8900.0
| Order | ||
|---|---|---|
| Subject | ||
| FHWA Internal Operations Policy for Unmanned Aircraft Systems (UAS) | ||
| Classification Code | Date: | Office of Primary Interest |
| 8900.0 | September 21, 2026 | HIF |
Par.
- What is the purpose of this Order?
- Does this Order cancel an existing FHWA Order?
- What are the authorities governing this Order?
- What is FHWA's internal UAS operation policy?
- What are FHWA's responsibilities for implementing its internal UAS Program?
- What definitions are used in this Order?
- What are the procurement and acquisition controls for this Order?
- What are the flight plan requirements, approvals, and public notifications for UAS operations?
- What are the training and currency requirements?
- What are the safety, privacy, and data protection requirements for UAS operations?
- What are the maintenance, recordkeeping, and asset management requirements for use of UAS?
- What are the incident and accident reporting procedures?
- What are the representation requirements regarding telecommunications and video surveillance equipment?
- What are the transition, compliance, and exception provisions for this Order?
- What are the enforcement and oversight requirements of the UAS Program?
- What is the purpose of this Order? This Order establishes the Federal Highway Administration (FHWA) policy, responsibilities, and procedures for the acquisition, ownership, operation, management, records, and oversight of UAS used to conduct official FHWA business. The objectives of this Order are to ensure safe, lawful, efficient, and privacy-protective UAS operations in support of FHWA mission; to implement supply chain and information security measures required for Federal UAS procurement and operations; establish clear operational authorities at the office and division levels; and, to standardize mission approvals and public notifications through a centralized system.
- Does this Order cancel an existing FHWA order? This Order supersedes the Interim FHWA UAS Policy dated November 19, 2020, and adopts program structure, controls, and procurement safeguards necessary to meet current statutory and executive guidance, including Section 1825 of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2024, P.L. 118-31 (Section 1825 of the FY 2024 NDAA) and the Office of Management and Budget (OMB) Memorandum M-26-02.
- What are the authorities governing this Order?
- Title 14, Code of Federal Regulations (CFR), Part 107-Small Unmanned Aircraft Systems.
- 49 CFR Part 15-Protection of Sensitive Security Information. Section 889 of the FY 2019 NDAA and related prohibitions on certain telecommunications and video surveillance equipment.
- Section 1825, FY 2024 NDAA-Prohibition on use of Federal funds to procure or operate covered UAS from covered foreign entities (as provided by statute).
- OMB Memorandum M-26-02-Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States Producers.
- Buy American Act (41 U.S.C. §§ 8301-8305)
- Federal Acquisition Regulations (FAR)
- DOT Order 1351.28-Records Management
- DOT Order 1351.18-Departmental UAS Privacy Policy
- DOT Order 1351.37-Departmental Cybersecurity Policy
- FHWA Personal Property Order (M 4300.1)
- FHWA Order 1324.1B-FHWA Records Management
What authorities govern this Order? FHWA will operate and procure UAS only for official FHWA business and only in compliance with applicable aviation, acquisition, privacy, information security, and records requirements.
FHWA shall implement supply chain and information security controls to satisfy OMB M-26-02 and the prohibitions and exemptions in Section 1825 of the FY 2024 NDAA. These controls include, but are not limited to: (a) pre-award supply chain risk assessments and impact assessments for UAS that process, store, or transmit Federal information; (b) vendor certifications and contractual warranties, including the mandatory insertion of FAR 52.240-90 and 52.240-91, attesting that the proposed UAS and its supply chain contain no foreign components or services prohibited by the American Security Drone Act (ASDA) or other applicable Federal restrictions; (c) technical and procedural measures to protect Federal information and to mitigate risks from firmware and software updates, telemetry, and data storage; and, (d) the inclusion of contractual inspection, audit, and traceability rights. The UAS Program Manager shall promulgate detailed acquisition guidance and required contract clause language consistent with OMB M-26-02 and Section 1825 of the FY 2024 NDAA.
