01
An operator documenting a role-specific procedure with three role-perspective monitors visible behind the workstation
MISSION TWOFOCUS
Mission Two
FOCUS.
“When the pressure hits, you do not rise to the occasion. You fall to the clarity of your role.”

You came out of Mission One with the roles assigned and the console learned. Mission Two puts both against a live tasking, where the window is short and the product at the end has to be right first time.

MODULE SEVEN
01/07
02
Brief

BRIEF THE MISSION

Mission Two is a working Earth-observation flight over two tasking regions, run at four times speed across a much longer window, with four ground stations coming into view and leaving it again. Nothing is scripted to go wrong here either. The difficulty is the pass itself: short windows, real tasking, and a product at the end that somebody downstream will act on.

▷ Scenario
Orbit regime
Medium Earth orbit, circular
Altitude
About 2,622 km
Inclination
26 degrees
Run
9600 seconds at 4.0x
Ground stations
Cape Town, Singapore, Honolulu, Santiago
Scripted events
None
▷ Your objective

Earth-observation tasking over the Strait of Malacca and Hawaii.

MODULE SEVEN
02/07
03
Mission Two · what each role works

WHAT YOU FOCUS ON

Mission Two is a working Earth-observation flight over two tasking regions, with four ground stations coming into view and leaving again. Nothing is scripted to go wrong, so every role is judged on discipline rather than on reaction. Click a role to see what it holds this mission.

▷ MISSION LEAD

You run the pass. You open it, you hold the thresholds, and you close it.

Focus: the pass, start to finish.
  • · Confirm contact, the pass timeline and the ground station at the start of every pass
  • · Approve safe-mode entry or a spacecraft reset personally, never by delegation
  • · Review whether primary tasking completed and whether anomalies occurred, the moment the pass ends
  • · Set the escalation thresholds the two operators work to
A mission lead standing at a supervisory console directing the team, with overview screens behind
TEAM SHAPE · You hold the roles you assigned in Mission One. No swaps.
MODULE SEVEN
03/07
04
Method

THE PASS LIFECYCLE

A contact window is short and it does not pause. Crews that improvise inside one lose it. The lifecycle gives every phase of the pass a fixed job, so the crew is deciding what to do about the vehicle rather than deciding what to do next. Click a step for the reasoning behind it.

▷ Acquire, hold, task, close
Verify the link before you command anything.

A pass opens with three confirmations and none of them are commands: that you have contact, that you know the pass timeline, and that you know which station you are working. Commanding into an unverified link is how a crew loses a window, because a command that is not acknowledged has to be reissued and the window does not wait. Confirm first, command second.

MODULE SEVEN
04/07
05
Simulate

FLY THE MISSION IN ZENDIR

Zendir, the digital twin and mission simulation platform Kestrel procured, replicates your satellite operations center. Everything you rehearsed here you now do for real inside it: one mission objective and ten scored questions. The ten questions land on the pass lifecycle you just walked. Run it in three steps: take your assigned consoles, fly the one objective and answer the ten questions in platform where they are scored, then note the score and come back here for the debrief. Your facilitator provides Zendir access, and two things must be true before you fly.

▷ Before you fly · your attestation
▸ Attest to both before you fly
▷ Scored in Zendir

This mission is worth 100 points, scored in-platform. Points accumulate across Missions One through Five, and the highest cumulative team finishes as the Top SCOR Team.

▷ Procedures ready
MODULE SEVEN
05/07
06
Return

NOW THAT YOU ARE BACK

Zendir scored your mission out of 100 toward the Top SCOR Team standings. Note where you landed, then run the debrief while it is fresh. Work these three questions in order; the last one is the one that becomes an engineering update in the quarterly SCOR exercise.

▷ Debrief · 01
What did the platform show you that the deck did not?
The gap between rehearsal and a live console is where the real learning sits.
▷ How to run it

Go around the crew once, one observation each, no discussion until everyone has spoken. Write the observations down before debating them; the first answer is usually the honest one.

MODULE SEVEN
06/07
END
OBSERVEMISSION THREEMODULE 08
Mission Two complete · Mission Three next

OBSERVE.

