01
A mission leader receiving a nominal-operations briefing from an operator in front of a status board showing orbital tracks and telemetry waveforms
MISSION THREEOBSERVE
Mission Three
OBSERVE.
“Clean comms on a calm day is the muscle you need on a bad day.”

The mission leader asks what happened, and your facilitator stands in for them. Mission Three is scored on the report you hand up, and on whether you can tell a part that is wearing out from somebody who should not be there.

MODULE EIGHT
01/07
02
Brief

BRIEF THE MISSION

Mission Three flies the same kind of Earth-observation work as Mission Two, over two new regions, from a higher and more steeply inclined orbit. The flying is familiar on purpose. What changes is the deliverable: this mission is scored on the situation report you produce, not on the pass you flew.

▷ Scenario
Orbit regime
Medium Earth orbit, circular
Altitude
About 3,122 km
Inclination
63 degrees
Run
9600 seconds at 4.0x
Ground stations
Ankara, Auckland, Bangkok, Santiago
Scripted events
None
▷ Your objective

Earth-observation tasking over the Aegean Sea and the Tasman Sea.

MODULE EIGHT
02/07
03
Mission Three · what each role reports

WHAT YOU OBSERVE

The flying is Mission Two's, from a higher and more steeply inclined orbit. What changes is the deliverable: this mission is scored on the situation report, and both operating roles carry the same job of telling a failing part from an adversary. Click a role to see what it holds this mission.

▷ MISSION LEAD

You combine and you cut. Two reports go in, one goes up.

Focus: the report that leaves the room.
  • · Combine the Satellite Operations and Payload Operations situation reports into one
  • · Drop the per-step raw telemetry samples and the full command logs
  • · Write the single most important line: mission status, whether primary tasking was achieved, and any decision required
  • · Carry it to the mission leader
A mission lead standing at a supervisory console directing the team, with overview screens behind
THE COMMON TASK · Both operators run the same test on their own signals. A maintenance signal explains itself with wear or physics. A cyber signal needs a person who is not on your crew to explain it.
MODULE EIGHT
03/07
04
Method

CYBER-RELEVANT OR MAINTENANCE-RELEVANT

Every anomaly you will ever see arrives looking the same: a number that is not what you expected. The work is deciding whether a part is wearing out or somebody is in your system, and the two demand completely different responses. Click a step for the reasoning behind it.

▷ The discriminator
Lead with the bottom line, because the reader may stop after one line.

The first line of a report states the mission status, whether the primary tasking was achieved, and what decision is required of the reader. Everything after it is support. A report that builds toward its conclusion works for the writer and fails the commander, who has three other reports to read and will act on whichever one told them something in the first sentence.

MODULE EIGHT
04/07
05
Simulate

FLY THE MISSION IN ZENDIR

Zendir, the digital twin and mission simulation platform Kestrel procured, replicates your satellite operations center. Everything you rehearsed here you now do for real inside it: one mission objective and ten scored questions. The ten questions land on the situation report and the discriminator you just walked. Run it in three steps: take your assigned consoles, fly the one objective and answer the ten questions in platform where they are scored, then note the score and come back here for the debrief. Your facilitator provides Zendir access, and two things must be true before you fly.

▷ Before you fly · your attestation
▸ Attest to both before you fly
▷ Scored in Zendir

This mission is worth 100 points, scored in-platform. Points accumulate across Missions One through Five, and the highest cumulative team finishes as the Top SCOR Team.

▷ Console ready
MODULE EIGHT
05/07
06
Return

NOW THAT YOU ARE BACK

Zendir scored your mission out of 100 toward the Top SCOR Team standings. Note where you landed, then run the debrief while it is fresh. Work these three questions in order; the last one is the one that becomes an engineering update in the quarterly SCOR exercise.

▷ Debrief · 01
What did the platform show you that the deck did not?
The gap between rehearsal and a live console is where the real learning sits.
▷ How to run it

Go around the crew once, one observation each, no discussion until everyone has spoken. Write the observations down before debating them; the first answer is usually the honest one.

MODULE EIGHT
06/07
END
DETECTMISSION FOURMODULE 09
Mission Three complete · Mission Four next

DETECT.