Each Headquarters Program Office, Director of Field Services (DFS) office, or Federal Lands Highway Division (FLHD) that operates, procures, contracts for, or maintains an active UAS Program shall designate a Senior Pilot in Command (Senior PIC) to exercise delegated operational authority and accountability for the office's UAS activities in accordance with this Order. Offices that do not operate, procure, or utilize UAS are exempt from this designation requirement. The UAS Advisory Committee established under prior guidance is rescinded; advisory and programmatic responsibilities formerly assigned to the committee are transferred to the UAS Program Manager. To standardize mission approvals, public notice, and recordkeeping, FHWA will use a centralized FHWA UAS Google Site, or other centralized system as directed by the UAS Program
Manager to collect mission submissions, route approvals, store required documentation, and publish public notices as required. The FHWA UAS Google Site shall capture the metadata necessary to demonstrate regulatory and policy compliance and shall
What are FHWA's responsibilities for implementing its internal UAS Program? This Order applies to all FHWA employees, contractors, consultants, subcontractors, and others conducting UAS operations, procuring UAS equipment or services, or otherwise supporting FHWA UAS missions. This Order governs all FHWA-owned UAS, UAS acquired through FHWA funds, UAS services procured or paid for with FHWA funds, and any UAS operations in support of or in connection with a Federal project. Use of personal UAS for official business or on official time is prohibited.
All UAS operations and acquisitions under this Order shall comply with applicable law, regulation, and policy including, but not limited to, the items listed below. FHWA staff should coordinate questions on applicability with their office's Senior PIC, UAS Program Coordinator, or UAS Program Manager as appropriate.
- What definitions are used in this Order? This section establishes the authorities and definitions governing FHWA's internal UAS Program to ensure Agencywide compliance with statutory and safety requirements:
- Unmanned Aircraft System: The airframe and all associated support items, such as sensors, equipment, control stations, data links, telemetry, communications, and navigation equipment necessary to operate the unmanned aircraft and collect aerial data.
- Covered Unmanned Aircraft System: Any UAS that is manufactured or assembled by a covered foreign entity, as defined in Section 1825 of the FY 2024 NDAA and 48 CFR 40.201
- Covered Foreign Entity: This term means an entity included on a list developed and maintained by the Federal Acquisition Security Council and published in the System for Award Management.
- UAS Program Manager: The FHWA official with final approval authority for all FHWA UAS acquisitions and any policy deviations. Responsibilities include managing the central asset registry, maintaining standardized contract language, and coordinating Agency-wide compliance with Section 1825 of the FY 2024 NDAA, OMB, and other requirements.
- UAS Program Coordinator: Responsible for day-to-day operational oversight, including auditing flight and maintenance records, monitoring training currency, and overseeing accident documentation. In the absence or unavailability of the UAS Program Manager, the UAS Program Coordinator acts temporarily in such capacity as is necessary for continued operations.
- Senior Pilot in Command: The senior operational official for an FHWA office or division. The Senior PIC must validate mission flight plans on the FHWA UAS Google Site, maintain the office UAS inventory, and certify that all proposed procurement or contract actions conform to OMB M-26-02 and Section 1825 of the FY 2024 NDAA requirements.
- Pilot in Command: An Federal Aviation Administration (FAA)-certified remote pilot with final authority and responsibility for the safe conduct of a UAS mission. Responsibilities include adhering to approved flight plans, maintaining flight logs, ensuring compliance with privacy protections, and immediately reporting accidents, incidents, or security events.
- Visual Observer (VO): An individual who assists the PIC in maintaining visual line of sight and situational awareness during flight operations. The VO is responsible for scanning the surrounding airspace for potential hazards, such as other aircraft or obstacles, and communicating those risks to the PIC immediately.
- Contracting Officer (CO) and Contracting Officer's Representative (COR): These officials ensure all solicitations and contracts comply with OMB M-26-02 and Section 1825 of the FY 2024 NDAA requirements and contain relevant FAR and Transportation Acquisition Regulations clauses. The CO and COR shall consider the inclusion of sample contract clauses provided in the Appendix of this Order to ensure contractors provide required attestations, traceability, and rights to inspect. The COR specifically verifies that contractor PICs meet FHWA requirements.
- FHWA UAS Google Site: The centralized system used to standardize mission approvals, publish public notifications, and serve as the primary repository for regulatory and policy compliance artifacts.
What are the procurement and acquisition controls for this Order? No UAS hardware, firmware, software, or UAS service contract shall be executed without prior written approval of the UAS Program Manager. Procurement actions shall include documented consideration of existing FHWA assets prior to authorizing purchase of additional systems.
All proposed procurements shall be accompanied by a supply chain and information security assessment consistent with OMB M-26-02, including an impact assessment when UAS will process, store, or transmit Federal information. Procurements are subject to the FAR, including the provisions at 48 CFR Part 40, Subpart 40.2. Offerors must disclose manufacturers, assembly locations, firmware and software sources, upstream suppliers, and any use of subcontractors. The use of UAS on any list maintained by another Federal Agency approved for use or platforms confirmed to the same supply chains will be allowed approval without this additional information.