Mission Two is complete and scored. Mission Three flies the same kind of work from a different orbit, but the deliverable changes: you are scored on the report you hand up, not on the pass you flew.

CARRY FORWARD
The pass lifecycle you just ran, acquisition to loss of signal. Mission Three reports on it.
IN MISSION THREE
The situation report, and telling a part that is failing from somebody who should not be there.
MODULE SEVEN
07/07
REFERENCE LIBRARY

Standards, Policies & Sources

The instruments this course aligns to. Each element links to its primary source.

U.S. National Security Space Policy

CNSS Policy No. 12 (CNSSP-12)Information-assurance policy for national security space systems.CNSS Instruction 1200 (CNSSI 1200), Aug 2025Implementing requirements: on-board intrusion detection, hardware root-of-trust, patch management.DoDI 8581.01Information-assurance policy for space systems used by the DoD.Space Policy Directive 5 (SPD-5), 2020First comprehensive U.S. cybersecurity principles for space systems.

Executive Orders

EO 14144 (Jan 16, 2025)Strengthening and Promoting Innovation in the Nation’s Cybersecurity.EO 14306 (Jun 6, 2025)Sustaining select efforts, amending EO 13694 and EO 14144.

NIST Standards & FISMA

NIST SP 800-53 Rev. 5Security and privacy controls; IR-3 incident-response testing.NIST SP 800-37 Rev. 2Risk Management Framework; continuous monitoring and annual control assessment.NIST IR 8270Introduction to Cybersecurity for Commercial Satellite Operations.NIST IR 8401Satellite Ground Segment cybersecurity framework profile.NIST IR 8441Cybersecurity Framework Profile for Hybrid Satellite Networks.NIST SP 800-160 Vol. 2 Rev. 1Cyber resiliency goals: Anticipate, Withstand, Recover, Adapt.FISMAFederal Information Security Modernization Act; annual program review obligation.

Threat Frameworks (analytic layer)

MITRE ATT&CKAdversary tactics and techniques knowledge base.MITRE CAPECCommon Attack Pattern Enumeration and Classification; dictionary of attack patterns that exploit known weaknesses.MITRE D3FENDKnowledge graph of defensive countermeasures and techniques, mapped to ATT&CK (NSA-funded, maintained by MITRE).SPARTASpace Attack Research and Tactic Analysis (The Aerospace Corporation).ESA Space ShieldEuropean Space Agency space-system threat framework.

EU & Global

NIS2 Directive (EU 2022/2555)Risk management and 24h/72h incident reporting; space sector in scope.EU Space Act (proposal, 25 Jun 2025)Space-specific resilience and cybersecurity obligations; extraterritorial scope.ENISA Space Threat LandscapeEuropean threat landscape and recommendations for space operators.Cyber Resilience Act (CRA)Connected hardware/software requirements; applies from December 2027.

Open-Source Vocabulary & Tooling

METEORSTORM MISP taxonomyThe course vocabulary, live and open source in the MISP taxonomy repository.MISP / CIRCLComputer Incident Response Center Luxembourg, maintainers of MISP.RootAPublic-domain open detection language (YAML) used in Module 04 to write portable signatures. (github.com/UncoderIO/Roota)Uncoder.IOOpen-source IDE and translation engine that ports RootA rules across SIEM, EDR, and XDR formats.SpaceCOP & Indicators of BehaviorDHS S&T + Aerospace Corp. on-board intrusion-detection prototype.CROO (Cyber Resilience On-Orbit)Proof Labs on-board IDS for the Space Force.

Community & Reporting

Space ISACSpace Information Sharing and Analysis Center.Air & Space Forces MagazineWaterman, “New Cybersecurity Rules for Pentagon’s Commercial Satellite Vendors,” Nov 19, 2025.Via Satellite“DHS Wants Satellite Volunteers to Test New Cyber Tools,” Nov 17, 2025.Defense Daily“New National Space Cybersecurity Policy Emphasizes Intrusion Detection,” Nov 18, 2025.Mayer Brown legal analysis“Securing the Final Frontier,” Dec 11, 2025 (US and EU regulatory map).