Art. 21(2)(b)

Silenced alarms, frozen counters, and desensitised thresholds are the precise targets that hollow out detection; Art. 21(2)(b)'s incident-handling capability must include integrity-of-monitoring controls so disabled FDIR is itself an incident signal.

Telemetry loss or falsification destroys the primary monitoring surface; Art. 21(2)(b)'s incident-handling capability must surface telemetry gaps and content anomalies via heartbeat baselines and cross-source corroboration.

Disabled telemetry software, corrupted processing pipelines, and falsified ground-side displays are paradigmatic incidents the entity's incident-handling capability under Art. 21(2)(b) must detect via integrity-of-monitoring and out-of-band corroboration.

Sustained downlink jamming aligned with monitoring windows is detectable from receive-station telemetry; Art. 21(2)(b)'s incident-handling capability must surface and triage those events.

On-board telemetry suppression — paused publishers, throttled rates, retuned transmitters, beacon-only modes — is detectable via heartbeat baselines and ground cross-source corroboration; Art. 21(2)(b)'s incident-handling capability must surface those signals despite the spacecraft 'continuing to operate'.

Bias of housekeeping counters, frozen severity flags, and reduced/summary telemetry modes that mask activity are the precise integrity failures Art. 21(2)(b)'s incident-handling capability must surface via cross-validation against orthogonal sources.

VCC anomalies (zeroed counts, frozen values, divergence between accepted-command behaviour and reported VCC) are detectable through cross-validation; Art. 21(2)(b)'s incident-handling capability must surface those signals from multi-source command auditing.

Suspiciously flat or cleared rejection-counter telemetry alongside otherwise-active command sessions is a detectable cross-validation anomaly Art. 21(2)(b)'s incident-handling capability must surface.

Receiver toggles aligned with command queues or autonomy windows produce detectable patterns Art. 21(2)(b)'s incident-handling capability must surface, especially when 'transient loss of commandability' coincides with operational anomalies.

Lock-status indicators contradicted by command-acceptance behaviour, or by RF-link telemetry from the ground side, are detectable cross-source anomalies Art. 21(2)(b)'s incident-handling capability must surface.

Sudden shifts to beacon-only modes, deferred playback windows, or redirection of packets to rarely monitored VCIDs are detectable observability anomalies Art. 21(2)(b)'s incident-handling capability must surface.

Log-integrity controls and cross-validation between on-board and ground-side command records are part of incident-handling readiness under Art. 21(2)(b); discrepancies should surface even when the on-board narrative looks plausible.

Time-base discontinuities (clock-register writes, disciplining-source switches, distribution-service offsets) are detectable via multi-source corroboration; Art. 21(2)(b)'s incident-handling capability must surface those anomalies for forensic reconstruction.

Sudden ephemeris jumps without known GPS-handoff context are detectable cross-source anomalies; Art. 21(2)(b)'s incident-handling capability must surface those signals to flag GPS-spoofing-driven evasion.

Disabled or redirected watchdog supervision, suspiciously long task runs, or rhythmic resets aligned with operational events are detectable patterns Art. 21(2)(b)'s incident-handling capability must surface.

Origin-attribution mismatches (VCID/APID/source-sequence-count anomalies, unexpected facility identifiers, station-fingerprint deviations) are detectable; Art. 21(2)(b)'s incident-handling capability must surface those signals from cross-source authentication telemetry.

Runtime concealment subverts the very mechanisms incident-handling depends on; Art. 21(2)(b)'s capability must include integrity-of-monitoring controls and out-of-band attestation that survive in-host hooks on telemetry, queues, and event paths.

On-board SSA/SDA fusion anomalies (centroiding inconsistencies, transponder-reply gaps, RCS misclassifications) are detectable via multi-source cross-correlation; Art. 21(2)(b)'s incident-handling capability must surface those proximity-awareness signals.

Saturated ingestion, falsified TLE updates, and adversarial-input floods on terrestrial SDA pipelines are detectable as integrity incidents Art. 21(2)(b)'s incident-handling capability must surface across the SDA monitoring surface.

Buffer rollover bursts of benign-but-high-frequency events aligned with downlink gaps are detectable log-integrity signals; Art. 21(2)(b)'s incident-handling capability must include log-volume baselines and ground-side ring-buffer cross-checks.

Coordinated-implant detection via cross-component behavioural baselines (shared-resource writes, trigger-action correlation, mission-state-keyed activations) is part of Art. 21(2)(b)'s incident-handling capability — log analysis on a single module is insufficient.

Repeated/duplicate frames, queue-saturating streams, and unexplained mode changes are observable replay artefacts the entity's incident-handling capability under Art. 21(2)(b) must surface from baseline command volumes.

Streams of valid-but-stale commands congesting queues or triggering nuisance FDIR are detectable as incidents the entity's incident-handling capability under Art. 21(2)(b) must address.

Bus-traffic anomalies — duplicate frames, rate-cap exhaustion, watchdog-reset misalignment — are detectable as incidents the entity's incident-handling capability under Art. 21(2)(b) must surface from internal-bus telemetry.

