View PDF Document

The Federal Aviation Administration’s (FAA) oversight of Unmanned Aircraft Systems (UAS) depends in part on maintaining accurate and complete information on all users (both general public and commercial) who operate small UAS. FAA compiles this information in its UAS registration system, also known as FAA DroneZone. FAA DroneZone is used to report small UAS accidents as well. Because of the volume of sensitive data provided by the general public as well as the importance of UAS user data to FAA’s oversight, we are initiating an audit to determine whether FAA’s UAS registration system has the proper information security controls and recovery procedures in place. Our objectives are to (1) assess the effectiveness of FAA’s UAS registration system security controls, including controls to protect personally identifiable information, and (2) determine whether FAA’s contingency planning limits the effects caused by the loss of DroneZone during disruptions of service.