Theft

Strict authentication and access-management mechanisms restrict who can access the data stores and downlink channels theft would target — within (2)(d)'s appropriate-control-mechanisms scope.

Stealing the data the spacecraft gathers, processes, and sends is the canonical confidentiality breach (2)(e) requires the product to protect against via state-of-the-art encryption at rest and in transit.

Theft severe-incident notification (primary mapping: Art. 14(3)) follows the format and procedures specified by (14)(10)'s implementing acts.

Theft of mission-critical data affects confidentiality of important data — meeting the 14(5)(a) severe-incident threshold and triggering the manufacturer's 14(3) notification obligations.

Theft severe-incident notification (primary mapping: Art. 14(3)) cascades to (14)(4)'s timing schedule for the confidentiality-impact case.

Theft severe incidents (primary mapping: Art. 14(3)) may justify delayed dissemination to avoid further compromise of stolen-data scope or to coordinate with law enforcement; (14)(9) governs.

Art. 80(3)'s information categorization is domain-relevant to theft (it drives encryption policy), but categorization itself does not interdict the exfiltration.

Strict authentication and access-management mechanisms under 81(1) restrict who can access data stores and downlink channels theft would target.

Theft-impact (primary: Art. 81(1)) is mitigated by 81(4)'s credential audit and revocation lifecycle that limits the population that can access the data stores theft targets.

Stealing mission-critical data is the canonical confidentiality breach 85(1)'s cryptographic concept addresses — encryption at rest and in transit limits exfiltration value.

Theft significant-incident reporting (primary: Art. 93(6)) cascades to 93(3) — confidentiality-affecting incidents under NIS2 essential-entity status route via CSIRTs.

Theft reporting (primary: Art. 93(6)) relates to 93(4) — confidentiality-affecting incidents trigger NIS2 Art. 23 in parallel.

Theft of mission-critical data can cause considerable damage to natural or legal persons (93(6)(b)) and may also disrupt the affected service — triggering 93(1)/(2) reporting.

Theft reporting (primary: Art. 93(6)) cascades to 93(7) — confidentiality-impacting incidents follow the 12h/24h/72h timing schedule.

Theft reporting (primary: Art. 93(6)) relates to 93(8) — implementing-acts on content/templates govern theft-incident report formats.

Confirmed exfiltration of mission-critical data is a significant incident the entity's incident-handling capability under Art. 21(2)(b) must detect (anomalous downlinks, unscheduled playbacks) and contain.

Art. 21(2)(h) requires cryptography and, where appropriate, encryption policies covering payload and mission data; it addresses theft of mission data by mandating encryption in transit and at rest, while the deployed confidentiality controls, not the policy obligation, are what actually deny the adversary the content.

Mission-critical data is an asset whose access must be governed by access-control policies and asset-management discipline under Art. 21(2)(i); least-privilege role design constrains who can stage exfiltration.

Theft of mission-critical data affects natural or legal persons who depend on those products and meets the Art. 23(3)(b) significance criterion; Art. 23(1) notification is triggered.

Primary mapping to Art. 23(1) treats theft of mission data as a significant incident. Art. 23(2) timing applies once Art. 23(1) is triggered.

Primary mapping to Art. 23(1) treats theft as significant. Art. 23(3) significance test is met by the financial-loss criterion (commercial mission data) and frequently the cross-border criterion (constellation data routinely covers multi-Member-State customers).

Primary mapping to Art. 23(1) drives Art. 23(4) deadlines. Theft is often detected via downstream IOC matches; awareness can lag exfil by significant time.

Access-rights provisioning bounds the population that can read or copy mission-critical datasets; over-broad access is the leverage data-theft attacks exploit.

Mission data is the principal target of theft attacks; the asset-classification obligation is the foundational control that drives the encryption, access and storage controls determining whether theft is feasible at all.

Asset-handling policy covers the entire life cycle of mission data (acquisition, use, storage, transportation, disposal); strict handling discipline is the operational lever that resists theft along every stage of the data-distribution chain.

Network-security obligations cover the protection of mission data in transit (encryption, integrity, egress monitoring), reducing the value of intercepted or exfiltrated traffic offline.

Communications security with confidentiality preservation during transmission directly defeats interception of mission-critical data on the downlink path.

Data encryption per availability/integrity/confidentiality requirements covers the mission-critical payload data IMP-0006 attempts to steal.

Information classification and labelling governs the protection requirements and acceptable use of the mission-critical data IMP-0006 targets, establishing handling rules rather than actively preventing exfiltration.

DLP solutions safeguarding information assets from unauthorised access and disclosure are the named control against bulk theft of mission-critical data.

Derived by composition, not from a source that names this pair. D3FEND publishes that Content Filtering counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Content Modification counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Content Quarantine counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Client-server Payload Profiling counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Decoy File counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that File Encryption counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Local File Permissions counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Network Traffic Community Deviation counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Network Traffic Filtering counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Network Traffic Signature Analysis counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Per Host Download-Upload Ratio Analysis counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Remote File Access Mediation counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

MITRE Enterprise has no impact-tactic data-theft technique; the theft outcome is captured through the exfiltration mechanism (T1041 Exfiltration Over C2 Channel and related). T1041 covers data theft via the legitimate C2 channel — the primary mechanism for SPARTA IMP-0006 'Theft' (steal mission-critical data via spacecraft downlink). Cross-tactic moderate (exfiltration vs impact) honors MITRE's separation of exfil-mechanism from impact-outcome where SPARTA combines them.

T0882 'Theft of Operational Information' is in MITRE ICS impact tactic and addresses adversary theft of operational information from production environments — exact title-and-concept match for SPARTA IMP-0006 'Theft' (steal mission-critical data). Tactic and activity align directly. Notable: this is a tactic-aligned high anchor in MITRE ICS where MITRE Enterprise had cross-tactic moderate to T1041 — ICS uniquely models data theft as an impact-tactic outcome rather than separating it from the exfiltration mechanism.

AC-23 mitigates IMP-0006 by limiting bulk extraction that data-mining-style theft requires.

AC-3 mitigates IMP-0006 by enforcing access authorization on data stores theft would target.

AC-4 mitigates IMP-0006 by constraining information flow that theft would otherwise traverse.

AU-12 addresses audit-record generation on data access whose review surfaces theft attempts.

IR-4 mitigates IMP-0006 by detecting and responding to theft indicators.

SC-13 mitigates IMP-0006 by mandating cryptographic protection on stolen-while-encrypted data so theft yields ciphertext.

SC-8 mitigates IMP-0006 by protecting data confidentiality on transmission paths theft uses.

SC-8(1) mitigates IMP-0006 by ensuring transmission cryptographic protection.

T2018 'Data from link eavesdropping' covers collecting data transmitted over channels — direct match to IMP-0006's theft of mission-critical data being gathered, processed, and sent from the victim spacecraft.

T2022 'Exfiltration Over TM Channel' covers malicious software using the TM channel to exfiltrate data — addresses IMP-0006's theft outcome where stolen mission data exits via the TM downlink path.