01
Mission operations team preparing at their consoles before the shift begins
MISSION ONEORIENT · ASSIGN · OPERATE
Mission One
ORIENT, ASSIGN,
OPERATE.
“Before you fly anything, your team needs to know who runs what.”

Assign the three roles, then go and find the spacecraft on the console. Ten questions are scored in the platform, and seven of them are about the fleet rather than the crew.

MODULE SIX
01/07
02
Brief

BRIEF THE MISSION

Mission One puts your team on nine identical Microsat spacecraft in low Earth orbit, with three ground stations holding continuous contact and forty minutes of run time at real speed. Nothing is scripted to go wrong, and that is deliberate: this is the only mission where the platform does not act on you. Identical is the word that matters. A reading you take off one spacecraft is a reading that should hold across all nine, so anything that does not match is telling you something.

▷ Scenario
Spacecraft
Nine identical Microsats
Orbit regime
Low Earth orbit, circular
Altitude
About 722 km
Inclination
40 degrees
Run
2400 seconds at 1.0x
Ground stations
London, Dubai, Singapore
Scripted events
None
▷ Your objective

Orient the team and run nominal operations.

MODULE SIX
02/07
03
Mission One · what each role works

THREE ROLES, NINE SPACECRAFT

Nine identical Microsats, three ground stations in continuous contact, and nothing scripted to go wrong. The work splits three ways and it is not an even split: Satellite Operations carries the spacecraft and the link, Payload Operations carries the power chain, and the Mission Lead carries the authority calls. Click a role to see what it holds this mission.

▷ MISSION LEAD

You direct. You do not work a console.

Focus: authority on a quiet flight.
  • · Own the objective for the window
  • · Declare go for payload operations once comms checkout is complete
  • · Name who commands the sun-pointing manoeuvre and who verifies it
  • · Take the first call when downlink quality will not carry the tasking
  • · Call go / no-go on commanded actions
A mission lead standing at a supervisory console directing the team, with overview screens behind
TEAM SHAPE · Assign the three names now. You hold these roles for every mission ahead, no swaps. If you are flying solo you hold all three and move between them.
MODULE SIX
03/07
04
Method

READING THE SPACECRAFT

Five reads carry Mission One: where to look, where the spacecraft are, what they are making, where they are pointed, and how well they are heard. Nine identical vehicles means a reading that holds on one should hold on all nine, so each read is also a comparison. Click a step for the reasoning behind it.

▷ The five reads
Eight surfaces, and they are not interchangeable.

Controls, Images, Schedule, Telemetry, Messages, Plots, Map and Timeline. Two of them can hold the same quantity in different forms, so before you go looking, name what you need: a value, a trend, a position, or a time. The surface follows from the kind of question. An operator who skips that step searches instead of reads, and a contact window does not wait.

MODULE SIX
04/07
05
Simulate

FLY THE MISSION IN ZENDIR

Zendir, the digital twin and mission simulation platform Kestrel procured, replicates your satellite operations center. Everything you rehearsed here you now do for real inside it: one mission objective and ten scored questions. The ten questions land on the console reads and the authority calls you just walked. Run it in three steps: take your assigned consoles, fly the one objective and answer the ten questions in platform where they are scored, then note the score and come back here for the debrief. Your facilitator provides Zendir access, and two things must be true before you fly.

▷ Before you fly · your attestation
▸ Attest to both before you fly
▷ Scored in Zendir

This mission is worth 100 points, scored in-platform. Points accumulate across Missions One through Five, and the highest cumulative team finishes as the Top SCOR Team.

▷ Consoles ready
MODULE SIX
05/07
06
Return

NOW THAT YOU ARE BACK

Zendir scored your mission out of 100 toward the Top SCOR Team standings. Note where you landed, then run the debrief while it is fresh. Work these three questions in order; the last one is the one that becomes an engineering update in the quarterly SCOR exercise, the standing review where SCOR and Satellite Design & Engineering act on mission findings.

▷ Debrief · 01
What did the platform show you that the deck did not?
The gap between rehearsal and a live console is where the real learning sits.
▷ How to run it

Go around the crew once, one observation each, no discussion until everyone has spoken. Write the observations down before debating them; the first answer is usually the honest one.

