safemode.space
← All techniques
PER-0001
ST0005Persistence

Memory Compromise

Description

The adversary arranges for malicious content to survive resets and mode changes by targeting memories and execution paths that initialize the system. Candidates include boot ROM handoff vectors, first/second-stage loaders, non-volatile images (flash/EEPROM), “golden” fallback partitions, configuration words/fuses, and RAM regions reconstructed at start-up from stored files or tables. Persistence may also ride auto-run mechanisms, init scripts, procedure engines, stored command sequences, or event hooks that execute on boot, safe-mode entry/exit, time triggers, or receipt of specific telemetry/commands. Variants keep the core payload only in RAM but ensure it is reloaded after every restart by patching copy-on-boot routines, altering file catalogs, or modifying table loaders so the same bytes are restored. The common thread is control of where the spacecraft looks for what to run next, so unauthorized logic is reinstated whenever the system resets or transitions modes.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(f)
    addresses
    high
    derived

    Integrity protection on boot ROM handoff vectors and first-stage code is the manufacturer-side obligation requiring secure-boot, measured boot and immutable bootloader chains.

  • craAnnex I, Part II, (5)
    addresses
    moderate
    direct

    Malicious update persistence (primary mapping: Part II, (7) secure update distribution) implies CVD intake for reports about persistent post-update artifacts; (5) supplements the outbound (7) cascade.

  • craAnnex I, Part II, (7)
    addresses
    moderate
    derived

    Secure update-distribution mechanisms protect modifications to memory regions whose integrity is critical (boot, FDIR, persistent configuration).

  • craAnnex I, Part II, (8)
    addresses
    moderate
    direct

    Malicious-update persistence (primary mapping: Part II, (7)) cascades to (8) — the legitimate update channel that countervails malicious-update persistence must maintain timely dissemination of remediating fixes.

  • eu-space-actArt. 81(3)
    addresses
    moderate
    direct

    81(3)(b)'s restrict-access-to-critical-functions limits which entities can write to non-volatile partitions, fuses, and golden-image stores.

  • eu-space-actArt. 84(2)
    addresses
    moderate
    direct

    Memory-compromise persistence rides non-volatile images, configuration words, and auto-run hooks — 84(2)'s Annex VII point 5.1 compliance includes integrity protection on these foundational storage areas.

  • nis2Art. 21(2)(b)
    addresses
    moderate
    derived

    Persistence artefacts (auto-run hooks, modified init scripts, altered file catalogs reasserting after resets) are detectable via configuration-integrity baselines; Art. 21(2)(b)'s incident-handling capability must surface them across the post-incident lifecycle.

  • nis2Art. 21(2)(e)
    addresses
    high
    direct

    Boot ROM handoff, first/second-stage loaders, golden fallback partitions, configuration words, and copy-on-boot logic are network-and-information-systems development/maintenance artefacts; Art. 21(2)(e), including disclosed-vulnerability handling on the persistence surface, is the obligation that governs them.

  • nis2Art. 21(2)(h)
    addresses
    high
    inferred

    Secure boot, signed images, anti-rollback and authenticated table loaders are cryptographic mechanisms, but the operative control against copy-on-boot and altered-loader persistence is boot-chain integrity and protection against unauthorised software, which the CIR (EU) 2024/2690 Annex assigns to section 6 (6.9; 6.4 change management of software in operation), not to the section 9 cryptography requirements (cryptography policy, algorithm and cipher selection, and key management). At NIS2 Art. 21(2)(h) the relationship is addresses; the mitigation sits at the section-6 control.

  • nis2-implAnnex 12.1.1
    addresses
    moderate
    derived

    Boot ROMs and early-init configuration are top-classification assets; their classification governs the strict storage and access controls that prevent malicious modification at the source.

  • nis2-implAnnex 6.2.1
    addresses
    high
    derived

    Boot-stage code is produced inside the secure-development life cycle; integrity protection on boot artefacts and signed-build provenance are the development-side controls that resist persistent memory implants.

  • nis2-implAnnex 6.4.1
    addresses
    high
    derived

    Memory-compromise persistence requires modifying boot ROM handoff vectors, first-stage code and initialization paths — all change-management-controlled artefacts under the implementing regulation's procedures.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i01
    mitigates
    moderate

    Configuration management of init scripts, table loaders, and event hooks detects modifications used to reinstate unauthorized logic on boot.

  • ENISA-STL-2025-03-sD.21-i04
    mitigates
    moderate

    Cybersecurity-safe-mode with hardware-controlled, non-modifiable known-good software undermines persistence routes that depend on rewriting boot-time content.

  • ENISA-STL-2025-03-sD.25-i10
    addresses
    high

    Integrity-checking on mission software and firmware including non-volatile images, fallback partitions, and configuration words detects persistent payload reinjection across resets.

Cross-reference controls

  • csf-2-0DE.CM-01Networks and network services are monitored to find potentially adverse events
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records PER-0001 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-01. Through SPARTA: SPARTA's catalog maps PER-0001 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.CM-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.

