YOU'VE BEEN HIRED.

You are joining Kestrel Orbital to establish the Space Cybersecurity Operations and Resilience (SCOR) department, driving organizational transformation through the Pentagon of Pain mindset, equipped with the METEORSTORM Resilient Cyber Operations (RCO) Framework: five functions running on one machine-readable data model, where every threat, attack path, detection, and resilience measure normalizes into standardized enumerated elements. MITRE ATT&CK, SPARTA, D3FEND, NIST and the rest stop being a dozen disconnected catalogues, because each one enters as enumerated elements anchored to your own platform. What accumulates is the analytics catalog, your own intelligence and normalized peer-framework content in one lens, curated once and portable everywhere, including machine to machine with the Space Information Sharing and Analysis Center. Your department will bridge the Security Operations Center, the Satellite Operations Center, and Satellite Design & Engineering for Resilient Cyber Operations.

• ▸Protect command and control. In the United States, Executive Order 14144
  United States · Federal mandate

  Executive Order 14144

  Strengthening and Promoting Innovation in the Nation's Cybersecurity. Signed 16 January 2025. Published Federal Register Vol. 90, No. 11, 17 January 2025.

  × Close

  Most of this order is about federal software, cloud, and identity. One subsection is about you. Section 3(e) tells the Department of the Interior, the Department of Commerce, and NASA to review civil space contract requirements and recommend new cybersecurity language for the Federal Acquisition Regulation, on a risk-based, tiered approach, for all new civil space systems. Those requirements shall be designed to apply at minimum to the on-orbit segments and the link segments. That is Kestrel Orbital’s spacecraft and the radio path to them.

  The four command-and-control requirements

  Section 3(e)(i) directs that the recommended requirements address, for the highest-risk tier and as appropriate other tiers, protection of command and control of the civil space system, including backup or failover systems, by:

  #	Requirement, verbatim from the order	What you will build for it course mapping
  1	encrypting commands to protect the confidentiality of communications	Resilience measures on the telecommand path
  2	ensuring commands are not modified in transit	Detection signatures on command integrity
  3	ensuring an authorized party is the source of commands	Threats and attack paths against command authenticity
  4	rejecting unauthorized command and control attempts	Detection signatures with response playbooks

  The two further requirements

  • 3(e)(i)(B) establishment of methods to detect, report, and recover from anomalous network or system activity.
  • 3(e)(i)(C) use of secure software and hardware development practices, consistent with the NIST SSDF or any successor documents.

  Why this reaches a commercial operator

  The order does not regulate Kestrel Orbital directly. It directs agencies to put these requirements into contract language, and the tier a system falls in decides how much applies. An operator that wants civil space work meets them through the contract. That is why SCOR treats the four command-and-control items as a floor and not a ceiling, and why every one of them has to be evidenced against a named part of the platform rather than asserted.

  Page numbers are Federal Register pages, printed in the margin. The space provisions are Section 3(e), pages 6759 to 6760 (PDF pages 5 to 6). Read the order in full: Executive Order 14144.
  directs cybersecurity requirements for civil space systems: protect command and control, so that only commands from an authorized source are accepted and acted on. You will map the platform elements, threats, detections, and resilience measures that prove that protection. The full requirements are taught in the modules that meet them.
• ▸Meet NIS2 obligations. In Europe, the NIS2 Directive (EU) 2022/2555
  European Union · Directive

  The NIS2 Directive

  Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. Official Journal L 333, 27 December 2022.

  × Close

  NIS2 names Space in Annex I, Sectors of High Criticality, entry 11. The entity type it describes is precise: operators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks. NIS2 is a Directive, so it does not bind an operator by itself: it obliges Member States to impose these duties in national law, and the duty reaches an operator through the transposing statute of the state it operates in. It is the ground segment that carries it, not the spacecraft. For Kestrel Orbital that is the Reston mission-operations enclave, SEG:GR:Ground:00, and the Kiruna TT&C ground-station enclave, SEG:GR:Ground:01.

  Article 21(2), the ten measures

  Article 21(1) requires appropriate and proportionate technical, operational and organisational measures. Article 21(2) sets the floor, on an all-hazards approach, and it must include at least these ten.

