Skip to content
safemode.space

About SafeMode Space

SafeMode Space maps documented space-cybersecurity techniques to the European rules and the control frameworks that bear on them, so that a specific way of attacking a space system can be followed to the specific provisions and controls that speak to it.

Who maintains this corpus, and what a single maintainer means for what you are reading: further down this page.

The problem

European law now reaches space operators from several directions at once. Network and information security obligations, product requirements for anything with digital elements, and a proposed instrument aimed at space specifically all apply to parts of the same organisation, and each was drafted on its own terms.

The technical side is not short of material either. Adversary technique catalogues, sector threat landscapes and general control catalogues are all published in the open.

What is missing is the join. A provision states a duty in the language of law; a technique catalogue states a behaviour in the language of attack; and no publisher of either is responsible for telling you which one answers the other. So the join gets made privately, again and again, by every operator, consultancy and supervisory body that needs it, and none of those answers can be checked by anyone who did not make it.

What this corpus does

It takes a published catalogue of space-cybersecurity techniques as its spine, and hangs the join off the technique. For each one, the corpus records which provisions of the European instruments relate to it, which of the operational measures ENISA sets out for the sector relate to it, which entries in the general control catalogues relate to it, and which of the catalogue's own countermeasures are paired with it.

Each of those records says where it came from. The ones SafeMode Space adjudicated also carry how strongly the two are related, how confident that reading is, what kind of evidence it rests on, and the reasoning, next to the mapping rather than in a log somewhere else.

The reasoning is the product. A mapping a reader cannot argue with is worth no more than a guess, so the ground each one rests on is published with it and can be held against the source it cites.

It is a set of ordinary pages. There is nothing to sign in to, nothing behind a gate, and every page carries a citation naming the corpus state it was read at.

What it does not do

It does not tell you whether you comply

There is no compliance conclusion anywhere in the corpus. The strongest thing a mapping says is how a provision relates to a technique, which is analysis rather than advice, and it is not a statement of law. What this site is not, in its own terms, is on the disclaimer.

It does not replace the instrument

For any provision, the official published text prevails over anything here. The corpus points at the source and says which edition it read; it is a route into the material and not a substitute for it.

It does not watch anything

Nothing here is live. There is no detection, no feed and no alerting, and the corpus knows nothing about your systems. It is a reference that changes when curation changes it.

It is not finished, and does not pretend to be

Curation runs from the technique side, so coverage is uneven by construction and every instrument has provisions nothing has reached yet. Where that is the case the page says so. How the mappings are made, and where the method stops, is on the methodology page.

Independence, and what threatens it

SafeMode Space maintains a free reference corpus and intends to sell things to organisations that corpus concerns. That is a direct interest in its own adjudications. This section says what the interest is and what keeps it apart from the mappings, limited to mechanisms that exist today and that you can check today.

  • Evidence packs assembled from the mappings in this corpus.
  • A licensed-provider arrangement, letting consultancies deliver those packs under our mark.
  • A commercial licence for embedding the mapping graph in other products.

None of these is on sale as this page is written. There is no price, no order path and no customer.

Why that is a conflict

An organisation that buys any of these has an interest in the adjudications the pack is built from: in which relationship a mapping carries, in how confident it says it is, in the provisions their pack cites staying mapped and the ones it does not cite staying quiet.

A consultancy that has built a client engagement on a mapping has the same interest one step removed.

That interest is not illegitimate. It runs against the only property that makes this corpus worth citing, which is that its adjudications were made without reference to who is paying.

What keeps them apart, and how to check it

Each of these is a property of what is already published. None of them needs anything from us.

  • There is no account system on this reference at all. It is a set of static pages, so there is no server deciding what to show you and no state that could make one reader's view of a mapping differ from another's.

    Check: Read any mapping without signing in, because there is nothing to sign in to. What is gated, and why nothing here is, is set out on the methodology page. methodology page.

  • Every mapping is published with the reasoning that produced it, next to the mapping rather than in a log somewhere else.

    Check: Open any technique and read a row. The relationship, the confidence, the evidence type where one applies, and the reasoning are all on the page, and they cite a source you can obtain yourself.

