| Governance |
Authority and legal oversight |
Documented approval for drone detection and response activities |
No written ownership, escalation path, or authority matrix |
5 |
Counter-drone actions may create safety, privacy, communications, or aviation-law risks if responsibilities are unclear. |
Define accountable roles, approved responses, evidence handling, and coordination with relevant authorities. |
Critical |
| Identify |
Mission and asset criticality |
Number of essential operations or assets that could be disrupted by an unauthorized drone |
Continuous operations depend on exposed equipment, personnel, or restricted areas |
5 |
A drone may support surveillance, create a safety hazard, or interrupt essential services without physically entering a building. |
Map critical assets, protection zones, operating hours, and consequences of interruption. |
Critical |
| Identify |
Airspace and approach exposure |
Visibility of the site from likely launch areas and the number of unobstructed approach paths |
Open ground, rooftops, roads, or public areas provide clear lines of sight to the site |
4 |
Open approaches can reduce warning time and make visual observation alone unreliable. |
Conduct a site survey covering perimeter, roofline, nearby public areas, and likely flight corridors. |
High |
| Protect |
Physical defense-in-depth |
Availability of barriers, access control, roof protection, lighting, and protected stand-off distance |
Perimeter controls protect ground access but do not address overhead or rooftop approaches |
4 |
Traditional physical controls may not prevent a drone from observing or reaching an exposed outdoor asset. |
Add aerial-threat controls to existing physical security rather than replacing fences, guards, or access controls. |
High |
| Protect |
Personnel and public safety |
Presence of people in outdoor work zones or public areas near critical assets |
Personnel regularly work outdoors beneath or near potential drone routes |
4 |
Unidentified aircraft can introduce collision, dropped-object, distraction, and evacuation concerns. |
Establish safe shelter locations, alert procedures, restricted zones, and non-interference response rules. |
High |
| Detect |
Airspace awareness |
Ability to detect, classify, track, and record low-altitude aerial activity |
Security staff rely primarily on calls, patrols, or unaided visual observation |
5 |
Visual observation is affected by darkness, weather, distance, occlusion, workload, and limited reaction time. |
Evaluate a lawful detection capability that can provide time, location, track history, and operator alerts. |
Critical |
| Detect |
False-alarm resilience |
Documented process for distinguishing drones from birds, aircraft, weather effects, and other signals |
No standard verification process or alert confidence threshold |
3 |
Unverified alerts can cause unnecessary disruption and reduce trust in the security system. |
Use multiple confirmation methods, maintain an event log, and test detection performance in representative conditions. |
Moderate |
| Respond |
Incident response readiness |
Time required to verify an alert, notify decision-makers, and protect people or operations |
Response depends on ad hoc communications and lacks a drone-specific playbook |
4 |
Rapid, coordinated decisions reduce exposure while avoiding unsafe or unauthorized actions. |
Create playbooks for observation, verification, notification, sheltering, operations continuity, and evidence preservation. |
High |
| Respond |
Communications and coordination |
Availability of redundant communication channels and external coordination procedures |
Single-channel communication is used for security, operations, and emergency notification |
4 |
One failed or overloaded channel can delay protective actions and incident reporting. |
Provide primary and backup communications, contact lists, notification templates, and scheduled exercises. |
High |
| Recover |
Operational continuity |
Ability to maintain essential functions during investigation or temporary airspace restrictions |
Operations have limited manual fallback capacity and no defined drone-incident continuity plan |
4 |
Even a short disruption can affect safety, production, access, or service delivery. |
Define alternate work areas, manual procedures, shutdown criteria, restart checks, and recovery priorities. |
High |
| Recover |
Evidence and lessons learned |
Retention of alert data, video, timelines, decisions, and corrective actions |
Incident records are inconsistent and cannot reliably support trend analysis |
3 |
Reliable records support investigation, recurring-threat analysis, training, and control improvement. |
Standardize timestamps, access controls, retention periods, after-action reviews, and corrective-action tracking. |
Moderate |
| Continuous Improvement |
Testing and maintenance |
Frequency of exercises, software updates, sensor checks, and coverage validation |
Testing occurs only after an incident or during irregular maintenance windows |
3 |
Detection coverage and response quality can degrade because of environmental changes, equipment faults, or staffing changes. |
Schedule routine inspections, controlled exercises, coverage reviews, staff training, and documented corrective actions. |
Moderate |