  #	Measure, verbatim from the directive	Where the course produces it course mapping
  (a)	policies on risk analysis and information system security	Module 02, the documented risk basis
  (b)	incident handling	Module 04
  (c)	business continuity, such as backup management and disaster recovery, and crisis management	Module 05
  (d)	supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers	Module 05
  (e)	security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure	Not produced in these five modules
  (f)	policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Not produced in these five modules
  (g)	basic cyber hygiene practices and cybersecurity training	Not produced in these five modules
  (h)	policies and procedures regarding the use of cryptography and, where appropriate, encryption	Module 05
  (i)	human resources security, access control policies and asset management	Module 01, for asset management. The rest is not produced in these five modules
  (j)	the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate	Module 05

  Article 23, the reporting clocks

  A significant incident, defined at Article 23(3) as one that has caused or is capable of causing severe operational disruption or financial loss, or has affected or is capable of affecting others through considerable damage, starts a fixed sequence from the moment you become aware of it.

  Clock	What is due	Article
  24 hours	An early warning, indicating whether the incident is suspected of being caused by unlawful or malicious acts, or could have cross-border impact	23(4)(a)
  72 hours	An incident notification, updating the early warning with an initial assessment of severity and impact and, where available, the indicators of compromise	23(4)(b)
  On request	An intermediate report on relevant status updates	23(4)(c)
  One month	A final report: detailed description, severity and impact, the type of threat or root cause, applied and ongoing mitigation, and cross-border impact where applicable	23(4)(d)
  Still ongoing at one month	A progress report at that time, and a final report within one month of handling the incident	23(4)(e)

  Why the 72-hour clock decides your data model

  At 72 hours you owe indicators of compromise where you have them. An indicator you cannot attach to a named part of your platform is an indicator you cannot assess for severity or cross-border impact, and the clock does not pause while you work out what it touched. This is why the Concept of Operations comes first. The decomposition is what makes the 72-hour notification answerable.

  Page numbers are Official Journal pages, printed in the margin as L 333/nnn. Space is Annex I entry 11, L 333/146 (PDF page 67). The measures are Article 21, L 333/127 (PDF page 48). The clocks are Article 23, L 333/128 to 129 (PDF pages 49 to 50). Read the directive in full: Directive (EU) 2022/2555.
  designates Space a sector of high criticality and binds the ground infrastructure Kestrel Orbital operates, with incident reporting on fixed deadlines of 24 hours, 72 hours, and one month. You will connect platform elements, threats, detections, and response actions to those reporting obligations.
• ▸Enable collective defense. Kestrel Orbital’s own mandate, set by an executive memorandum from the CEO and CTO
  Kestrel Orbital · Internal directive · Simulated

  KO-EXEC-2026-014

  Approval of METEORSTORM analytic elements for machine-to-machine exchange with Space ISAC. Issued 9 January 2026 by Adaeze N. Okafor, Chief Executive Officer, and Gordon S. Reyes, Chief Technology Officer. Standing directive, effective immediately.

  × Close

  This memorandum is a course artifact. Kestrel Orbital is the fictional operator you work for. Executive Order 14144 and the NIS2 Directive are real instruments; this one models the internal directive a real operator would need to make sharing routine.

  This one is Kestrel Orbital’s own, and it is the only one of the three the company wrote for itself. It exists because sector sharing does not happen by good intentions. The memorandum states the reason plainly: a threat, an attack path, or a detection that one operator confirms becomes usable to the rest of us before it arrives. It then removes the ambiguity that stops sharing in practice, by naming exactly what may cross the channel.

  What it directs

  • Three co-equal mandates, Section 1.1. The order, the directive, and this exchange mandate carry equal weight. Section 4 states that none is subordinate to the other two.
  • Every element carries its identifier, Section 3.1. Its METEORSTORM tag and, where it names a specific instance on the platform, its ETEN identifier and parent chain, so a record means the same thing on both ends.
  • Machine to machine, Section 3.2. Structured records over the agreed Space ISAC interface, not free-text email or ad hoc attachments.
  • Scoped, not open-ended, Section 3.3. A redacted alert on a confirmed command-and-control attack under Executive Order 14144, and incident records consistent with the thresholds and clocks the NIS2 Directive sets.
  • Redaction is mandatory, Section 3.4. Mission-sensitive detail, customer identity, and any content restricted under ITAR or EAR is removed or withheld.
  • Reciprocal, Section 3.5. Elements received from Space ISAC in the same vocabulary are ingested into the shared platform view and routed to the department that owns the affected element.

