safemode.space
← All techniques
LM-0003
ST0007Lateral Movement

Constellation Hopping via Crosslink

Description

In networks where vehicles exchange data over inter-satellite links, a compromise on one spacecraft becomes a springboard to others. The attacker crafts crosslink traffic, routing updates, service advertisements, time/ephemeris distribution, file or tasking messages, that appears to originate from a trusted neighbor and targets gateway functions that bridge crosslink traffic into command/data paths. Once accepted, those messages can queue procedures, deliver configuration/table edits, or open file transfer sessions on adjacent vehicles. In mesh or hub-and-spoke constellations, this enables “hop-by-hop” spread: a single foothold uses shared trust and protocol uniformity to reach additional satellites without contacting the ground segment.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(d)
    addresses
    high
    direct

    Crafted crosslink traffic that 'appears to originate from a trusted neighbor' is the canonical authentication-bypass scenario (2)(d) requires the product's access-management to resist on inter-satellite links.

  • craAnnex I, Part I, (2)(f)
    addresses
    high
    direct

    Routing updates, service advertisements, and time/ephemeris distribution traversing crosslink are processed data whose integrity (2)(f) requires protection of, including the corruption-reporting requirement.

  • craAnnex I, Part I, (2)(j)
    addresses
    moderate
    direct

    Crosslink gateways into command/data paths are an external-interface attack surface; (2)(j)'s limit-attack-surfaces obligation constrains what the gateway accepts from peers.

  • eu-space-actArt. 84(3)
    addresses
    high
    direct

    Crosslink hopping between vehicles is precisely the only-authorized-devices scenario 84(3) defends — crafted traffic from a compromised neighbor must be filtered.

  • eu-space-actArt. 85(1)
    addresses
    high
    direct

    85(1)'s cryptographic concept must define authentication on inter-satellite links — defeating crafted-traffic-from-trusted-neighbor scenarios.

  • eu-space-actArt. 85(3)
    addresses
    moderate
    direct

    85(3)(a)'s end-to-end-authentication-between-SCC-and-space-segment obligation extends to crosslink-mediated control paths.

  • nis2Art. 21(2)(b)
    addresses
    moderate
    derived

    Anomalous crosslink traffic patterns (tasking from unexpected geometries, off-cadence service advertisements, spreading file transfers) are detectable; Art. 21(2)(b)'s incident-handling capability must surface those signals across the constellation.

  • nis2Art. 21(2)(h)
    addresses
    high
    direct

    Art. 21(2)(h) obliges cryptography policies and procedures covering crosslink authentication and key separation; it addresses constellation hopping by requiring those measures, while the deployed authentication and per-peer keys, not the policy article, are what defeat hop-by-hop spread that relies on appearing to come from a trusted neighbour.

  • nis2Art. 21(2)(i)
    addresses
    moderate
    direct

    Crosslink gateway functions that bridge into command/data paths are access-controlled assets; Art. 21(2)(i)'s access-control + asset-management obligation governs which crosslink message classes can reach which onboard subscribers.

  • nis2Art. 23(1)
    triggers obligation
    moderate
    direct

    Constellation-wide compromise affects services delivered across multiple Member States; the resulting cross-border impact is reportable under Art. 23(1).

  • nis2Art. 23(2)
    addresses
    moderate
    derived

    Primary mapping to Art. 23(1) treats constellation-hopping via crosslink as a significant incident. Art. 23(2) timing applies once Art. 23(1) is triggered.

  • nis2Art. 23(3)
    relates to
    high
    derived

    Primary mapping to Art. 23(1) treats constellation hopping as significant. Art. 23(3) significance is met by the operational-disruption criterion (multiple satellites compromised) and the cross-border criterion (constellation members typically span Member States).

  • nis2Art. 23(4)
    addresses
    moderate
    derived

    Primary mapping to Art. 23(1) drives Art. 23(4) deadlines. Constellation hopping is detected via cross-satellite anomaly correlation, often days after first-asset compromise.

  • nis2-implAnnex 11.6.1
    addresses
    moderate
    derived

    Authentication on crosslink peer exchanges (routing, time, ephemeris distribution) reduces the value of forged inter-satellite traffic to subscribers applying the secure-authentication obligations.

  • nis2-implAnnex 6.7.1
    addresses
    moderate
    derived

    Network-security obligations cover crosslink traffic between satellites; protection of routing updates, service advertisements and inter-vehicle data flows is part of the entity's network-security envelope.

  • nis2-implAnnex 6.8.1
    addresses
    high
    derived

    Segmentation between crosslink-facing functions and bus internals is the architectural defense that bounds how far a compromise on one constellation member can travel via inter-satellite links.

ENISA controls

  • ENISA-STL-2025-03-sD.23-i01
    addresses
    high

    Communications security on inter-satellite links defeats traffic from a compromised neighbor attempting to reach gateway functions on adjacent vehicles.

