Incident Handling

Description

a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b. Coordinate incident handling activities with contingency planning activities; c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

Mapped SPARTA techniques

157 techniques

DE-0001 Disable Fault ManagementST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0002 Disrupt or Deceive DownlinkST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0002.01 Inhibit Ground System FunctionalityST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0002.03 Inhibit Spacecraft FunctionalityST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003 On-Board Values ObfuscationST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.01 Vehicle Command Counter (VCC)ST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.02 Rejected Command CounterST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.03 Command Receiver On/Off ModeST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.04 Command Receivers Received Signal StrengthST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.05 Command Receiver Lock ModesST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.06 Telemetry Downlink ModesST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.07 Cryptographic ModesST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.08 Received CommandsST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.09 System Clock for EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.10 GPS EphemerisST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.11 Watchdog Timer (WDT) for EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.12 Poison AI/ML Training for EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0004 MasqueradingST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0005 Subvert Protections via Safe-ModeST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0006 Modify WhitelistST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0007 Evasion via RootkitST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0008 Evasion via BootkitST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0009.04 Targeted Deception of Onboard SSA/SDA SensorsST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0009.05 Corruption or Overload of Ground-Based SDA SystemsST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0010 Overflow Audit LogST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0011 Credentialed EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0001 ReplayST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0001.01 Command PacketsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0001.02 Bus Traffic ReplayST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0002 Position, Navigation, and Timing (PNT) GeofencingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0003 Modify Authentication ProcessST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0005 Exploit Hardware/Firmware CorruptionST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0005.01 Design FlawsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0005.02 Malicious Use of Hardware CommandsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0006 Disable/Bypass EncryptionST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0007 Trigger Single Event UpsetST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0008 Time Synchronized ExecutionST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0008.01 Absolute Time SequencesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0008.02 Relative Time SequencesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0009 Exploit Code FlawsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0009.01 Flight SoftwareST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0009.02 Operating SystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0009.03 Known Vulnerability (COTS/FOSS)ST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010 Malicious CodeST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010.01 RansomwareST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010.02 Wiper MalwareST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010.03 RootkitST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010.04 BootkitST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0011 Exploit Reduced Protections During Safe-ModeST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012 Modify On-Board ValuesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.01 RegistersST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.02 Internal Routing TablesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.03 Memory Write/LoadsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.04 App/Subscriber TablesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.05 Scheduling AlgorithmST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.06 Science/Payload DataST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.07 Propulsion SubsystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.08 Attitude Determination & Control SubsystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.09 Electrical Power SubsystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.10 Command & Data Handling SubsystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.11 Watchdog Timer (WDT)ST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.12 System ClockST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.13 Poison AI/ML Training DataST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0013 FloodingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0013.01 Valid CommandsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0013.02 Erroneous InputST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014 SpoofingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014.01 Time SpoofST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014.02 Bus Traffic SpoofingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014.03 Sensor DataST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014.04 Position, Navigation, and Timing (PNT) SpoofingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0015 Side-Channel AttackST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0016.03 Position, Navigation, and Timing (PNT) JammingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0001 ReplayST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0006 Modify Communications ConfigurationST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0006.01 Software Defined RadioST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0006.02 TransponderST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0007 Compromised Ground SystemST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0008 Compromised Developer SiteST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0009 Compromised Partner SiteST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0002 Compromise Software Defined RadioST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0003 Crosslink via Compromised NeighborST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0004 Secondary/Backup Communication ChannelST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0004.01 Ground StationST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0005.02 Docked Vehicle / OSAMST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0006 Compromise Hosted PayloadST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0007 Compromise Ground SystemST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0007.01 Compromise On-Orbit UpdateST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0007.02 Malicious Commanding via Valid GSST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0008 Rogue External EntityST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0008.01 Rogue Ground StationST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0008.02 Rogue SpacecraftST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0009 Trusted RelationshipST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0009.01 Mission Collaborator (academia, international, etc.)ST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0009.02 VendorST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0009.03 User SegmentST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0010 Unauthorized Access During Safe-ModeST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0011 Auxiliary Device CompromiseST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0012 Assembly, Test, and Launch Operation CompromiseST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0013 Compromise Host SpacecraftST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IMP-0001 Deception (or Misdirection)ST0009
addresses
moderate
IR-4 mitigates IMP-0001 by detecting and responding to deception indicators.
IMP-0002 DisruptionST0009
addresses
moderate
IR-4 mitigates IMP-0002 by detecting and responding to disruption indicators.
IMP-0003 DenialST0009
addresses
moderate
IR-4 mitigates IMP-0003 by detecting and responding to denial indicators.
IMP-0004 DegradationST0009
addresses
moderate
IR-4 mitigates IMP-0004 by detecting and responding to degradation indicators.
IMP-0005 DestructionST0009
addresses
moderate
IR-4 mitigates IMP-0005 by detecting and responding to destruction indicators.
IMP-0006 TheftST0009
addresses
moderate
IR-4 mitigates IMP-0006 by detecting and responding to theft indicators.
LM-0001 Hosted PayloadST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
LM-0002 Exploit Lack of Bus SegregationST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
LM-0003 Constellation Hopping via CrosslinkST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
LM-0004 Visiting Vehicle Interface(s)ST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
LM-0007 Credentialed TraversalST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0001 Memory CompromiseST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0002 BackdoorST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0002.01 Hardware BackdoorST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0002.02 Software BackdoorST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0003 Ground System PresenceST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0004 Replace Cryptographic KeysST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0005 Credentialed PersistenceST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0002 Compromise InfrastructureST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0002.01 Mission-Operated Ground SystemST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0002.02 3rd Party Ground SystemST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0003 Obtain Cyber CapabilitiesST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0003.02 Cryptographic KeysST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0004 Stage CapabilitiesST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0004.01 Identify/Select Delivery MechanismST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0004.02 Upload Exploit/PayloadST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001 Gather Spacecraft Design InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.01 Software DesignST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.02 FirmwareST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.03 Cryptographic AlgorithmsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.04 Data BusST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.05 Thermal Control SystemST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.06 Maneuver & ControlST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.07 PayloadST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.08 PowerST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.09 Fault ManagementST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0002 Gather Spacecraft DescriptorsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0002.01 IdentifiersST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0002.02 OrganizationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0002.03 OperationsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003 Gather Spacecraft Communications InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003.01 Communications EquipmentST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003.02 Commanding DetailsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003.03 Mission-Specific Channel ScanningST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003.04 Valid CredentialsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0004 Gather Launch InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0004.01 Flight TerminationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0006 Gather FSW Development InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0006.01 Development EnvironmentST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0006.02 Security Testing ToolsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0007 Monitor for Safe-Mode IndicatorsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008 Gather Supply Chain InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008.01 Hardware ReconST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008.02 Software ReconST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008.03 Known VulnerabilitiesST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008.04 Business RelationshipsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0009 Gather Mission InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.

Cross-framework references

Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.

Referenced by 24 in NIST Cybersecurity Framework 2.0

Cite as SafeMode Space, nist-80053-rev5 IR-4.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.

# Description

›Mapped SPARTA techniques

157 techniques

›Cross-framework references

Referenced by 24 in NIST Cybersecurity Framework 2.0

Description

Mapped SPARTA techniques

Cross-framework references