Most of this order is about federal software, cloud, and identity. One subsection is about you. Section 3(e) tells the Department of the Interior, the Department of Commerce, and NASA to review civil space contract requirements and recommend new cybersecurity language for the Federal Acquisition Regulation, on a risk-based, tiered approach, for all new civil space systems. Those requirements shall be designed to apply at minimum to the on-orbit segments and the link segments. That is Kestrel Orbital’s spacecraft and the radio path to them.

The four command-and-control requirements

Section 3(e)(i) directs that the recommended requirements address, for the highest-risk tier and as appropriate other tiers, protection of command and control of the civil space system, including backup or failover systems, by:

The two further requirements

• 3(e)(i)(B) establishment of methods to detect, report, and recover from anomalous network or system activity.
• 3(e)(i)(C) use of secure software and hardware development practices, consistent with the NIST SSDF or any successor documents.

Why this reaches a commercial operator

The order does not regulate Kestrel Orbital directly. It directs agencies to put these requirements into contract language, and the tier a system falls in decides how much applies. An operator that wants civil space work meets them through the contract. That is why SCOR treats the four command-and-control items as a floor and not a ceiling, and why every one of them has to be evidenced against a named part of the platform rather than asserted.

NIS2 names Space in Annex I, Sectors of High Criticality, entry 11. The entity type it describes is precise: operators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks. NIS2 is a Directive, so it does not bind an operator by itself: it obliges Member States to impose these duties in national law, and the duty reaches an operator through the transposing statute of the state it operates in. It is the ground segment that carries it, not the spacecraft. For Kestrel Orbital that is the Reston mission-operations enclave, SEG:GR:Ground:00, and the Kiruna TT&C ground-station enclave, SEG:GR:Ground:01.

Article 21(2), the ten measures

Article 21(1) requires appropriate and proportionate technical, operational and organisational measures. Article 21(2) sets the floor, on an all-hazards approach, and it must include at least these ten.

Article 23, the reporting clocks

A significant incident, defined at Article 23(3) as one that has caused or is capable of causing severe operational disruption or financial loss, or has affected or is capable of affecting others through considerable damage, starts a fixed sequence from the moment you become aware of it.

Why the 72-hour clock decides your data model

At 72 hours you owe indicators of compromise where you have them. An indicator you cannot attach to a named part of your platform is an indicator you cannot assess for severity or cross-border impact, and the clock does not pause while you work out what it touched. This is why the Concept of Operations comes first. The decomposition is what makes the 72-hour notification answerable.

This one is Kestrel Orbital’s own, and it is the only one of the three the company wrote for itself. It exists because sector sharing does not happen by good intentions. The memorandum states the reason plainly: a threat, an attack path, or a detection that one operator confirms becomes usable to the rest of us before it arrives. It then removes the ambiguity that stops sharing in practice, by naming exactly what may cross the channel.

What it directs

• Three co-equal mandates, Section 1.1. The order, the directive, and this exchange mandate carry equal weight. Section 4 states that none is subordinate to the other two.
• Every element carries its identifier, Section 3.1. Its METEORSTORM tag and, where it names a specific instance on the platform, its ETEN identifier and parent chain, so a record means the same thing on both ends.
• Machine to machine, Section 3.2. Structured records over the agreed Space ISAC interface, not free-text email or ad hoc attachments.
• Scoped, not open-ended, Section 3.3. A redacted alert on a confirmed command-and-control attack under Executive Order 14144, and incident records consistent with the thresholds and clocks the NIS2 Directive sets.
• Redaction is mandatory, Section 3.4. Mission-sensitive detail, customer identity, and any content restricted under ITAR or EAR is removed or withheld.
• Reciprocal, Section 3.5. Elements received from Space ISAC in the same vocabulary are ingested into the shared platform view and routed to the department that owns the affected element.

The six approved element types, Section 2

Nothing outside this schedule crosses without a further written directive. The definitions are the published METEORSTORM analytic-layer text, and Section 2 forbids rewording, shortening, or paraphrasing them in an exchanged record, so they appear here as written.

What it puts on you

Section 4 gives SCOR the vocabulary, the interface, and the redaction standard, and the job of training Security Operations, Satellite Operations, and Satellite Design and Engineering to produce and consume these elements as one system. It also states the line all five modules run on: the work done for the first two mandates is the work that feeds the third. You do not build a separate sharing program. You share what the five functions already produced.

The three mandates make one operator harder to attack. This is how an entire sector does, and it is the reason the vocabulary matters as much as the findings. Space ISAC’s stated mission is to collectively protect global space systems to secure the future of humanity and to be the primary communications channel for the global space community. It was conceived in 2017 by the Science and Technology Partnership Forum to address information-sharing gaps in the cybersecurity and space community, presented at the 34th Space Symposium in April 2018, and established a year later.

Why collective defense is the point, not a benefit

An adversary that develops a technique against one operator’s ground segment can use it against every operator whose ground segment looks the same, and most of them do. The asymmetry is structural: the attacker builds once and reuses, while each defensive cyber operator discovers alone. Sector sharing inverts it. A confirmed threat, attack path, or detection signature crossing the channel means the second operator to be targeted is the first one already prepared.

That only works if the finding survives the trip. A detection written against “the ground station” tells another operator nothing they can act on, because their ground station is not yours. A detection anchored to an enumerated element, with its parent chain, tells them exactly which part of their own platform to look at. This is why the memorandum insists on the published definitions and the ETEN identifier. The vocabulary is what makes collective defense mechanical rather than aspirational.

What membership provides

From the Space ISAC membership materials in your reference pack. Benefits are tiered, so what any operator gets depends on the level it holds.

• Information Sharing Portal accounts receiving Watch Center alerts. Fifteen at Platinum, five at Gold, two at Silver, one at University and Laboratory.
• Actionable space-related threat intelligence and vulnerability disclosures, thought leadership, and a voice at the table with the public and private sector.
• Unlimited participation in collaborative groups, and access to critical industry reports and whitepapers. Below Gold this excludes the Analyst Working Group.
• The opportunity to pitch a project to the Cyber Vulnerability Lab Committee, four times a year at Platinum down to once at Small Business.
• Placing analysts in the Watch Center, virtual or in person. This is a Platinum benefit. University and Laboratory members get priority access to apply for open Fellow positions instead.

Your part in it

Kestrel Orbital’s commitment is membership and a machine-to-machine connection, contributing and consuming, redacted and policy-gated. The company runs a MISP instance, the same platform that publishes the meteorstorm taxonomy you tag against from Module 02 onward, and that instance is what carries the exchange. The memorandum sets the form at Section 3.2: structured records over the agreed Space ISAC interface, not free-text email or ad hoc attachments. What you build across the five modules is what fills that channel, and it is portable to it by construction, because it was written in a published vocabulary from the start rather than translated into one afterwards.