  • csf-2-0DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records PER-0001 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps PER-0001 to countermeasure CM0014 Secure boot; CM0023 Configuration Management; CM0028 Tamper Protection, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

  • csf-2-0PR.PS-01Configuration management practices are established and applied
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records PER-0001 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for PR.PS-01. Through SPARTA: SPARTA's catalog maps PER-0001 to countermeasure CM0023 Configuration Management, and that countermeasure's own CSF references include PR.PS-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.PS-01 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

  • d3fendD3-AVEAsset Vulnerability Enumeration
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Asset Vulnerability Enumeration counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records PER-0001 as addressing that same adversary behaviour in the space domain. Enumerating known defects against the software actually flying is standard practice for flight COTS and FOSS components, not only ground assets. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-RSRestore Software
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Restore Software counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records PER-0001 as addressing that same adversary behaviour in the space domain. Reloading software to a host is the flight-software recovery upload as well as a ground reimage. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SUSoftware Update
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Software Update counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records PER-0001 as addressing that same adversary behaviour in the space domain. Replacing old software is the patch uplink, which is how a known defect is closed on-orbit. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SWISoftware Inventory
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Software Inventory counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records PER-0001 as addressing that same adversary behaviour in the space domain. A software inventory covers the flight build, its libraries, and their versions, which is the precondition for knowing what on-board defects exist. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • mitre-attack-enterpriseT1195Supply Chain Compromise
    relates to
    moderate

    Mapped by SPARTA, not curated by SafeMode Space.

  • mitre-attack-enterpriseT1495Firmware Corruption
    relates to
    moderate

    Mapped by SPARTA, not curated by SafeMode Space.

  • mitre-attack-enterpriseT1542Pre-OS Boot
    relates to
    moderate

    Mapped by SPARTA, not curated by SafeMode Space.

  • mitre-attack-enterpriseT1553Subvert Trust Controls
    relates to
    moderate

    Mapped by SPARTA, not curated by SafeMode Space.

  • mitre-attack-enterpriseT1554Compromise Host Software Binary
    addresses
    high

    T1554 'Compromise Host Software Binary' is ATT&CK's persistence-tactic technique for modifying host-resident binaries to establish persistent access; SPARTA PER-0001 'Memory Compromise' is the spacecraft equivalent (modify FSW images in NVM/flash to persist across resets). Tactic and activity align directly.

  • mitre-attack-enterpriseT1601Modify System Image
    relates to
    moderate

    Mapped by SPARTA, not curated by SafeMode Space.

  • mitre-attack-icsT0889Modify Program
    addresses
    high

    T0889 'Modify Program' is in MITRE ICS persistence tactic and addresses adversary modification or addition of programs on a controller to affect its behavior — direct concept-match for SPARTA PER-0001 'Memory Compromise' (modify FSW program memory to maintain persistent access). Tactic and activity align directly.

  • mitre-attack-icsT1693Modify Firmware
    addresses
    moderate

    T1693 'Modify Firmware' covers adversary firmware modification; SPARTA PER-0001 'Memory Compromise' includes firmware-level memory compromise as one persistence path (alongside RAM/flash compromise). T1693 family is in persistence (among others); tactic-aligned moderate complementing T0889.

  • nasa-bpgMI-DCO-01Mission Adversarial Actions Detection Function
    addresses
    moderate

    Persistence across resets in boot paths and non-volatile images is detectable on-board in principle, but the practice does not reach the boot-time window where the technique establishes itself.

  • nist-80053-rev5AC-14Permitted Actions Without Identification or Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-25Reference Monitor
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-14Session Audit
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-2Event Logging
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3Content of Audit Records
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3(1)Additional Audit Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4Audit Log Storage Capacity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4(1)Transfer to Alternate Storage
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5Response to Audit Logging Process Failures
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(2)Real-time Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(5)Alternate Audit Logging Capability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(1)Automated Process Integration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(4)Central Review and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-8Time Stamps
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9Protection of Audit Information
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(2)Store on Separate Physical Systems or Components
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(3)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-7(6)Automation Support for Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-8Penetration Testing
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-8(1)Independent Penetration Testing Agent or Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-8(3)Facility Penetration Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11User-installed Software
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11(3)Automated Enforcement and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-14Signed Components
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-2Baseline Configuration
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3Configuration Change Control
    addresses
    moderate

    CM-3 addresses change-control governance over modifications to memory regions involved in initialization.