  • ENISA-STL-2025-03-sD.23-i10
    mitigates
    moderate

    Access-based network segmentation between crosslink and command/data paths limits hop-by-hop spread within a constellation.

  • ENISA-STL-2025-03-sD.23-i11
    addresses
    high

    Cryptography and key management explicitly mandates ISL encryption — the canonical defence against constellation-hopping via crosslink.

  • ENISA-STL-2025-03-sD.26-i06
    mitigates
    high

    Cryptographic bidirectional crosslink authentication rejects routing/time-distribution and tasking messages from an unauthenticated compromised neighbor.

Cross-reference controls

  • ccsds-sdlsCCSDS-355.0-S02Authentication
    addresses
    low

    SDLS authentication rejects forged crosslink messages that merely appear to come from a trusted neighbor, but lateral movement through a genuinely compromised, validly-keyed vehicle is not stopped, so it governs rather than interdicts.

  • csf-2-0DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records LM-0003 against AC-4 Information Flow Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps LM-0003 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0034 Monitor Critical Telemetry Points; CM0036 Session Termination, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

  • csf-2-0PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records LM-0003 against SC-8 Transmission Confidentiality and Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for PR.DS-02. Through SPARTA: SPARTA's catalog maps LM-0003 to countermeasure CM0002 COMSEC; CM0003 TEMPEST; CM0029 TRANSEC, and that countermeasure's own CSF references include PR.DS-02. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.

  • csf-2-0PR.DS-10The confidentiality, integrity, and availability of data-in-use are protected
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records LM-0003 against AC-4 Information Flow Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.DS-10. Through SPARTA: SPARTA's catalog maps LM-0003 to countermeasure CM0003 TEMPEST, and that countermeasure's own CSF references include PR.DS-10. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.DS-10 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

  • csf-2-0PR.IR-01Networks and environments are protected from unauthorized logical access and usage
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records LM-0003 against AC-4 Information Flow Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.IR-01. Through SPARTA: SPARTA's catalog maps LM-0003 to countermeasure CM0055 Secure Command Mode(s), and that countermeasure's own CSF references include PR.IR-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.IR-01 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

  • d3fendD3-APCAApplication Protocol Command Analysis
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Application Protocol Command Analysis counters T1021 Remote Services; SafeMode's curated mapping records LM-0003 as addressing that same adversary behaviour in the space domain. Analysing application-protocol remote commands is directly the telecommand-validation problem: on-board command handlers and the ground command chain both inspect opcode, argument, and sequencing structure before acting. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-PMADProtocol Metadata Anomaly Detection
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1021 Remote Services; SafeMode's curated mapping records LM-0003 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • mitre-attack-enterpriseT1021Remote Services
    addresses
    moderate

    T1021 'Remote Services' is in lateral-movement tactic and addresses lateral movement via legitimate remote-service protocols (RDP, SSH, SMB, etc.); SPARTA LM-0003 covers constellation-hopping via crosslink — using the legitimate inter-satellite-link as the remote service for cross-vehicle lateral movement. Tactic and activity align.

  • mitre-attack-icsT0886Remote Services
    addresses
    high

    T0886 'Remote Services' is in MITRE ICS lateral-movement tactic and addresses lateral movement via legitimate remote-service mechanisms; SPARTA LM-0003 covers constellation-hopping via crosslink — using the legitimate inter-satellite-link as the remote service for cross-vehicle lateral movement. Tactic and activity align directly.

  • nasa-bpgMI-AUTH-01Boundary Protection Function
    addresses
    moderate

    Crosslink hopping crosses a vehicle-to-vehicle boundary rather than an internal subsystem boundary. Mediated access to critical subsystems limits what a compromised neighbour can reach once it is inside, so the practice governs the consequence rather than interdicting the crossing.

  • nist-80053-rev5AC-12Session Termination
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-12(2)Termination Message
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-14Permitted Actions Without Identification or Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17Remote Access
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(1)Monitoring and Control
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(10)Authenticate Remote Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(2)Protection of Confidentiality and Integrity Using Encryption
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(6)Protection of Mechanism Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-18Wireless Access
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-18(1)Authentication and Encryption
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-18(5)Antennas and Transmission Power Levels
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-2(11)Usage Conditions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-2(12)Account Monitoring for Atypical Usage
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3Access Enforcement
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(10)Audited Override of Access Control Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(11)Restrict Access to Specific Information Types
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(2)Dual Authorization
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(3)Mandatory Access Control
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(4)Discretionary Access Control
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(8)Revocation of Access Authorizations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-4Information Flow Enforcement
    mitigates
    high

    AC-4 mitigates LM-0003 by constraining information flow on inter-satellite crosslinks even from compromised peers.