  The six approved element types, Section 2

  Nothing outside this schedule crosses without a further written directive. The definitions are the published METEORSTORM analytic-layer text, and Section 2 forbids rewording, shortening, or paraphrasing them in an exchanged record, so they appear here as written.

  Tag	Element	Published definition
  AN-THR	Threat	“Confirmed and active threat against a converged space system.”
  AN-ATT	Attack Path	“Confirmed attack path for a converged space system.”
  AN-IOA	Indicator of Attack	“Confirmed indication that a converged space system has been attacked.”
  AN-IOC	Indicator of Compromise	“Confirmed indication that a converged space system has been compromised.”
  AN-DET	Detection Signature	“Validated and operational pattern, signal, or logic that triggers on contextualized threat behavior for a converged space system.”
  AN-RES	Resilience Measure	“Validated and operational protective capability ensuring converged space system resistance or recovery from confirmed threats.”

  What it puts on you

  Section 4 gives SCOR the vocabulary, the interface, and the redaction standard, and the job of training Security Operations, Satellite Operations, and Satellite Design and Engineering to produce and consume these elements as one system. It also states the line all five modules run on: the work done for the first two mandates is the work that feeds the third. You do not build a separate sharing programme. You share what the five functions already produced.

  Read the memorandum in full: KO-EXEC-2026-014.
  , requires information sharing with the Space Information Sharing and Analysis Center (Space ISAC)
  Global · Collective defense

  The Space Information Sharing and Analysis Center

  Established April 2019, headquartered in Colorado Springs. Member of the National Council of ISACs since 2020, participant in the EU Council of ISACs since 2023.

  × Close

  The three mandates make one operator harder to attack. This is how an entire sector does, and it is the reason the vocabulary matters as much as the findings. Space ISAC’s stated mission is to collectively protect global space systems to secure the future of humanity and to be the primary communications channel for the global space community. It was conceived in 2017 by the Science and Technology Partnership Forum to address information-sharing gaps in the cybersecurity and space community, presented at the 34th Space Symposium in April 2018, and established a year later.

  Why collective defense is the point, not a benefit

  An adversary that develops a technique against one operator’s ground segment can use it against every operator whose ground segment looks the same, and most of them do. The asymmetry is structural: the attacker builds once and reuses, while each defender discovers alone. Sector sharing inverts it. A confirmed threat, attack path, or detection signature crossing the channel means the second operator to be targeted is the first one already prepared.

  That only works if the finding survives the trip. A detection written against “the ground station” tells another operator nothing they can act on, because their ground station is not yours. A detection anchored to an enumerated element, with its parent chain, tells them exactly which part of their own platform to look at. This is why the memorandum insists on the published definitions and the ETEN identifier. The vocabulary is what makes collective defense mechanical rather than aspirational.

  What membership provides

  From the Space ISAC membership materials in your reference pack. Benefits are tiered, so what any operator gets depends on the level it holds.

  • Information Sharing Portal accounts receiving Watch Center alerts. Fifteen at Platinum, five at Gold, two at Silver, one at University and Laboratory.
  • Actionable space-related threat intelligence and vulnerability disclosures, thought leadership, and a voice at the table with the public and private sector.
  • Unlimited participation in collaborative groups, and access to critical industry reports and whitepapers. Below Gold this excludes the Analyst Working Group.
  • The opportunity to pitch a project to the Cyber Vulnerability Lab Committee, four times a year at Platinum down to once at Small Business.
  • Placing analysts in the Watch Center, virtual or in person. This is a Platinum benefit. University and Laboratory members get priority access to apply for open Fellow positions instead.

