Write a drone-sighting procedure that separates routine flights from suspicious activity

CISA’s November 2025 guidance says most drone flights near facilities are harmless and lawful, so security staff need a procedure that learns routine activity, watches for specific indicators, documents what it sees and escalates suspected crime to police.

Source facts

CISA’s Suspicious UAS Activity Guidance, dated November 2025, says most drone activity is likely non-threatening and compliant with FAA regulations. It encourages procedures that help security personnel tell routine from suspicious activity, built on four actions: determine routine activity nearby, understand risks to critical assets, recognize indicators, and respond appropriately.

Indicators CISA lists include flying along perimeter lines or between sensitive assets, hovering near windows or IT/OT locations, flights outside normal operating hours, suspicious payloads, disabled or masked lights, and no detectable Remote ID broadcast. Security and access control assets appear on its list of assets vulnerable to observation or cyberattack.

CISA advises consulting legal counsel before using detection technology and before engaging operators, and points to its de-escalation series. Non-threatening activity can be logged as routine; activity suspected of planning criminal acts should be reported to local law enforcement, with information also shared with the FAA through the local Flight Standards District Office or a LEAP agent.

Applicability

Use this for any site where staff may see drones overhead. The guidance is voluntary and written for critical infrastructure, but its procedure fits campuses, venues and commercial facilities. It does not authorize anyone to interfere with an aircraft.

DSE recommendation

DSE recommends adding a written drone-sighting procedure and log to post orders before the first suspicious flight is reported. Record time, location, direction, behavior, payload and any Remote ID data, use existing cameras to document the aircraft and the area it watches, and identify which views could expose door controllers, guard posts or network rooms. Name who decides on a police report, and tell staff to observe and report rather than confront operators or attempt to disable a drone.

Verification

Run a tabletop with security, safety and IT using one routine and one suspicious scenario, and check that the log captures what police and the FAA would need. Review the log quarterly to update the list of expected flights in the area.

Official reference

CISA — Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators (November 2025). Reviewed October 18, 2026.