Annex 11.7.1

Multi-factor authentication on telemetry-processing servers and operator displays prevents credential-only foothold from converting into the configuration changes that suppress ground-system telemetry rendering.

Multi-factor authentication on commanding paths must remain enforced during safe-mode; relaxation of MFA in contingency operations creates exactly the protection-subversion window this technique exploits.

Multi-factor authentication ensures that even valid credentials require an additional factor; passive credential reuse for evasion is broken by MFA enforcement on commanding paths.

Multi-factor authentication on commanding paths must remain enforced during safe-mode operations; contingency commanding does not justify a relaxed authentication regime under the implementing regulation.

Multi-factor authentication on operator workstations, archive databases and distribution services is the procedural defense that prevents credential-only foothold from converting into bulk-exfiltration access.

Multi-factor authentication is required on commanding paths; backup-ground-station operator stations and contingency commercial-station gateways must enforce MFA at the same strength as the primary site.

Multi-factor authentication on operator workstations and TT&C automation is required by the implementing regulation; it is the procedural defense that prevents a credential foothold from converting into live commanding access.

Multi-factor authentication on commanding consoles is the procedural lever that prevents valid GS infrastructure (already configured for the mission) from being driven by a compromised credential alone.

Multi-factor authentication on vendor remote-administration paths is the procedural defense that prevents a vendor credential leak from converting into operations-affecting access.

Multi-factor authentication on commanding paths must remain enforced during safe-mode operations; emergency commanding does not justify a relaxed authentication regime under the implementing regulation.

Multi-factor authentication on commanding and administrative paths breaks the convertibility of passively reused credentials into cross-boundary traversal.

Multi-factor authentication on operator workstations and TT&C automation breaks the conversion from persistent foothold to live commanding access, even where the attacker has achieved long-lived credential capture.

Multi-factor authentication on accounts that confer commanding access prevents harvested or replayed credentials from yielding live persistence — even a long-lived password is insufficient on its own.

Multi-factor authentication on operator workstations and TT&C automation is the authentication procedure that prevents harvested or replayed credentials from converting into live commanding access.

Multi-factor authentication is the procedural and technical defense that converts credential-reconnaissance success into a still-blocked authentication attempt.