Drone inspection fleets: do SBOMs and firmware lists help?

Yes, they help. An inspection drone is flight hardware plus firmware, a controller app and often a cloud account for flight data. A fleet inventory with firmware versions, plus supplier SBOMs where you can get them, lets you answer "are we affected?" when a flaw is published.

We checked primary sources for drone-specific standards. CISA's page for its January 2024 guidance describes it, but its detailed text sits in a PDF we could not read for this post. We therefore keep the claims below to general practice and flag where to read further.

What is in a drone, from a security view?

Four layers matter. The airframe electronics and flight controller run firmware. The remote controller or tablet app talks to the drone. The vendor's cloud service may store imagery, flight logs and account details. Your own systems then receive the inspection data, such as reports for a bridge or a roof.

Each layer has software and components someone else wrote. A flaw in any layer can matter, though the consequences differ: lost data, a hijacked account, or, in the worst case, loss of control of the aircraft.

What does CISA say?

CISA's resource page for "Cybersecurity Guidance: Chinese-Manufactured UAS", issued with the FBI, says it raises awareness of the threats posed by Chinese-manufactured unmanned aircraft systems and offers cybersecurity recommendations to reduce risks to networks and sensitive information. The page also points to resources for preparedness, response and resilience. For the specific recommendations, read the linked PDF.

That guidance concerns one category of aircraft, and your own procurement rules and legal advisers decide what applies to you. The general point stands for any fleet: know what you operate and where its data goes.

What can bills of materials tell you?

NTIA's minimum elements set the baseline for software lists: supplier, component name, version, identifiers, dependency relationships, author and timestamp. CISA's Hardware Bill of Materials Framework from September 2023 adds a vocabulary for hardware parts, including semiconductor components and the firmware version shipped with a part.

Together they can describe a drone's flight controller board, its radio module, the firmware on each and the libraries inside the controller app. The HBOM framework is clear about its limit: it does not examine the provenance of the firmware itself.

How should an inspection company run its fleet?

Keep a register. One row per airframe, controller, battery pack with firmware, and tablet. Record firmware and app versions and the date of the last update.

Control updates. Do not update in the field before a job. Test on a spare unit, then roll out between jobs, and keep the previous version available if the vendor allows rollback.

Know where data goes. Find out whether imagery is stored on the aircraft, on a tablet, or in a vendor cloud, and in which country. Match that to client contracts, since inspections of infrastructure can be sensitive.

Secure accounts. Use unique logins, multi-factor authentication and revocation when staff leave.

Retire carefully. Wipe flight logs and stored media from retired units.

What to do

1. Create a fleet register with firmware and app versions.
2. Ask each vendor for an SBOM or component list and its advisory process.
3. Map where flight data is stored and who can access it.
4. Enable multi-factor authentication on every vendor account.
5. Stage updates on a spare unit before field use.
6. Read CISA's UAS guidance PDF and note which recommendations fit your fleet.
7. Review client contract clauses on data handling.

Quick check

Sources

• CISA: Cybersecurity Guidance: Chinese-Manufactured UAS
• NTIA: The Minimum Elements For a Software Bill of Materials (PDF)
• CISA: A Hardware Bill of Materials (HBOM) Framework for Supply Chain Risk Management (PDF)

Last reviewed: 18 October 2026.