U.S. Army Chief Information Officer Leonel Garciga has issued interim cybersecurity guidance governing the operation and network connectivity of small unmanned aircraft systems, or sUAS, across the service.
The Potomac Officers Club’s 2026 Army Summit on June 18 will highlight how the Army’s transformation efforts are reshaping modernization and contracting priorities, providing industry leaders with insight into the service’s path toward its 2030 goals. Save your seat now!
What Is the Purpose of the Cybersecurity Guidance?
According to the memo issued Feb. 5, the policy establishes interim requirements for operating small UAS, defined as Group 1 and Group 2 systems weighing 55 pounds or less. The guidance is intended to establish new protocols for rapid procurement and fielding of drones while protecting the Department of War Information Network, or DoWIN, from cybersecurity threats.
What Are the Key Cybersecurity Rules?
Under the guidance, O-6 level commanders authorized to procure, test or train with sUAS must follow Army cybersecurity requirements governing network connectivity. Small UAS may not connect to DoWIN without both an authorization to operate and authority to connect. Systems operating in closed-loop or standalone configurations that do not interface with Army networks are exempt from formal authorization, provided other requirements are met.
Platforms on the Defense Innovation Unit and Defense Contract Management Agency Blue UAS Select list receive type-based authorization but still require approval to connect, while all other systems must complete the assess-and-authorize process through the Enterprise Mission Assurance Support Service, or eMASS.
What Systems & Organizations Are Covered by the Guidance?
The Army CIO, acting on behalf of the secretary of the Army, is responsible for setting policy, allocating resources and providing oversight for the Army Cybersecurity Program in accordance with Army Regulation, or AR, 25-2, titled Information Management: Army Cybersecurity, including issuing policy memoranda as needed to clarify or expand existing guidance. The policy applies across all headquarters, Department of the Army elements, Army commands, Army service component commands, direct reporting units and reserve components, regardless of duty status, but excludes small UAS used for intelligence gathering.
