# Write a drone-sighting procedure that separates routine flights from suspicious activity > CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police. - Canonical URL: https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:00:24+00:00 - Modified: 2026-10-18T22:22:06+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Playbook - DSE priority: Advisory - Topics: Business Continuity, Video Surveillance - Reading time: 2 minutes ## What you need to know CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police. ## Potentially affected Facilities with security officers, monitoring centers or video systems that may observe drones, especially sites with crowds, hazardous materials, sensitive operations or exposed security equipment. ## DSE recommendation DSE recommends adding a written drone-sighting procedure and log to post orders before the first suspicious flight is reported. ## Article CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police. ## Source facts CISA’s [Suspicious UAS Activity Guidance](https://www.cisa.gov/sites/default/files/2026-01/Suspicious_UAS_Activity_Guidance_508cV2.pdf), dated November 2025, says most drone activity is likely non-threatening and compliant with FAA regulations. It encourages procedures that help security personnel tell routine from suspicious activity, built on four actions: determine routine activity nearby, understand risks to critical assets, recognize indicators, and respond appropriately. Indicators CISA lists include flying along perimeter lines or between sensitive assets, hovering near windows or IT/OT locations, flights outside normal operating hours, suspicious payloads, disabled or masked lights, and no detectable Remote ID broadcast. Security and access control assets appear on its list of assets vulnerable to observation or cyberattack. CISA advises consulting legal counsel before using detection technology and before engaging operators, and points to its de-escalation series. Non-threatening activity can be logged as routine; activity suspected of planning criminal acts should be reported to local law enforcement, with information also shared with the FAA through the local Flight Standards District Office or a LEAP agent. ## Applicability Use this for any site where staff may see drones overhead. The guidance is voluntary and written for critical infrastructure, but its procedure fits campuses, venues and commercial facilities. It does not authorize anyone to interfere with an aircraft. ## DSE recommendation DSE recommends adding a written drone-sighting procedure and log to post orders before the first suspicious flight is reported. Record time, location, direction, behavior, payload and any Remote ID data, use existing cameras to document the aircraft and the area it watches, and identify which views could expose door controllers, guard posts or network rooms. Name who decides on a police report, and tell staff to observe and report rather than confront operators or attempt to disable a drone. ## Verification Run a tabletop with security, safety and IT using one routine and one suspicious scenario, and check that the log captures what police and the FAA would need. Review the log quarterly to update the list of expected flights in the area. ## Official reference [CISA — Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators (November 2025)](https://www.cisa.gov/sites/default/files/2026-01/Suspicious_UAS_Activity_Guidance_508cV2.pdf). Reviewed October 18, 2026. ## Primary reference - Name: CISA — Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators (November 2025) - Authority: Cybersecurity and Infrastructure Security Agency - URL: https://www.cisa.gov/sites/default/files/2026-01/Suspicious_UAS_Activity_Guidance_508cV2.pdf - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Write a drone-sighting procedure that separates routine flights from suspicious activity,” DSE Security, https://update.dsesecurity.com/updates/suspicious-drone-activity-procedure-cisa-uas-guidance/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.