All solicitations and contracts shall incorporate the clause at 48 CFR 52.240-1, Prohibition on the Procurement and Operation of UAS from Covered Foreign Entities, to ensure mandatory vendor certification of non-use of ASDA-prohibited covered foreign entities per Section 1825 of the FY 2024 NDAA. These enforceable provisions shall include rights to audit and inspect supply chain documentation, requirements for immediate notification of component substitution, breach and incident reporting within 24 hours, and clear contractual remedies for misrepresentation. Sample clauses and specific representation language are provided in the Appendix.
What are the flight plan requirements, approvals, and public notifications for UAS operations? All missions shall be planned and submitted by the PIC through the FHWA
UAS Google Site. The submission must include the mission flight plan, airspace review, weather briefing, area of operation, altitudes and obstacle analysis, communications plan, PIC and VO assignments, any permits or approvals obtained for the flight, and contingency and emergency procedures.
The Senior PIC shall review submissions for completeness, safety, and compliance and shall either approve or return the plan with required corrections. The UAS Program Coordinator and UAS Program Manager may review missions as necessary for program or security concerns.
For missions requiring public notice, the UAS Program Coordinator shall publish required public notifications to the FHWA public operations page prior to the operation. PICs shall enter missions for which public posting is required into the Google Site at least 7 days prior to the planned date to permit internal review and posting. Flights that will be similar in nature over long durations can receive flight plan approvals for up to 6 months in duration to minimize redundant approvals and postings. To support emergency operations or critical flights, the UAS Program Manager can waive these requirements and allow for flight plan approvals to be completed by a Senior PIC and public posting to take place at the earliest opportunity, but no later than 48 hours after the conclusion of the mission.
What are the training and currency requirements? All FHWA PICs must hold a current FAA Remote Pilot Certificate and must satisfy FHWA minimum experience requirements prior to acting as an independent PIC. Minimum FHWA PIC experience shall include at least five separate flights totaling not less than 60 minutes of flight time on the UAS platform to be operated, unless otherwise approved by the Senior PIC. Up to three of the initial flights, and fifty percent of initial flight time, may be satisfied via approved simulator training or supervised personal flights where documented and approved.
To maintain FHWA currency, each PIC must log at least two flights annually. Records documenting currency shall be provided annually to the UAS Program Coordinator.
What are the safety, privacy, and data protection requirements for UAS operations? UAS operations shall adhere to 14 CFR Part 107 requirements and require a VO for all FHWA flights. Certificates of Waiver or Authorization (known as a COA) or waivers are required when operations fall outside Part 107 parameters, and COA waivers shall have UAS Program Manager concurrence prior to initiation of the waiver process.
UAS operations must be carried out with due regard for privacy. Intentional collection of Personally Identifiable Information (PIT) is prohibited unless authorized by law and expressly approved by the UAS Program Manager and concurrence from the Office of Chief Counsel. Inadvertently collected PIT shall be redacted promptly during data processing and shall not be used or disseminated.
All systems shall be treated as both aircraft and IT assets. Remote control devices must not access FHWA networks during flight. Software and firmware updates shall be obtained only from trusted sources; update procedures shall be executed on isolated systems. Mission data shall be encrypted to the extent practicable and in accordance with DOT Order 1351.37, Departmental Cybersecurity Policy, and its accompanying Departmental Cybersecurity Compendium. Where mission data is classified or designated as high-confidentiality, appropriate technical controls (including disabling non-approved data transmission paths) shall be implemented.
Secure Digital (SD) cards and other removable media shall be removed from UAS when not in use, uniquely identified, and erased and reformatted after each mission. Annual attestations regarding removable media handling shall be submitted to the UAS Program Coordinator from Senior PICs where the UAS are located.
What are the maintenance, recordkeeping, and asset management requirements for use of UAS? The PIC shall maintain a pre- and post-flight maintenance log for each UAS mission that documents inspections, repairs, and SD card assignments. The Senior PIC shall ensure that maintenance logs are reviewed prior to flight.
Offices and divisions shall retain all UAS records, including pilot certificates, flight hours, maintenance logs, incident reports, procurement and supply chain documentation, and training records in accordance with DOT and FHWA records management policy and shall provide records promptly upon request to the UAS Program Manager.
What are the incident and accident reporting procedures? The PIC shall immediately notify their Senior PIC, the Office Director or Division Administrator, the UAS Program Coordinator, and the UAS Program Manager of any accident or incident resulting in injury, private property damage, or significant damage or loss of the UAS. The PIC shall complete FAA reporting forms where required by FAA regulations and shall cooperate with any internal or external investigations.