MODULE SIX
06/07
END
FOCUSMISSION TWOMODULE 07
Mission One complete · Mission Two next

FOCUS.

Mission One is complete: you flew it in Zendir and your score is on the board. Mission Two takes the same crew into a working Earth-observation flight, where the windows are short, the tasking is real, and there is a product at the end that somebody downstream will act on.

CARRY FORWARD
The three roles you assigned, and the console reads you learned. Mission Two runs both against a live tasking.
IN MISSION TWO
The pass lifecycle, acquisition to loss of signal, over two tasking regions and four ground stations.
MODULE SIX
07/07
REFERENCE LIBRARY

Standards, Policies & Sources

The instruments this course aligns to. Each element links to its primary source.

U.S. National Security Space Policy

CNSS Policy No. 12 (CNSSP-12)Information-assurance policy for national security space systems.CNSS Instruction 1200 (CNSSI 1200), Aug 2025Implementing requirements: on-board intrusion detection, hardware root-of-trust, patch management.DoDI 8581.01Information-assurance policy for space systems used by the DoD.Space Policy Directive 5 (SPD-5), 2020First comprehensive U.S. cybersecurity principles for space systems.

Executive Orders

EO 14144 (Jan 16, 2025)Strengthening and Promoting Innovation in the Nation’s Cybersecurity.EO 14306 (Jun 6, 2025)Sustaining select efforts, amending EO 13694 and EO 14144.

NIST Standards & FISMA

NIST SP 800-53 Rev. 5Security and privacy controls; IR-3 incident-response testing.NIST SP 800-37 Rev. 2Risk Management Framework; continuous monitoring and annual control assessment.NIST IR 8270Introduction to Cybersecurity for Commercial Satellite Operations.NIST IR 8401Satellite Ground Segment cybersecurity framework profile.NIST IR 8441Cybersecurity Framework Profile for Hybrid Satellite Networks.NIST SP 800-160 Vol. 2 Rev. 1Cyber resiliency goals: Anticipate, Withstand, Recover, Adapt.FISMAFederal Information Security Modernization Act; annual program review obligation.

Threat Frameworks (analytic layer)

MITRE ATT&CKAdversary tactics and techniques knowledge base.MITRE CAPECCommon Attack Pattern Enumeration and Classification; dictionary of attack patterns that exploit known weaknesses.MITRE D3FENDKnowledge graph of defensive countermeasures and techniques, mapped to ATT&CK (NSA-funded, maintained by MITRE).SPARTASpace Attack Research and Tactic Analysis (The Aerospace Corporation).ESA Space ShieldEuropean Space Agency space-system threat framework.

EU & Global

NIS2 Directive (EU 2022/2555)Risk management and 24h/72h incident reporting; space sector in scope.EU Space Act (proposal, 25 Jun 2025)Space-specific resilience and cybersecurity obligations; extraterritorial scope.ENISA Space Threat LandscapeEuropean threat landscape and recommendations for space operators.Cyber Resilience Act (CRA)Connected hardware/software requirements; applies from December 2027.

Open-Source Vocabulary & Tooling

METEORSTORM MISP taxonomyThe course vocabulary, live and open source in the MISP taxonomy repository.MISP / CIRCLComputer Incident Response Center Luxembourg, maintainers of MISP.RootAPublic-domain open detection language (YAML) used in Module 04 to write portable signatures. (github.com/UncoderIO/Roota)Uncoder.IOOpen-source IDE and translation engine that ports RootA rules across SIEM, EDR, and XDR formats.SpaceCOP & Indicators of BehaviorDHS S&T + Aerospace Corp. on-board intrusion-detection prototype.CROO (Cyber Resilience On-Orbit)Proof Labs on-board IDS for the Space Force.

Community & Reporting

Space ISACSpace Information Sharing and Analysis Center.Air & Space Forces MagazineWaterman, “New Cybersecurity Rules for Pentagon’s Commercial Satellite Vendors,” Nov 19, 2025.Via Satellite“DHS Wants Satellite Volunteers to Test New Cyber Tools,” Nov 17, 2025.Defense Daily“New National Space Cybersecurity Policy Emphasizes Intrusion Detection,” Nov 18, 2025.Mayer Brown legal analysis“Securing the Final Frontier,” Dec 11, 2025 (US and EU regulatory map).