  • nist-80053-rev5CM-3(4)Security and Privacy Representatives
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3(6)Cryptography Management
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3(7)Review System Changes
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3(8)Prevent or Restrict Configuration Changes
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-4Impact Analyses
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-4(2)Verification of Controls
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-5Access Restrictions for Change
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-5(6)Limit Library Privileges
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7(8)Binary or Machine Executable Code
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7(9)Prohibiting The Use of Unauthorized Hardware
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10System Recovery and Reconstitution
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10(4)Restore Within Time Period
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-12Safe Mode
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-2Contingency Plan
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-2(5)Continue Mission and Business Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-4(5)Self-challenge
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-2Identification and Authentication (Organizational Users)
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3Incident Response Testing
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3(1)Automated Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3(2)Coordination with Related Plans
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4Incident Handling
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(11)Integrated Incident Response Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(12)Malicious Code and Forensic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(14)Security Operations Center
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(3)Continuity of Operations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(5)Automatic Disabling of System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5Incident Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5(1)Automated Tracking, Data Collection, and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5MA-7Field Maintenance
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-10Emergency Shutoff
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8Security and Privacy Architectures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8(1)Defense in Depth
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8(2)Supplier Diversity
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PM-30Supply Chain Risk Management Strategy
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PM-30(1)Suppliers of Critical or Mission-essential Items
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-10Threat Hunting
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3Risk Assessment
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3(1)Supply Chain Risk Assessment
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3(4)Predictive Cyber Analytics
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-5(11)Public Disclosure Program
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-7Risk Response
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10Developer Configuration Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(1)Software and Firmware Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(2)Alternative Configuration Management Processes
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(3)Hardware Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(4)Trusted Generation
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(7)Security and Privacy Representatives
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11Developer Testing and Evaluation
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(3)Independent Verification of Assessment Plans and Evidence
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(5)Penetration Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(8)Dynamic Code Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(9)Interactive Application Security Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-3System Development Life Cycle
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(5)System, Component, and Service Configurations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(9)Functions, Ports, Protocols, and Services in Use
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8Security and Privacy Engineering Principles
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(10)Hierarchical Trust
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(11)Inverse Modification Threshold
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(12)Hierarchical Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(13)Minimized Security Elements
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(16)Self-reliant Trustworthiness
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(19)Continuous Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(21)Self-analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(22)Accountability and Traceability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(23)Secure Defaults
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(24)Secure Failure and Recovery
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(26)Performance Security
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(29)Repeatable and Documented Procedures
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(3)Modularity and Layering
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(30)Procedural Rigor
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(31)Secure System Modification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(4)Partially Ordered Dependencies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(7)Reduced Complexity
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-9External System Services
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(2)Anti-spoofing Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-2(2)Disassociability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-24Fail in Known State
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-32(1)Separate Physical Domains for Privileged Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5Denial-of-service Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5(3)Detection and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-51Hardware-based Protection
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(10)Prevent Exfiltration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(29)Separate Subnets to Isolate Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(9)Restrict Threatening Outgoing Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(6)Injection Prevention
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-11Error Handling
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-16Memory Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-17Fail-safe Procedures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3Malicious Code Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(10)Malicious Code Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(8)Detect Unauthorized Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4System Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(1)System-wide Intrusion Detection System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(10)Visibility of Encrypted Communications
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(11)Analyze Communications Traffic Anomalies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(13)Analyze Traffic and Event Patterns
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(16)Correlate Monitoring Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(17)Integrated Situational Awareness
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(2)Automated Tools and Mechanisms for Real-time Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(23)Host-based Devices
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(24)Indicators of Compromise
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(25)Optimize Network Traffic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(4)Inbound and Outbound Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(5)System-generated Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(7)Automated Response to Suspicious Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-6Security and Privacy Function Verification
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7Software, Firmware, and Information Integrity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(1)Integrity Checks
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(10)Protection of Boot Firmware
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(12)Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(15)Code Authentication
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(17)Runtime Application Self-protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(5)Automated Response to Integrity Violations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(6)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(8)Auditing Capability for Significant Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(9)Verify Boot Process
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-1Policy and Procedures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-10Inspection of Systems or Components
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-11Component Authenticity
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-11(2)Configuration Control for Component Service and Repair
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-11(3)Anti-counterfeit Scanning
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-2Supply Chain Risk Management Plan
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-2(1)Establish SCRM Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-3Supply Chain Controls and Processes
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-4(3)Validate as Genuine and Not Altered
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-4(4)Supply Chain Integrity — Pedigree
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-5Acquisition Strategies, Tools, and Methods
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-5(2)Assessments Prior to Selection, Acceptance, Modification, or Update
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-6(1)Testing and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-9Tamper Resistance and Detection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-9(1)Multiple Stages of System Development Life Cycle
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • space-shieldT1542Pre-OS Boot
    addresses
    moderate

    T1542 'Pre-OS Boot' covers persistence at pre-OS levels via firmware/bootloader manipulation — addresses the boot-ROM and first/second-stage-loader subset of PER-0001 Memory Compromise.

  • space-shieldT2014Backdoor Installation
    addresses
    high

    T2014 'Backdoor Installation' parent covers installing covert access paths via hardware/software/firmware modification — directly aligned with PER-0001 Memory Compromise's positioning of malicious content in boot ROM, non-volatile images, and auto-run mechanisms for cross-reset persistence.

SPARTA countermeasures

Cite as SafeMode Space, PER-0001 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.