Kestrel Orbital Day-1 CONOPS

ETEN Example

Layer

PCE

Tag

TE

Label

Terrestrial

Ordinal

00

Description

Reston, Virginia land site hosting the primary mission-operations complex, its control facilities, and the network operations center.

ETEN Process

Step 01

Set the scope, from the resilience objective and the requirements that drive the decomposition; an element outside the scope is not enumerated. Kestrel’s scope is the telecommand path.

Step 02

Select the layer, working top down through the taxonomy’s structural layers, and confirm the element passes that layer’s definition gate before proceeding. The gates are the taxonomy’s layer definitions, verbatim:

• PCEPrimary Capability Environment. “Operational zone in which a capability primarily exists or is exercised.” The gate: you are naming a WHERE, a zone, not a thing in it.
• SEGSegment. “Service and asset enclaves that compose the system across environments.” The gate: you are naming an ENCLAVE, a grouping of services and assets, not the zone it sits in and not the hardware inside it.
• SVCService. “Functional planes that organize control and data responsibilities.” The gate: you are naming a functional RESPONSIBILITY, what the platform does, not what it is built from.
• ASTAsset. “Asset classes composing the system and its interfaces.” The gate: you are naming a CONCRETE ELEMENT, a real component the platform is built from.

Tiebreak for the recurring trap: PCE and SEG share tag names (Orbital and Space, Aquatic, Deep Space) but are different things. Ask: am I naming a zone, or a group of services and assets? Zone means PCE; group means SEG. An element that fails its layer’s gate is not enumerated at that layer; reclassify and re-enter at Step 02. Enrichment (AN) follows in Functions 02 through 05.

Step 03

Select the tag from the taxonomy for that layer; never invent one.

Step 04

Write the label exactly as the taxonomy publishes it for that tag.

Step 05

Assign the ordinal, two digits from 00, counted per tag.

Step 06

Link the parent one layer up. This link is the ontology: every child names its parent, PCE is the root, and no element is an orphan. The parent chain enforces the layer gates structurally: a segment names one or more environments, a service names one or more segments, and an asset names exactly one service, never zero, never two. An enrichment element takes no parent; it anchors through its target field.

Step 07

Set the optional fields: a service marks DISTRIBUTED when it spans more than one segment; an asset may carry a SUBSYSTEM grouping; an enrichment element carries its TARGET and SOURCE.

Step 08

Write the description, one plain sentence stating what this exact instance is on this platform, at its own layer: a zone for an environment, an enclave of services and assets for a segment, a responsibility for a service, a concrete element for an asset. The layer gate from Step 02 applies again here: a segment description never describes the hardware inside the enclave; a service description begins “The service that …”; an asset description begins with its element class (“The physical …”, “The embedded …”, “The flight software …”, “The stored …”, “The transmitted …”). An instance described at the wrong layer is non-compliant.

PCE Key Points

Key point

What was missing: security frameworks carried no taxonomy and no ontology for the environment; where a platform operates was prose context, not an element that threats, detections, and resilience measures could anchor to.Recommendation: enumerate every distinct operational zone as its own PCE, one per physical site; a new site is a new ordinal, no restructuring.Kestrel: PCE:TE:Terrestrial:00 Reston, Virginia and PCE:TE:Terrestrial:01 Kiruna, Sweden, so enrichment lands at the location level (terrestrial weather over the site, possible positioning of mobile electronic-warfare apparatus near it) while the set of environments preserves the global view.

Key point

What was missing: aerial, aquatic, orbital, and deep space were one undifferentiated environment, so there was no way to enrich by taxonomy and ontology for space domain awareness.Recommendation: one PCE per orbital regime, never a generic orbital; the taxonomy already carries Terrestrial, Aquatic, Aerial, Orbital, and Deep Space, so the model extends without change.Kestrel: the fleet spans two regimes, so it carries two orbital environments, PCE:OR:Orbital:00 GEO and PCE:OR:Orbital:01 MEO, aligning space-weather enumeration to each regime.

Key point

What was missing: a rule for whether a fleet spanning two regimes needs its inventory split per regime or shared across them.Recommendation: enumerate the environments separately, share one segment and one service and asset set while the workload supports it, and let evidence, not habit, decide a future split.Kestrel: two orbital environments, one Space segment: one shared service and asset set sized to current workload; the teams track the SDA (space domain awareness) to measure what is MEO-specific versus GEO-specific, then build the longer-term plan to coordinate enumerating the entire platform.

SEG Key Points

Key point

What was missing: enterprise models carried no enclave that spans environments, so jurisdiction and failover lived outside the model.Recommendation: one segment per enclave of services and assets; each physically or jurisdictionally distinct enclave takes its own ordinal, and a cross-environment segment names every parent.Kestrel: SEG:GR:Ground:00 Reston, Virginia under US authorities, SEG:GR:Ground:01 Kiruna under Sweden and the EU, and the Link naming both the Orbital and Terrestrial environments.

Key point

What was missing: models described the enterprise a company has today, so growth broke them.Recommendation: the segment taxonomy already carries Launch, Link, Ground, User, Aquatic, Low Altitude, High Altitude, Near Space, Space, and Deep Space, so Resilient Cyber Operations is future proof by construction: a merger, an acquisition, or a new market enumerates into existing tags with new ordinals, never a remodel.Kestrel: a downrange tracking ship enumerates as SEG:AQ:Aquatic:00, a stratospheric relay as SEG:NE:Near Space:00, and a cis-lunar mission as SEG:DE:Deep Space:00, the day the business needs them.

SVC Key Points

Key point

What was missing: no plane-level taxonomy: command and mission traffic blurred together, and a cross-segment service was filed in one box, hiding the surface an adversary crosses.Recommendation: classify every service by what actually flows through it, Control Plane, Data Plane, or Hybrid when both, and mark DISTRIBUTED with every parent segment named.Kestrel: SVC:HY:Hybrid:00 C&DH carries commands and mission data, so it is Hybrid by classification, not by guess.

AST Key Points

Key point

What was missing: asset inventories stopped at "the satellite" or "the ground system," and a bundle cannot carry a threat anchor.Recommendation: one asset per concrete element under exactly one parent service, split to the depth you defend; a new asset slots under its service without renumbering.Kestrel: AST:SI:Signal:00 the TC uplink waveform, AST:DA:Data:03 the on-board key store, and AST:FW:Firmware:01 the OBC boot firmware are separate elements, so a threat anchors to the exact asset it exploits, never a bundle.