Hardware-command sequences producing physical or electrical anomalies (over-driven mechanisms, altered calibration, disabled watchdogs) are detectable as incidents the entity's incident-handling capability under Art. 21(2)(b) must surface via subsystem telemetry.

Implanted code activating under specific commands, modes, or environmental triggers is a paradigmatic incident; Art. 21(2)(b)'s incident-handling capability must surface activation events even when their triggers blend with routine autonomy.

Encryption of mission data or critical configuration that prevents nominal operations is a paradigmatic incident the entity's incident-handling capability under Art. 21(2)(b) must triage, contain, and restore from.

Wiper deployment is a destruction-class incident; Art. 21(2)(b)'s incident-handling capability must trigger fast detection (downlinks-as-noise, FDIR-into-safing patterns) and forensic preservation despite cascading subsystem effects.

Rootkits subvert the very mechanisms incident-handling depends on (telemetry, event logs, scheduler views, sensor reports); Art. 21(2)(b)'s incident-handling capability must include integrity-of-monitoring controls and out-of-band attestation that survive in-host concealment.

Silent value modification (mode-logic edits, FDIR-rule rewrites, ephemeris drift) is detectable via configuration-integrity baselines; Art. 21(2)(b)'s incident-handling capability must surface those signals despite the absence of obvious protocol anomalies.

Silent rerouting (commands misdelivered, telemetry blackholed, handler swaps) produces subtle traffic-pattern anomalies; Art. 21(2)(b)'s incident-handling capability must surface them via routing-integrity baselines.

Propellant waste, orbit-maintenance bias, repeated wheel unloads, and unexpected venting/lockouts are detectable from subsystem telemetry; Art. 21(2)(b)'s incident-handling capability must surface those propulsion anomalies.

Pointing-anomalies, frequent star-tracker dropouts, unexplained sun-point entries, and limit-cycle behaviour are detectable from ADCS telemetry; Art. 21(2)(b)'s incident-handling capability must surface those signals.

Brownouts, repeated safing, premature capacity loss, and load-oscillation patterns are detectable EPS anomalies; Art. 21(2)(b)'s incident-handling capability must surface them from housekeeping telemetry.

Telemetry suppression, command queue manipulation, and silent housekeeping repackaging are detectable as integrity incidents; Art. 21(2)(b)'s incident-handling capability must surface them via configuration-integrity baselines.

Runaway tasks, repeated resets at tactically chosen moments, and disabled watchdogs are detectable patterns; Art. 21(2)(b)'s incident-handling capability must surface those WDT-state anomalies.

Excess traffic at any layer (RF/optical, link, application, internal-bus) producing dropped commands, lost telemetry, missed windows, and FDIR entries is a paradigmatic incident the entity's incident-handling capability under Art. 21(2)(b) must detect, contain, and document.

Streams of valid-but-volume-anomalous commands (no-ops, telemetry requests, repeated state reports) are detectable as incidents the entity's incident-handling capability under Art. 21(2)(b) must surface from baseline command-volume monitoring.

Volumetric invalid activity engaging front-ends and parsers (BER spikes, repeated acquisitions, error-log floods, retransmission storms) is detectable; Art. 21(2)(b)'s incident-handling capability must surface those signals.

Spoofed-input artefacts (estimator drift, unscheduled mode transitions, off-axis actuator commands) are detectable through cross-source-fusion and behavioural-anomaly monitoring the entity's incident-handling capability under Art. 21(2)(b) must operate.

Bus anomalies (silent configuration drift, control-loops chasing phantom stimuli, cross-domain propagation through gateways) are detectable via integrity monitoring; Art. 21(2)(b)'s incident-handling capability must surface them despite protocol-conformant traffic.

Sensor-derived state inconsistencies (estimator divergence, abrupt mode transitions, contradictions between fused sources) are detectable via cross-correlation; Art. 21(2)(b)'s incident-handling capability must surface those anomalies even when individual readings pass sanity checks.

PNT-solution discontinuities and inconsistencies between GNSS-derived and propagated-ephemeris position are detectable via fusion-anomaly monitoring; Art. 21(2)(b)'s incident-handling capability must surface them despite individual signals passing validity checks.

Jamming events — link Eb/N₀ collapse, sustained BER elevation, partial-pass loss — are detectable from RF-link telemetry; Art. 21(2)(b)'s incident-handling capability must triage and document those signals (intentional vs accidental).

Uplink Eb/N₀ collapse during specific pass windows is a detectable incident; Art. 21(2)(b)'s incident-handling capability must triage uplink-jamming patterns and coordinate response.

Downlink degradation localised to specific terminal geometries is a detectable incident; Art. 21(2)(b)'s incident-handling capability must surface and triage user-side jamming reports.

GNSS unavailability or PNT-solution degradation aligned with attacker geometry is a detectable incident; Art. 21(2)(b)'s incident-handling capability must surface those signals from receiver telemetry.

Repeated playback patterns, off-cadence recorder dumps, and subscription/rate-change reissues that align with non-mission ground geometry are detectable behavioural anomalies; Art. 21(2)(b)'s incident-handling capability must surface them.

