely uniform across a portfolio of sites.
Can you stop a drone over our facility?
No. In the United States, mitigating a drone is limited to federal agencies with statutory authority and, since July 2026, to state and local law enforcement and correctional agencies certified under the SAFER SKIES Act. ClearPoint does not mitigate. ClearPoint detects, tracks, assesses, documents, trains and coordinates with the agencies that hold that authority.
Start with the decision you need to make.
Whether you’re evaluating drone risk or ready to assess a specific site, we’ll help you identify the next step.