AIA NAS9948

The scope of this standard is the protection of the Unmanned Aircraft System (UAS) data with respect to data security and privacy throughout the lifecycle of the UAS. This standard is focused on the data security and privacy of operators and operator data. This includes how the data are used, recorded, and protected from origin to destruction internal to the platform and external to the platform (i.e. the cloud). Protections are provided for use by UAS developers, users, and third-party applications. This standard is not intended to replace any other cybersecurity guidance but to augment protections for UAS. This standard also does not cover safety of UAS flight. The standard is intended for manufacturers to inform users on how their data is disseminated. Users of UAS can make informed decisions on how to manage their data. Appendix A describes eight use cases that were identified to describe potential UAS cyber attacks.

Purpose

This document provides guidance for the protection of data with respect to data security and privacy for the owners of a UAS throughout the lifecycle of the UAS. This document is designed to reduce the risk of exploitation and dissemination of private information while operating a UAS less than 55 pounds. This document is not intended to duplicate the Risk Management Framework (RMF) and does not address the UAS manufacturer development infrastructure.

The objective of this document is not only to promote cybersecurity protections for data security and privacy for government, military systems, private individuals, and corporations but to also give the reader clear guidance on overall data security and privacy while operating a UAS and disseminating the data.

This standard is directed at manufacturers, original equipment manufacturers (OEM), and software developers to guide them to protect the data intended to be collected and used by Public Operators. In protecting the data, the standard can support Public Operators (non-DoD) with their mission of protecting critical infrastructure such as public utilities, public transportation, and other types of critical infrastructure. The users of the UAS within this standard include but are not limited to first responders, homeland security, and military.