Sparsely supervised secondary links are exactly the surface incident-handling capability must extend to — anomalous traffic on rekey/beacon/contingency channels is an incident even when primary TT&C looks normal; Art. 21(2)(b)'s obligation is to surface those signals.

Spacecraft emissions on configurations the program does not expect — covert sidebands, off-pointed auxiliary downlinks, redirected virtual channels — are detectable incidents Art. 21(2)(b)'s incident-handling capability must surface via spectrum monitoring and configuration-integrity baselines.

An adversary residing in mission ground infrastructure and siphoning data at scale is a significant compromise the entity's incident-handling capability under Art. 21(2)(b) must detect via DLP, exfil-volume baselines, and unscheduled-export alerts.

Anomalous crosslink traffic — control messages, malformed service advertisements, payload tasking from a 'trusted' neighbor — is exactly what the entity's incident-handling capability under Art. 21(2)(b) must detect via crosslink behavioural baselines.

Sparsely supervised secondary paths producing unexpected commanding traffic during failover or maintenance windows are detectable incidents; Art. 21(2)(b)'s incident-handling capability must extend monitoring across all paths, not just the primary.

Anomalous file transfers, firmware loads, or table edits crossing the docking interface during a maintenance window are detectable incidents the entity's incident-handling capability under Art. 21(2)(b) must surface from cross-vehicle audit trails.

Adversary residency in the ground segment — preparing on-orbit updates, queueing crafted telecommands, manipulating counters — is a paradigmatic incident the entity's incident-handling capability under Art. 21(2)(b) must detect, contain, and document.

Inserted procedures into existing timelines, modified rate/size limits, and queued commands transmitted from approved apertures — even when each frame is technically valid — are the misuse-of-legitimate-authority pattern Art. 21(2)(b)'s incident-handling capability must detect via behavioural baselines.

Sensor anomalies, mode transitions, and accepted spoofed traffic following a counterspace event are observable incident signals the entity's incident-handling capability under Art. 21(2)(b) must correlate.

Falsified telemetry, mimicked TTPs, and compromised allied infrastructure used to mislead operators are textbook scenarios the entity's incident-handling capability under Art. 21(2)(b) must detect via cross-validation of evidence, indicators of compromise, and chain-of-custody discipline.

Temporary communications impairment during operationally critical windows is a paradigmatic incident the entity's incident-handling capability under Art. 21(2)(b) is designed to detect and respond to, including the data-modification variants distinct from outright denial.

Outright denial of service to ground controllers (resource exhaustion, subsystem degradation, full communications block) is the canonical availability incident incident-handling under Art. 21(2)(b) covers.

Permanent impairment of subsystems or the hosted payload is a significant compromise the entity's incident-handling capability under Art. 21(2)(b) must triage and document, including assessment of mission-lifespan impact.

Destruction of data, commands, subsystems, or the spacecraft itself is the most severe incident class the entity must handle through its incident-handling capability under Art. 21(2)(b), including post-incident analysis and lessons-learned distribution.

Confirmed exfiltration of mission-critical data is a significant incident the entity's incident-handling capability under Art. 21(2)(b) must detect (anomalous downlinks, unscheduled playbacks) and contain.

Anomalous crosslink traffic patterns (tasking from unexpected geometries, off-cadence service advertisements, spreading file transfers) are detectable; Art. 21(2)(b)'s incident-handling capability must surface those signals across the constellation.

Anomalous file transfers, firmware loads, or table edits 'just after dock' that fall outside expected commissioning sequences are detectable; Art. 21(2)(b)'s incident-handling capability must surface those signals from cross-vehicle audit trails.

Persistence artefacts (auto-run hooks, modified init scripts, altered file catalogs reasserting after resets) are detectable via configuration-integrity baselines; Art. 21(2)(b)'s incident-handling capability must surface them across the post-incident lifecycle.

Backdoor activations — magic opcodes, special timetags, embedded-pattern triggers — are detectable via behavioural and origin-diversity baselines; Art. 21(2)(b)'s incident-handling capability must surface those signals despite the attacker's preference for blending with nominal operations.

Adversary residency in operator workstations, mission control software, schedulers, automation, IdPs, and cloud-hosted mission services is an ongoing high-severity incident; Art. 21(2)(b)'s incident-handling capability must detect, contain, document, and remediate that footprint.

Adversary residency in mission, third-party, or shared infrastructure is a paradigmatic incident the entity's incident-handling capability under Art. 21(2)(b) must detect, contain, and document — including pre-positioned tools and suppressed logging.

Adversary control of the entity's own ground system — operator workstations, MCC, schedulers, key-loading tools — is a high-severity incident the entity's incident-handling capability under Art. 21(2)(b) must detect via pre-positioned-tooling, log-suppression, and procedure-tampering signals.

Pre-positioned binaries, malicious tables, and operator macros staged inside the entity's automation repos, scheduler queues, or ground-station file drops are detectable artefacts the entity's incident-handling capability under Art. 21(2)(b) must surface — including via anti-forensics-resistant logging.

Active probes that elicit auto-track responses, ranging tones, or AGC reactions are observable anomalies the entity's incident-handling capability under Art. 21(2)(b) must surface via spectrum-monitoring and baseline deviation detection.