  Your part in it

  Kestrel Orbital’s commitment is membership and a machine-to-machine connection, contributing and consuming, redacted and policy-gated. The company runs a MISP instance, the same platform that publishes the meteorstorm taxonomy you tag against from Module 02 onward, and that instance is what carries the exchange. The memorandum sets the form at Section 3.2: structured records over the agreed Space ISAC interface, not free-text email or ad hoc attachments. What you build across the five modules is what fills that channel, and it is portable to it by construction, because it was written in a published vocabulary from the start rather than translated into one afterwards.

  spaceisac.org/membership · Member benefits by level · Membership brochure
  : membership, a machine-to-machine connection from Kestrel Orbital’s MISP instance, and the practice of contributing and consuming, redacted and policy-gated. You will build the taxonomy, ontology, and data model that channel needs.

You will build the organizational foundation for resilient cyber operations by implementing:

• ▸A shared taxonomy and ontology.
• ▸A machine-readable data model.
• ▸A unified view of the platform across security, operations, and engineering.
• ▸The five-function METEORSTORM Resilient Cyber Operations Framework.

You will apply the five functions to:

• ▸Decompose the platform.
• ▸Model threats and attack paths.
• ▸Engineer converged detections.
• ▸Prepare incident-response playbooks.
• ▸Identify resilience measures that help manage adversaries out of the platform’s attack surface.

In parallel, you will drive the Pentagon of Pain mindset across Kestrel Orbital. Most security programs measure themselves by what they have installed. This one measures itself by what the adversary has to spend.

Nobody here thinks that way yet. Maya Reyes, analyst lead in the Security Operations Center, has tracked the actors who target operators like this one for a year, and cannot say which part of the platform any of them would land on. Theo Lindgren, senior controller in the Satellite Operations Center, flies the spacecraft every pass and files interference as weather, because there has never been an element to file it against. Dana Whitfield, systems engineer in Satellite Design & Engineering, owns the flight software update path and has never once been asked to see it as a road an adversary would ride. Three good people, three partial views, and an attacker who only has to find the space between them.

The Pentagon names five areas where mastery provably raises an attacker’s cost, complexity, and risk. Each one falls to a different day of your week, and each of those three carries two of the five, with Day 1 shared between Theo and Dana. By the end of the week all three will be asking the question none of them asks today: what did that just cost the people trying to get in?

Your mission extends beyond producing technical artifacts. You will help Kestrel Orbital operate as one resilient organization and become a harder target, the organization’s contribution to the space community’s collective defense.

• ▸Day Zero: You will complete orientation.
• ▸Days 1–5: You will apply one function of the METEORSTORM Resilient Cyber Operations Framework each day.
• ▸Days 6–10: Your first week’s work earns funding for a digital twin, a simulation of the platform you defend. You will run five missions against it in the Satellite Operations Center, from standing up the team to a full incident response.

You will not build the department alone. Each of the three departments has given you one contact, and those three work every function beside you, from the decomposition on Day 1 to the response on your last day.

Security OperationsMaya ReyesAnalyst Lead, Security Operations CenterWith Maya you build the threat catalogue and the detection signatures that fire on it. She brings the intelligence; you both anchor it to elements the platform can name.

Satellite OperationsTheo LindgrenSenior Controller, Satellite Operations CenterWith Theo you build the concept of operations and the resilience measures that survive contact with a live pass. He flies the platform every day and knows what it does under load.

Satellite Design & EngineeringDana WhitfieldSystems Engineer, Satellite Design & EngineeringWith Dana you build the platform decomposition and the attack paths through it. She owns the flight software and the update path an adversary would target.

Before day one, you sit through orientation: how the team thinks, why space is no longer a sanctuary, and the shared language that holds the rest of the work together.

Your first five days on the job. One function each day, in order, applying the METEORSTORM cyber resilience framework end to end on the platform. Each function's deliverable supports the organization's work to meet Executive Order 14144 and the NIS2 Directive, and the taxonomy you stand up on Day 1 is what the Space ISAC sharing mandate exchanges.

With the digital twin deployed, you run five exercises against a simulation of the platform you defend, one mission each day, from standing up the team to running a full incident response. Each mission builds the organizational reflexes the mandates demand: detect, report, and recover as Executive Order 14144 requires, within the deadlines the NIS2 Directive sets.