To the extent that operations are within the scope of employment and conducted in accordance with this Order, FHWA will rely on available Federal immunities and the Federal Tort Claims Act. PICs must comply with all requirements of this Order to ensure coverage. Contractors are required to maintain liability insurance covering aircraft operations as a condition of contract performance.
- What are the representation requirements regarding telecommunications and video surveillance equipment? Contractors and vendors must certify that the UAS, related components, and software do not include covered telecommunications or video surveillance equipment or services prohibited by applicable statutes, including ASDA and Section 889 authorities. Sample vendor representations and clauses are included in the Appendix.
What are the transition, compliance, and exception provisions for this Order? Offices and divisions shall complete the following actions within 90 days of issuance of this Order: appoint a Senior PIC; register all FHWA UAS assets in the central inventory; transition active mission approvals to the FHWA UAS Google Site workflow; and submit office or division standard operating procedures to the UAS Program Coordinator for review.
Requests for exceptions to this Order, including exemptions under statutory authorities (including exemptions recognized under Section 1825 of the FY 2024 NDAA, where applicable), shall be submitted in writing to the UAS Program Manager with supporting justification. Exceptions may be granted only by the FHWA Executive Director or a delegated official in writing. Exemption documentation shall be retained for audit and oversight.
What are the enforcement and oversight requirements of the UAS Program? The UAS Program Manager shall monitor compliance, perform periodic audits, and require corrective action where policy deviations are identified. The FHWA Offices of Chief Counsel and Administration shall assist with legal and procurement enforcement, and the Office of Inspector General may be provided access to records for oversight.
This Order is effective on the date signed below and remains in force until superseded or rescinded.
Hari Kalla |
A.1. Mandatory Federal Acquisition Regulation (FAR) Compliance
The Contractor shall comply with FAR 52.240-1, Prohibition on the Procurement and Operation of Unmanned Aircraft Systems (UAS) from Covered Foreign Entities. This clause is hereby incorporated by reference into all solicitations and contracts for UAS hardware, software, or services.
A.2. Supplemental American Security Drone Act/FY 2024 National Defense Authorization Act (NDAA) 1825 Requirements
The Contractor certifies that, to the best of its knowledge and belief, the UAS, components, firmware, software, and associated services proposed for performance under this Contract do not include any covered UAS manufactured or assembled by a covered foreign entity as defined in Section 1825 of the FY 2024 NDAA and implementing regulations. The Contractor shall:
- (a) Provide, upon request, full disclosure of manufacturers, assembly locations, supply chain sources, firmware/software provenance, and any subcontractors involved in the supply chain for the UAS and associated systems.
- (b) Immediately notify the Contracting Officer and the Contracting Officer's Representative (COR) if the Contractor becomes aware of any condition that would cause the Contractor's certification to be inaccurate, including component substitution, change in manufacturing location, or acquisition of supplier assets.
- (c) Provide, upon request, supporting traceability documentation sufficient to validate the origin and chain of custody of UAS hardware and software components.
- (d) Allow the Federal Highway Administration (FHWA) or their authorized agents access to supplier documentation and facilities for inspection or audit, subject to protection of proprietary information as provided under the contract.
- (e) Agree that any material misrepresentation in the Contractor's certification constitutes a material breach and may result in contract termination, recoupment of funds, and other remedies.
A.3. OMB M-26-02 Information Security and Supply Chain Risk Clause
The Contractor shall implement and maintain measures necessary to protect Federal information processed, stored, or transmitted by the UAS and associated systems consistent with OMB M-26-02. Such measures shall include, at a minimum:
- (a) Authentication and access control for ground control stations consistent with National Institute of Standards and Technology SP 800-63 guidance, including multifactor authentication where remote access is permitted.
- (b) Firmware and software updates provided only through trusted sources; testing of integrity prior to field deployment; use of isolated systems for update procedures.
- (c) Encryption of Federal mission data in transit and at rest using validated cryptographic modules and algorithms approved by FHWA.
- (d) The ability for FHWA to opt out of any forced data uploads or remote storage, and the ability to control the destination of Federal data.
- (e) Support for remote security controls as appropriate (remote wipe and lock) and documented procedures for invoking remote controls.
- (f) Incident reporting to FHWA within 24 hours of detection of any suspected compromise of UAS systems, data exfiltration, or firmware integrity issues.
A.4. Contractor Insurance and Pilots in Command (PIC) Qualifications Clause
The Contractor shall maintain commercial general liability and aviation liability insurance that covers UAS operations. The Contractor shall ensure that any PIC performing under this contract holds a current Federal Aviation Administration Remote Pilot Certificate and has completed at least five flights on the specific UAS platform proposed for operations, unless otherwise approved by the COR.