Value chain · CLM-0764
In plain terms
A 2020 US presidential directive sets out what good cyber security for satellites looks like, including making sure a satellite only obeys commands from an authorised sender, but it says agencies and operators "should" do these things and states in its own text that it creates no legally enforceable obligation.
The claim as recorded
US Space Policy Directive-5 of 4 September 2020 defines Positive Control as the assurance that a space vehicle will only execute commands transmitted by an authorised source and that those commands are executed in the proper order and at the intended time, and its section 4 principles ask that owners and operators consider, based on risk assessment and tolerance, protection against unauthorised access to critical space vehicle functions including safeguarding command, control and telemetry links using effective and validated authentication or encryption measures, physical protection of command and telemetry receiver systems, protection against communications jamming and spoofing, protection of ground systems aligned with the NIST Cybersecurity Framework, cyber hygiene and intrusion detection, and supply chain risk management; every one of those principles is expressed as "should" rather than "shall", the memorandum is addressed to executive departments and agencies, and its own general provisions state that it is not intended to and does not create any right or benefit, substantive or procedural, enforceable at law or in equity by any party.
Scope and limits
Material if this feeds a compliance argument: SPD-5 directs agencies to foster practices and asks operators to consider measures. It does not bind any operator, it creates no enforceable obligation by its own terms, and it may NOT be cited as a requirement that an SBSP system authenticate its command link. It is a US instrument only and says nothing about UK, EU or any other jurisdiction. It is dated September 2020 and no check was made for superseding or implementing US instruments, so it may not be presented as the current state of US space cyber policy. It sets no technical threshold: "effective and validated" authentication is not defined and no standard is named except the NIST Cybersecurity Framework for ground systems.
What it assumes
No assumptions are recorded against this claim.
Where it comes from
Definition, SRC-234 at 85 FR 56157, verbatim: "'Positive Control' means the assurance that a space vehicle will only execute commands transmitted by an authorized source and that those commands are executed in the proper order and at the intended time." Principles, same page, verbatim: "Protection against unauthorized access to critical space vehicle functions. This should include safeguarding command, control, and telemetry links using effective and validated authentication or encryption measures designed to remain secure against existing and anticipated threats during the entire mission lifetime". Verbatim: "Protection against communications jamming and spoofing, such as signal strength monitoring programs, secured transmitters and receivers, authentication, or effective, validated, and tested encryption measures designed to provide security against existing and anticipated threats during the entire mission lifetime". Framing, same page, verbatim: "At a minimum, space system owners and operators should consider, based on risk assessment and tolerance, incorporating in their plans". Non-enforceability, SRC-234 at 85 FR 56158, verbatim: "This memorandum is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person."
Basis: normative force of the instrument; modal verb usage in section 4
Related records
- Answers question
- QST-011 not published in this release
Cite this
energyaperture.com/c/clm-0764
CLM-0764, Energy Aperture, as of 2020-09-04.