  • nist-80053-rev5AU-14Session Audit
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-2Event Logging
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3Content of Audit Records
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3(1)Additional Audit Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4Audit Log Storage Capacity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4(1)Transfer to Alternate Storage
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5Response to Audit Logging Process Failures
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(2)Real-time Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(5)Alternate Audit Logging Capability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(1)Automated Process Integration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(4)Central Review and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-8Time Stamps
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9Protection of Audit Information
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(2)Store on Separate Physical Systems or Components
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(3)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-3Information Exchange
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-3(7)Transitive Information Exchanges
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-7(6)Automation Support for Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11(3)Automated Enforcement and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3(6)Cryptography Management
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10System Recovery and Reconstitution
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10(4)Restore Within Time Period
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-8Telecommunications Services
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-10Adaptive Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-2Identification and Authentication (Organizational Users)
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-2(8)Access to Accounts — Replay Resistant
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-3Device Identification and Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-3(1)Cryptographic Bidirectional Authentication
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-4Identifier Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-4(9)Attribute Maintenance and Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5Authenticator Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5(6)Protection of Authenticators
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5(7)No Embedded Unencrypted Static Authenticators
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-7Cryptographic Module Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-9Service Identification and Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4Incident Handling
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(11)Integrated Incident Response Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(12)Malicious Code and Forensic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(14)Security Operations Center
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(5)Automatic Disabling of System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5Incident Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5(1)Automated Tracking, Data Collection, and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-19Information Leakage
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-19(1)National Emissions Policies and Procedures
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-21Electromagnetic Pulse Protection
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8Security and Privacy Architectures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8(1)Defense in Depth
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-10Threat Hunting
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3(4)Predictive Cyber Analytics
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-3System Development Life Cycle
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(5)System, Component, and Service Configurations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8Security and Privacy Engineering Principles
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(13)Minimized Security Elements
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(15)Predicate Permission
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(18)Trusted Communications Channels
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(19)Continuous Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(21)Self-analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(22)Accountability and Traceability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(23)Secure Defaults
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(9)Trusted Components
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-9(6)Organization-controlled Cryptographic Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-10Network Disconnect
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12Cryptographic Key Establishment and Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(1)Availability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(2)Symmetric Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(3)Asymmetric Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(6)Physical Control of Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-13Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16Transmission of Security and Privacy Attributes
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(1)Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(2)Anti-spoofing Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(3)Cryptographic Binding
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-23Session Authenticity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-23(1)Invalidate Session Identifiers at Logout
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-23(3)Unique System-generated Session Identifiers
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-28(1)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-28(3)Cryptographic Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-32(1)Separate Physical Domains for Privileged Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-40Wireless Link Protection
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-40(1)Electromagnetic Interference
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-40(3)Imitative or Manipulative Communications Deception
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-40(4)Signal Parameter Identification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5Denial-of-service Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5(3)Detection and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7Boundary Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(10)Prevent Exfiltration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(11)Restrict Incoming Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(18)Fail Secure
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(5)Deny by Default — Allow by Exception
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(9)Restrict Threatening Outgoing Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8Transmission Confidentiality and Integrity
    addresses
    high

    SC-8 protects the confidentiality and integrity of crosslink transmissions against an external attacker, but LM-0003 hops between vehicles using a compromised-but-trusted neighbor whose crafted traffic is cryptographically valid; transmission protection does not stop an authenticated insider from injecting routing, service-advertisement, or tasking messages. The control does not interdict the defining vector, so the relationship is addresses. This applies the same compromised-neighbor reasoning as IA-0003, per Crux D.

  • nist-80053-rev5SC-8(1)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8(3)Cryptographic Protection for Message Externals
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8(4)Conceal or Randomize Communications
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10Information Input Validation
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(3)Predictable Behavior
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(5)Restrict Inputs to Trusted Sources and Approved Formats
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(6)Injection Prevention
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-14(3)Non-persistent Connectivity
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-16Memory Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-17Fail-safe Procedures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-19(4)Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3Malicious Code Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(10)Malicious Code Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(8)Detect Unauthorized Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4System Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(1)System-wide Intrusion Detection System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(10)Visibility of Encrypted Communications
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(11)Analyze Communications Traffic Anomalies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(13)Analyze Traffic and Event Patterns
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(16)Correlate Monitoring Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(17)Integrated Situational Awareness
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(2)Automated Tools and Mechanisms for Real-time Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(23)Host-based Devices
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(24)Indicators of Compromise
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(25)Optimize Network Traffic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(4)Inbound and Outbound Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(5)System-generated Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(7)Automated Response to Suspicious Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-6Security and Privacy Function Verification
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(17)Runtime Application Self-protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(6)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(8)Auditing Capability for Significant Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • space-shieldT2039.003Interconnected spacecrafts
    addresses
    high

    T2039.003 'Interconnected spacecrafts' covers leveraging interconnections between spacecraft to compromise targets — direct match to LM-0003's hop-by-hop spread through mesh/hub-and-spoke constellation crosslinks.

  • space-shieldT2048TT&C over ISL
    addresses
    high

    T2048 'TT&C over ISL' is the direct cross-framework counterpart of LM-0003 — both describe issuing commands to other spacecraft over inter-satellite links from a compromised neighbor.

SPARTA countermeasures

Cite as SafeMode Space, LM-0003 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.