{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/suspicious-drone-activity-procedure-cisa-uas-guidance/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/",
        "slug": "suspicious-drone-activity-procedure-cisa-uas-guidance",
        "url": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/suspicious-drone-activity-procedure-cisa-uas-guidance/"
        },
        "title": "Write a drone-sighting procedure that separates routine flights from suspicious activity",
        "summary": "CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police.",
        "format": {
            "slug": "playbook",
            "name": "Playbook"
        },
        "priority": {
            "slug": "advisory",
            "name": "Advisory"
        },
        "featured": false,
        "image": {
            "theme": "physical-security",
            "label": "Physical security",
            "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "video-surveillance",
                "name": "Video Surveillance",
                "url": "https://update.dsesecurity.com/topic/video-surveillance/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-18T21:00:24+00:00",
        "modified_at": "2026-10-18T22:22:06+00:00",
        "reviewed_on": "2026-10-18",
        "reading_minutes": 2,
        "word_count": 381,
        "potentially_affected": "Facilities with security officers, monitoring centers or video systems that may observe drones, especially sites with crowds, hazardous materials, sensitive operations or exposed security equipment.",
        "dse_recommendation": "DSE recommends adding a written drone-sighting procedure and log to post orders before the first suspicious flight is reported.",
        "primary_source": {
            "name": "CISA — Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators (November 2025)",
            "url": "https://www.cisa.gov/sites/default/files/2026-01/Suspicious_UAS_Activity_Guidance_508cV2.pdf",
            "published_on": null,
            "authority": "Cybersecurity and Infrastructure Security Agency"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police.</p>\n<h2>Source facts</h2>\n<p>CISA’s <a href=\"https://www.cisa.gov/sites/default/files/2026-01/Suspicious_UAS_Activity_Guidance_508cV2.pdf\">Suspicious UAS Activity Guidance</a>, dated November 2025, says most drone activity is likely non-threatening and compliant with FAA regulations. It encourages procedures that help security personnel tell routine from suspicious activity, built on four actions: determine routine activity nearby, understand risks to critical assets, recognize indicators, and respond appropriately.</p>\n<p>Indicators CISA lists include flying along perimeter lines or between sensitive assets, hovering near windows or IT/OT locations, flights outside normal operating hours, suspicious payloads, disabled or masked lights, and no detectable Remote ID broadcast. Security and access control assets appear on its list of assets vulnerable to observation or cyberattack.</p>\n<p>CISA advises consulting legal counsel before using detection technology and before engaging operators, and points to its de-escalation series. Non-threatening activity can be logged as routine; activity suspected of planning criminal acts should be reported to local law enforcement, with information also shared with the FAA through the local Flight Standards District Office or a LEAP agent.</p>\n<h2>Applicability</h2>\n<p>Use this for any site where staff may see drones overhead. The guidance is voluntary and written for critical infrastructure, but its procedure fits campuses, venues and commercial facilities. It does not authorize anyone to interfere with an aircraft.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends adding a written drone-sighting procedure and log to post orders before the first suspicious flight is reported. Record time, location, direction, behavior, payload and any Remote ID data, use existing cameras to document the aircraft and the area it watches, and identify which views could expose door controllers, guard posts or network rooms. Name who decides on a police report, and tell staff to observe and report rather than confront operators or attempt to disable a drone.</p>\n<h2>Verification</h2>\n<p>Run a tabletop with security, safety and IT using one routine and one suspicious scenario, and check that the log captures what police and the FAA would need. Review the log quarterly to update the list of expected flights in the area.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://www.cisa.gov/sites/default/files/2026-01/Suspicious_UAS_Activity_Guidance_508cV2.pdf\">CISA — Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators (November 2025)</a>. Reviewed October 18, 2026.</p>",
        "content_text": "CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police.\nSource facts\nCISA’s Suspicious UAS Activity Guidance, dated November 2025, says most drone activity is likely non-threatening and compliant with FAA regulations. It encourages procedures that help security personnel tell routine from suspicious activity, built on four actions: determine routine activity nearby, understand risks to critical assets, recognize indicators, and respond appropriately.\nIndicators CISA lists include flying along perimeter lines or between sensitive assets, hovering near windows or IT/OT locations, flights outside normal operating hours, suspicious payloads, disabled or masked lights, and no detectable Remote ID broadcast. Security and access control assets appear on its list of assets vulnerable to observation or cyberattack.\nCISA advises consulting legal counsel before using detection technology and before engaging operators, and points to its de-escalation series. Non-threatening activity can be logged as routine; activity suspected of planning criminal acts should be reported to local law enforcement, with information also shared with the FAA through the local Flight Standards District Office or a LEAP agent.\nApplicability\nUse this for any site where staff may see drones overhead. The guidance is voluntary and written for critical infrastructure, but its procedure fits campuses, venues and commercial facilities. It does not authorize anyone to interfere with an aircraft.\nDSE recommendation\nDSE recommends adding a written drone-sighting procedure and log to post orders before the first suspicious flight is reported. Record time, location, direction, behavior, payload and any Remote ID data, use existing cameras to document the aircraft and the area it watches, and identify which views could expose door controllers, guard posts or network rooms. Name who decides on a police report, and tell staff to observe and report rather than confront operators or attempt to disable a drone.\nVerification\nRun a tabletop with security, safety and IT using one routine and one suspicious scenario, and check that the log captures what police and the FAA would need. Review the log quarterly to update the list of expected flights in the area.\nOfficial reference\nCISA — Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators (November 2025). Reviewed October 18, 2026.",
