NDAA-Compliant ISR Drones: GNSS-Denied Navigation and Encrypted C2

Requirement documents for small ISR drones increasingly open with three questions before they reach endurance. Is the supply chain free of covered-country components? Does the aircraft keep flying when satellite navigation is jammed or spoofed? Is the command link encrypted, with more than one way to reach the aircraft? Nimbus Recon, the ISR configuration of Fadron's Nimbus VTOL, answers all three. It is available in an NDAA-compliant configuration, it navigates without GNSS by fusing visual navigation with its inertial system, day and night, and it carries encrypted command and control over radio, mesh IP, cellular and satellite links.

This article takes each requirement in turn: what it means, why buyers write it, and how Nimbus Recon meets it.

What NDAA compliance means for an ISR drone

Section 848 of the US National Defense Authorization Act for fiscal year 2020 bars the Department of Defense from buying or operating drones, or their critical components, made in China. Section 817 of the FY2023 Act extended the restriction to Russia, Iran and North Korea, as Mayer Brown's summary of the FY2023 changes sets out. The components in scope run through the whole system, from the flight controller and radios to the cameras, the ground control station and the software. The American Security Drone Act then carried similar restrictions to US federal agencies and, from 22 December 2025, to the use of federal funds, grants included, for drones from covered foreign entities (Federal Register, 12 November 2024).

Outside the United States, "NDAA-compliant" has become common shorthand in requirement documents for a supply chain free of those sources. Allied ministries, border agencies and primes use it because it is the test their equipment will meet when it operates alongside US forces or is bought with US-linked money.

Nimbus Recon is available in an NDAA-compliant configuration, carrying an NDAA-compliant EO/IR gimbal with a thermal camera. Compliance belongs to a specific configuration, so name the NDAA-compliant Recon configuration in the requirement and in the quotation. A useful requirement asks every bidder for the same thing: a written statement of which configuration is compliant and which components it covers, from the flight controller to the ground station.

GNSS-denied navigation: flying when GPS is jammed or spoofed

Satellite navigation interference is a standing operating condition across much of eastern Europe. EASA has tracked it since Safety Information Bulletin 2022-02, most recently revised on 3 July 2026, and the 2024 revision rates spoofing as the greater risk (EASA). EASA's GNSS interference table (October 2026) ranks the Sofia flight information region fourth in the world, in a list led by regions such as Ankara, Warsaw and Bucharest, and flags spoofing in the Sofia region.

Jamming and spoofing do different damage. Jamming drowns the satellite signal, so the receiver loses its fix and the autopilot knows it. Spoofing feeds the receiver a false signal, so the aircraft trusts a wrong position and flies on with confidence. An ISR aircraft that depends on GNSS alone ends the mission early in the first case and drifts off its track in the second. Anti-jam antennas and multi-constellation receivers raise the bar against jamming, but they still depend on satellites, and inertial navigation on its own drifts the longer it runs.

Nimbus Recon fuses visual navigation with its inertial system, so it knows where it is without satellite signals and continues the mission when GPS is jammed or spoofed. The navigation system is manufactured in the EU and works by day and by night. Nimbus is built and flown in Bulgaria, inside the Sofia region that EASA ranks fourth.

When you write the requirement, ask three things of every bidder: what the aircraft does at the moment of signal loss, whether it holds its track under spoofing as well as jamming, and whether the capability works at night.

Encrypted C2: why an ISR drone needs more than one link

Every radio link has a failure mode. Terrain masks line-of-sight radio, cellular stops at the edge of coverage, and satellite carries too little data for video. Nimbus Recon carries four bearers, each for a reason:

• Encrypted C2 and telemetry radio, up to 100 km. The primary link uses AES-256 link encryption and message signing. Encryption keeps the traffic private, and signing proves each command came from your ground station, so a forged command is not accepted.
• Mesh IP radio for video and C2. The aircraft joins a ground mesh as one more node on the network the unit already runs, so video reaches every user on the mesh as well as the pilot.
• LTE and 5G cellular, on request. Where coverage exists, cellular extends reach over the operator's network. 3GPP has built aerial support into its standards, with UAS connectivity, identification and command-and-control quality of service in Release 17 (3GPP).
• Iridium SATCOM beyond line of sight. A low-rate satellite link carries telemetry and C2, so the aircraft stays reachable when the radio link is out of range or masked by terrain.

Position, status and mission data are published as Cursor-on-Target messages, video streams as H.264 or H.265 over RTSP, and waypoint and orbit commands are accepted from TAK. Our TAK integration article covers that in detail, and validation on your own network is part of integration.

When you write the communications section of a requirement, specify it by mission: the line-of-sight range you need, whether video must reach users on a ground network, and which link must remain when the primary radio is lost. Those three answers decide the bearer mix.

Export control and origin

Nimbus is designed and manufactured in Bulgaria, an EU and NATO member state, and is in serial production in Sofia. Fadron complies with EU dual-use export controls. The flight stack is open: PX4, MAVLink and QGroundControl, so integrators can work with the aircraft through standard interfaces. For buyers using European funding, origin is also a money question, covered in our guide to SAFE, EDF and EDIP.

Deployment, endurance and lead time

Nimbus needs no assembly in the field. One person carries it on the shoulder, it fits flat in an SUV, and it is ready to fly in under 2 minutes. It flies 2.5 hours on a single battery and up to 4 hours with a second fitted; with a 1 kg EO/IR payload, endurance is up to 4 hours at sea level and about 3 hours 30 minutes at 1,000 m. Range is up to 300 km. The aircraft operates at 4,000 m above sea level, take-off and landing included, with propellers adapted for altitude, and our high-altitude and cold-weather article covers that envelope. Lead time is 10 weeks.

Questions buyers ask

Is Nimbus Recon NDAA compliant?

Nimbus Recon is available in an NDAA-compliant configuration, including an NDAA-compliant EO/IR gimbal with a thermal camera. Specify that configuration in the requirement and the quotation.

Can Nimbus Recon fly without GPS?

Yes. It fuses visual navigation with its inertial system and continues the mission when GPS is jammed or spoofed, by day and by night.

How is the command link secured?

The C2 and telemetry radios use AES-256 link encryption and message signing, with a range of up to 100 km. Mesh IP radio, LTE and 5G cellular, and Iridium SATCOM provide further bearers.

Can Nimbus Recon operate from a ship?

Yes, in calm conditions, from a deck area of about 5 by 5 m. A precision visual landing system is recommended. Rougher seas need an assisted landing system and further integration.

How long is the lead time?

10 weeks.

See it fly

Request the data sheet or a demonstration flight on your own site through the defence page, or see the full aircraft on the Nimbus page.