The text of the Unmanned Aircraft Systems Security Procedure
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, and on any change to Office of Management and Budget (OMB) M-26-02, Federal Acquisition Regulation (FAR) 52.240-1, or the covered-entity lists.
Mandate. The Office of Management and Budget (OMB) issued memorandum M-26-02, Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States Producers, on November 21, 2025. By May 20, 2026, agencies had to treat every unmanned aircraft system (UAS) procurement as both an aircraft and an information technology system. For each one, the agency must:
- Complete a joint Federal Information Processing Standards (FIPS) 199 impact assessment before procurement.
- Document the minimum security capabilities the system will meet.
- Record any statutory exemption it relies on in the System Security and Privacy Plan (SSPP) and the contract file.
The funding prohibitions in the American Security Drone Act took effect on December 22, 2025. FAR 52.240-1 (FR 2024-26061) carries them out and bars UAS from covered foreign entities. This procedure applies National Institute of Standards and Technology (NIST) SP 800-53 controls RA-2 and SA-4 to UAS. It becomes mandatory on the day anyone proposes a UAS purchase, lease, grant-funded acquisition, or operation.
1. Purpose #
A UAS carries sensors, storage, radios, and software, and it often connects to a vendor cloud. It is an information system in its own right. The CISO and the people named below use this procedure so that the Organization evaluates and authorizes a UAS like any other system before it commits money. That way, the Organization never buys a prohibited product, and it operates a permitted one within an authorization boundary.
2. Screening and Categorizing a Proposed UAS #
Entry criteria: Anyone proposes a UAS purchase, lease, grant-funded acquisition, or operation.
Exit criteria: The producer passed the screening, and the categorization, the security capabilities, and any exemption are recorded.
| Step and actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| 1. Requesting office | Notify the CISO and the Contracting Officer of the proposed UAS acquisition or operation before raising a requisition. | The ticketing system | Request ticket and requisition note | SA-04 |
| 2. Supply chain risk management lead | Screen the producer and every component against the prohibition lists. Check the covered-foreign-entity list (FAR 52.240-1) and Section 889 (FAR 52.204-25). Check Federal Acquisition Supply Chain Security Act (FASCSA) orders (FAR 52.204-30) and information and communications technology and services (ICTS) determinations under 15 CFR Part 791. | The governance, risk, and compliance (GRC) system | Screening record | SR-03, SR-06, SA-04 |
| 3. System Owner and CISO | Complete a joint FIPS 199 impact assessment. Cover the aircraft, its ground control, its data links, and any vendor cloud. | The GRC system | Categorization worksheet (TMPL-RA-001) | RA-02 |
| 4. Senior Agency Official for Privacy (SAOP) | Decide whether the UAS may collect information about identifiable people, and whether it needs a privacy impact assessment. | The document management system | privacy impact assessment (PIA) decision | RA-08 |
| 5. System Owner and enterprise architecture lead | Document the minimum security capabilities the UAS will meet. These are encrypted command and data links, authenticated ground control, on-device storage encryption, data retention and deletion, firmware update control, geofencing, and logging to the security information and event management (SIEM) system. | The GRC system | Security capability statement in the SSPP | PL-02, SA-04 |
| 6. Contracting Officer and Office of the General Counsel | Decide whether the acquisition relies on a statutory exemption. If it does, record the exemption, its authority, and the approving official in the SSPP and the contract file. | The GRC system | SSPP section and contract file | SA-04 |
Evidence: the request ticket and requisition note, the screening record and categorization worksheet in the GRC system, the PIA decision, and the security capability statement and any exemption record in the SSPP.
3. Contracting for a UAS #
Entry criteria: The screening and categorization are complete.
Exit criteria: The award carries the security capabilities, the prohibitions, and the origin disclosure.
| Step and actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| 1. Contracting Officer | Write the security capabilities and the prohibitions into the contract. | Contract file | Solicitation and award | SA-04, SR-05 |
| 2. Contracting Officer | Require the vendor to disclose the country of origin of the airframe, flight controller, radios, and software. | Contract file | Disclosure clause | SR-04, SA-04 |
| 3. Contracting Officer’s Representative | Obtain the vendor’s origin disclosure. Keep it in the contract file with any exemption record. | Contract file | Origin disclosure and exemption record | SR-04, SA-04 |
Evidence: the solicitation and award, the vendor’s origin disclosure, and the contract file.
4. Authorizing, Registering, and Reviewing a UAS #
Entry criteria: The contract is awarded, and the UAS has not yet flown with Organization data.
Exit criteria: The UAS holds an authorization, it is in the hardware inventory, and its review is on the schedule.
| Step and actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| 1. Chief Information Officer (CIO) as Authorizing Official | Authorize the UAS to operate under the Risk Management Framework before its first flight with Organization data. Authorize it as its own system or within an existing boundary. | The GRC system | Authorization decision | CA-06 |
| 2. System Owner | Register the UAS in the hardware inventory. Where the vendor platform uses Super Intelligence (SI), also register it in the SI use-case inventory. | The asset inventory tool | Hardware inventory entry; SI inventory entry | CM-08, PM-05 |
| 3. CISO | Review the authorization and the screening at each contract renewal, and whenever a new prohibition names the producer. | The GRC system | Annual review record | CA-06, SR-06 |
Evidence: the authorization decision in the GRC system, the hardware and SI inventory entries, and the review records.
5. Data Handling #
The imagery and telemetry a UAS collects are Organization records, and they may contain personally identifiable information (PII). The System Owner brings in the Senior Agency Official for Privacy (SAOP) during the joint impact assessment. Where the UAS may collect information about identifiable people, the SAOP completes or updates a privacy impact assessment before the authorization decision. Data leaves the aircraft only for the Organization’s designated storage. The contract limits what the vendor cloud may keep.
6. Roles #
| Role | Responsibility |
|---|---|
| Requesting office | Sends the notice and states the operational need. |
| System Owner | Owns the categorization, the security capabilities, and the inventory entry. |
| CISO | Reviews each step. Keeps this procedure current with OMB M-26-02 and the FAR. |
| Supply chain risk management lead | Runs the prohibition screening. |
| Contracting Officer and Contracting Officer’s Representative | Write the contract terms. Obtain the origin disclosure. Keep the exemption records. |
| CIO | Makes the authorization decision. |
Evidence: the requisition note, the screening record in the GRC system, the categorization worksheet, the security capability statement and any exemption record in the SSPP, the contract terms, the authorization decision, and the inventory entries.
7. References #
These are the sources this document cites, with a link to each official text.
- 15 CFR Part 791: Securing the Information and Communications Technology and Services Supply Chain, July 18, 2024.
- FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Section 889; with FAR 52.204-24 and 52.204-26 representations), August 13, 2020.
- FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
- Federal Acquisition Regulation (FAR), current text.
- FIPS 199: Standards for Security Categorization, February 2004.
- OMB M-26-02: Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States Producers, November 21, 2025.
- Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act) — Federal Acquisition Security Council (Pub. L. 115-390, Title II; 41 U.S.C. §§ 1321–1328; 41 U.S.C. § 4713), December 21, 2018.