        "content_markdown": "CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police.\n\n## Source facts\n\nCISA’s [Suspicious UAS Activity Guidance](https://www.cisa.gov/sites/default/files/2026-01/Suspicious_UAS_Activity_Guidance_508cV2.pdf), dated November 2025, says most drone activity is likely non-threatening and compliant with FAA regulations. It encourages procedures that help security personnel tell routine from suspicious activity, built on four actions: determine routine activity nearby, understand risks to critical assets, recognize indicators, and respond appropriately.\n\nIndicators CISA lists include flying along perimeter lines or between sensitive assets, hovering near windows or IT/OT locations, flights outside normal operating hours, suspicious payloads, disabled or masked lights, and no detectable Remote ID broadcast. Security and access control assets appear on its list of assets vulnerable to observation or cyberattack.\n\nCISA advises consulting legal counsel before using detection technology and before engaging operators, and points to its de-escalation series. Non-threatening activity can be logged as routine; activity suspected of planning criminal acts should be reported to local law enforcement, with information also shared with the FAA through the local Flight Standards District Office or a LEAP agent.\n\n## Applicability\n\nUse this for any site where staff may see drones overhead. The guidance is voluntary and written for critical infrastructure, but its procedure fits campuses, venues and commercial facilities. It does not authorize anyone to interfere with an aircraft.\n\n## DSE recommendation\n\nDSE recommends adding a written drone-sighting procedure and log to post orders before the first suspicious flight is reported. Record time, location, direction, behavior, payload and any Remote ID data, use existing cameras to document the aircraft and the area it watches, and identify which views could expose door controllers, guard posts or network rooms. Name who decides on a police report, and tell staff to observe and report rather than confront operators or attempt to disable a drone.\n\n## Verification\n\nRun a tabletop with security, safety and IT using one routine and one suspicious scenario, and check that the log captures what police and the FAA would need. Review the log quarterly to update the list of expected flights in the area.\n\n## Official reference\n\n[CISA — Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators (November 2025)](https://www.cisa.gov/sites/default/files/2026-01/Suspicious_UAS_Activity_Guidance_508cV2.pdf). Reviewed October 18, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/",
                "url": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-18"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Write a drone-sighting procedure that separates routine flights from suspicious activity",
                        "item": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/#article",
                "identifier": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/",
                "url": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/",
                "headline": "Write a drone-sighting procedure that separates routine flights from suspicious activity",
                "description": "CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine…",
                "abstract": "CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police.",
                "articleBody": "CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police.\nSource facts\nCISA’s Suspicious UAS Activity Guidance, dated November 2025, says most drone activity is likely non-threatening and compliant with FAA regulations. It encourages procedures that help security personnel tell routine from suspicious activity, built on four actions: determine routine activity nearby, understand risks to critical assets, recognize indicators, and respond appropriately.\nIndicators CISA lists include flying along perimeter lines or between sensitive assets, hovering near windows or IT/OT locations, flights outside normal operating hours, suspicious payloads, disabled or masked lights, and no detectable Remote ID broadcast. Security and access control assets appear on its list of assets vulnerable to observation or cyberattack.\nCISA advises consulting legal counsel before using detection technology and before engaging operators, and points to its de-escalation series. Non-threatening activity can be logged as routine; activity suspected of planning criminal acts should be reported to local law enforcement, with information also shared with the FAA through the local Flight Standards District Office or a LEAP agent.\nApplicability\nUse this for any site where staff may see drones overhead. The guidance is voluntary and written for critical infrastructure, but its procedure fits campuses, venues and commercial facilities. It does not authorize anyone to interfere with an aircraft.\nDSE recommendation\nDSE recommends adding a written drone-sighting procedure and log to post orders before the first suspicious flight is reported. Record time, location, direction, behavior, payload and any Remote ID data, use existing cameras to document the aircraft and the area it watches, and identify which views could expose door controllers, guard posts or network rooms. Name who decides on a police report, and tell staff to observe and report rather than confront operators or attempt to disable a drone.\nVerification\nRun a tabletop with security, safety and IT using one routine and one suspicious scenario, and check that the log captures what police and the FAA would need. Review the log quarterly to update the list of expected flights in the area.\nOfficial reference\nCISA — Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators (November 2025). Reviewed October 18, 2026.",
                "datePublished": "2026-10-18T21:00:24+00:00",
                "dateModified": "2026-10-18T22:22:06+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Write a drone-sighting procedure that separates routine flights from suspicious activity"
                },
                "articleSection": [
                    "Business Continuity",
                    "Video Surveillance"
                ],
                "keywords": [
                    "Business Continuity",
                    "Video Surveillance",
                    "Playbook",
                    "Advisory priority"
                ],
                "genre": "Playbook",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Video Surveillance",
                        "url": "https://update.dsesecurity.com/topic/video-surveillance/"
                    }
                ],
                "wordCount": 381,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "CISA — Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators (November 2025)",
                    "url": "https://www.cisa.gov/sites/default/files/2026-01/Suspicious_UAS_Activity_Guidance_508cV2.pdf"
                }
            }
        ]
    }
}