  • Which mappings SafeMode Space adjudicated and which arrived from a published source catalogue is recorded on each mapping, by whatever wrote it, at the time it was written. It is not inferred afterwards from how the reasoning reads, so rewriting a sentence cannot reclassify a mapping.

    Check: The two groups are rendered apart on every technique page, and the split across the whole corpus is on the methodology page. Most of the corpus by volume is imported. methodology page.

  • Mappings from a technique to a SPARTA countermeasure carry no judgement of ours. The corpus records no relationship, no confidence and no evidence type for them, because SPARTA publishes those pairings without qualifying them and SafeMode Space has not adjudicated them.

    Check: Compare a countermeasure row against a regulation row on the same technique. The fields the second carries and the first does not are the ones that would be ours.

  • What a mapping is allowed to claim is capped by the published methodology rather than decided case by case. A provision can be recorded as interdicting a technique only where the provision mandates, or is, the mechanism that interdicts it; a duty to hold a policy governs a technique without deploying anything that stops it, and is capped below that.

    Check: The worked example on the methodology page takes one mapping apart field by field and says why it carries the weaker relationship even though the provision reaches the technique squarely. Read it, then hold any other mapping to the same standard. methodology page.

  • There is no compliance conclusion anywhere in this corpus, so there is none for a paying organisation to have decided in its favour. The strongest thing a mapping says is how a provision relates to a technique.

    Check: What this site is not, stated in its own terms, is on the disclaimer. disclaimer.

  • A provision or control carrying no mapping is published as not yet reached, never as examined and cleared. Mapping runs from the technique side, so which provisions have been looked at is a byproduct of which techniques were processed.

    Check: Open an entity with no mappings. The page says curation has not reached it and that this is a statement about the corpus rather than about the law.

  • Curation decisions are published one by one, with the date, the pair, what was decided and the ground it rested on.

    Check: The curation decision log, which states its own coverage: it records the decisions SafeMode Space took, and the imported cross-references that make up most of the corpus are not itemised there. curation decision log.

  • The one external review of this corpus is published in full, including where the raters disagreed with the corpus and where they disagreed with each other.

    Check: The validation study, which carries its own competing-interest statement above its findings rather than beneath them. validation study.

What this arrangement does not do

One person maintains this corpus

There is no editorial board and no institution behind the name. A separation of duties between the people who adjudicate mappings and the people who negotiate fees is not available at that size, and it is not claimed here. What replaces it today is that the reasoning for every mapping is published and can be argued with, which moves the question from whether the decider was influenced, which nobody can check, to whether the reasoning holds against the source it cites, which anyone can.

Nothing here proves the absence of a conversation

A request made quietly and declined, and a decision correctly made under a conflict nobody recognised, leave the same trace as no request at all. Everything above makes a bent corpus detectable by someone willing to read the same provisions we did. None of it makes an uninfluenced maintainer provable, and no page can.

Bulk access runs through us; checking one mapping does not

The machine-readable corpus files were withdrawn from public download in August 2026. Every individual mapping stays readable with no account and no gate, so per-mapping checking is unaffected, but reproducing the whole corpus in one step now involves the party being checked. The how-to-cite page holds what changed and what did not.

This page is scoped to what can be checked today. Arrangements that do not exist yet carry no commitments here, because a commitment nobody can test is worth less than saying plainly that there is nothing to test. When there is something to sell there will be more to say, and it will be said here rather than somewhere new.

If you think one of these is not being kept, or that one of them is weaker than it looks, say so. Challenges to this page and corrections to the corpus go to the same address, which is on the methodology page.

Where the rest of this lives

  • How mappings are made, and where the method stops: Methodology.
  • What this site is not, and what it does not warrant: Disclaimer.
  • Who owns the material reproduced here, and on what terms: Attribution.
  • How to cite a mapping and pin it to a version: How to cite.
  • The terms a contribution is made under: Contribution terms.

Corpus 2026.08.24-1, built 2026-08-24 from 226 techniques, 308 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.