Mission Three is complete and scored. Mission Four is the first flight where the platform acts on you: several things go wrong, and they do not all have the same cause.

CARRY FORWARD
Telling a failing part from an adversary. Mission Four asks for it with the clock running.
IN MISSION FOUR
A spoofed navigation fix, content in the telemetry nobody put there, and a unit that fails on its own.
MODULE EIGHT
07/07
REFERENCE LIBRARY

Standards, Policies & Sources

The instruments this course aligns to. Each element links to its primary source.

U.S. National Security Space Policy

CNSS Policy No. 12 (CNSSP-12)Information-assurance policy for national security space systems.CNSS Instruction 1200 (CNSSI 1200), Aug 2025Implementing requirements: on-board intrusion detection, hardware root-of-trust, patch management.DoDI 8581.01Information-assurance policy for space systems used by the DoD.Space Policy Directive 5 (SPD-5), 2020First comprehensive U.S. cybersecurity principles for space systems.

Executive Orders

EO 14144 (Jan 16, 2025)Strengthening and Promoting Innovation in the Nation’s Cybersecurity.EO 14306 (Jun 6, 2025)Sustaining select efforts, amending EO 13694 and EO 14144.

NIST Standards & FISMA

NIST SP 800-53 Rev. 5Security and privacy controls; IR-3 incident-response testing.NIST SP 800-37 Rev. 2Risk Management Framework; continuous monitoring and annual control assessment.NIST IR 8270Introduction to Cybersecurity for Commercial Satellite Operations.NIST IR 8401Satellite Ground Segment cybersecurity framework profile.NIST IR 8441Cybersecurity Framework Profile for Hybrid Satellite Networks.NIST SP 800-160 Vol. 2 Rev. 1Cyber resiliency goals: Anticipate, Withstand, Recover, Adapt.FISMAFederal Information Security Modernization Act; annual program review obligation.

Threat Frameworks (analytic layer)

MITRE ATT&CKAdversary tactics and techniques knowledge base.MITRE CAPECCommon Attack Pattern Enumeration and Classification; dictionary of attack patterns that exploit known weaknesses.MITRE D3FENDKnowledge graph of defensive countermeasures and techniques, mapped to ATT&CK (NSA-funded, maintained by MITRE).SPARTASpace Attack Research and Tactic Analysis (The Aerospace Corporation).ESA Space ShieldEuropean Space Agency space-system threat framework.

EU & Global

NIS2 Directive (EU 2022/2555)Risk management and 24h/72h incident reporting; space sector in scope.EU Space Act (proposal, 25 Jun 2025)Space-specific resilience and cybersecurity obligations; extraterritorial scope.ENISA Space Threat LandscapeEuropean threat landscape and recommendations for space operators.Cyber Resilience Act (CRA)Connected hardware/software requirements; applies from December 2027.

Open-Source Vocabulary & Tooling

METEORSTORM MISP taxonomyThe course vocabulary, live and open source in the MISP taxonomy repository.MISP / CIRCLComputer Incident Response Center Luxembourg, maintainers of MISP.RootAPublic-domain open detection language (YAML) used in Module 04 to write portable signatures. (github.com/UncoderIO/Roota)Uncoder.IOOpen-source IDE and translation engine that ports RootA rules across SIEM, EDR, and XDR formats.SpaceCOP & Indicators of BehaviorDHS S&T + Aerospace Corp. on-board intrusion-detection prototype.CROO (Cyber Resilience On-Orbit)Proof Labs on-board IDS for the Space Force.

Community & Reporting

Space ISACSpace Information Sharing and Analysis Center.Air & Space Forces MagazineWaterman, “New Cybersecurity Rules for Pentagon’s Commercial Satellite Vendors,” Nov 19, 2025.Via Satellite“DHS Wants Satellite Volunteers to Test New Cyber Tools,” Nov 17, 2025.Defense Daily“New National Space Cybersecurity Policy Emphasizes Intrusion Detection,” Nov 18, 2025.Mayer Brown legal analysis“Securing the Final Frontier,” Dec 11, 2025 (US and EU regulatory map).