safemode.space
← All techniques
PER-0004
ST0005Persistence

Replace Cryptographic Keys

Description

The adversary cements control by changing the cryptographic material the spacecraft uses to authenticate or protect links and updates. Targets include uplink authentication keys and counters, link-encryption/session keys and key-encryption keys (KEKs), key identifiers/selectors, and algorithm profiles. Using authorized rekey commands or key-loading procedures, often designed for over-the-air use, the attacker installs new values in non-volatile storage and updates selectors so subsequent traffic must use the attacker’s keys to be accepted. Variants desynchronize anti-replay by advancing counters or switching epochs, or strand operators by flipping profiles to a mode for which only the adversary holds parameters. Once replaced, the new material persists across resets and mode changes, turning the spacecraft into a node that recognizes the adversary’s channel while rejecting former controllers.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(d)
    addresses
    high
    derived

    Authentication obligations include identity life-cycle management of cryptographic keys; manufacturers must design products so key replacement requires verified, factor-bound authority.

  • craAnnex I, Part I, (2)(e)
    addresses
    moderate
    derived

    Confidentiality obligation requires manufacturers to encrypt cryptographic key material at rest and in transit; product-side hardware-backed key storage resists adversary key replacement.

  • craAnnex I, Part I, (2)(f)
    addresses
    moderate
    derived

    Integrity protection on stored keys and configurations resists unauthorized rotation through procedural manipulation.

  • eu-space-actArt. 81(1)
    addresses
    high
    direct

    Key-loading procedures are critical-function actions governed by 81(1)'s IAM protocols — only the highest-privilege identities should authorize rekey events.

  • eu-space-actArt. 81(4)
    addresses
    moderate
    direct

    Cryptographic-key replacement (primary: Art. 81(1) IAM on key-loading) cascades to 81(4) — rekey-command audit is part of credential lifecycle discipline applied to key-loading credentials.

  • eu-space-actArt. 85(2)
    addresses
    high
    direct

    Replacing cryptographic keys directly attacks the lifecycle 85(2) places on the operator — secure generation, storage, distribution, and disposal disciplines must include controls on rekey command authorization itself.

  • eu-space-actArt. 85(3)
    addresses
    moderate
    direct

    85(3)(c)'s availability-of-cryptographic-keys-and-parameters clause (with redundant cryptographic equipment) is the operator-side counterpart that prevents adversary key-replacement from leaving the legitimate operator stranded.

  • nis2Art. 21(2)(h)
    addresses
    moderate
    inferred

    PER-0004 installs attacker-chosen keys and algorithm profiles via rekey and key-loading procedures, desynchronizing anti-replay and stranding operators; NIS2 21(2)(h) policies on cryptography and encryption including key management govern this risk.

  • nis2Art. 21(2)(i)
    addresses
    high
    direct

    Keys, key-encryption keys, key identifiers, algorithm profiles, and rekey command sequences are first-class access-controlled assets; Art. 21(2)(i) governs which roles can author, transport, or invoke key-loading procedures.

  • nis2-implAnnex 11.3.1
    addresses
    high
    derived

    Authority to replace cryptographic keys is privileged-account authority; the privileged-account policy bounds the population, applies strong identification and review obligations and resists single-actor key-rotation events.

  • nis2-implAnnex 11.5.1
    addresses
    moderate
    direct

    Identity life-cycle management governs how cryptographic keys, including uplink-MAC and link-encryption keys, are issued, rotated and revoked; the implementing regulation's identity-life-cycle obligation is the procedural envelope around the keys this technique rotates under attacker control.

  • nis2-implAnnex 6.4.1
    addresses
    high
    derived

    Cryptographic-key replacement is a change-management event with dramatic security consequences; documented procedures with separation-of-duty review are the implementing-regulation lever that prevents single-operator key replacement under attacker direction.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i01
    mitigates
    moderate

    Configuration management of key identifiers, selectors, and algorithm profiles detects unauthorised changes to crypto material configuration.

  • ENISA-STL-2025-03-sD.23-i11
    addresses
    high

    Cryptography and key management governs the uplink-key lifecycle (handling outside on-board software, key restrictions, rotation cadence, anomaly review) that PER-0004 attempts to subvert.

  • ENISA-STL-2025-03-sD.26-i02
    mitigates
    moderate

    Least-privilege access control with separation of duties and four-eyes principle on rekey procedures denies unilateral key replacement by a compromised operator account.

  • ENISA-STL-2025-03-sD.26-i04
    addresses
    high

    Authentication-information management governs allocation, rotation, and revocation of the keys/counters PER-0004 replaces.

Cross-reference controls

  • ccsds-sdlsCCSDS-354.0-S03Key Management Service Procedures
    addresses
    low

    SDLS key-management procedures (authenticated OTAR, the key lifecycle, key verification) govern how cryptographic material is changed, raising the bar against unauthorized key replacement; but an adversary holding master-key authority can replace keys through the legitimate process, so it addresses rather than interdicts.

  • csf-2-0PR.PS-01Configuration management practices are established and applied
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records PER-0004 against CM-5 Access Restrictions for Change, and CSF 2.0's own crosswalk names that control as an informative reference for PR.PS-01. Through SPARTA: SPARTA's catalog maps PER-0004 to countermeasure CM0030 Crypto Key Management, and that countermeasure's own CSF references include PR.PS-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.PS-01 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

  • d3fendD3-ABPIApplication-based Process Isolation
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Application-based Process Isolation counters T1556 Modify Authentication Process; SafeMode's curated mapping records PER-0004 as addressing that same adversary behaviour in the space domain. Intra-process memory partitioning is implemented in flight software itself, so the control applies wherever that software runs. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-HBPIHardware-based Process Isolation
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Hardware-based Process Isolation counters T1556 Modify Authentication Process; SafeMode's curated mapping records PER-0004 as addressing that same adversary behaviour in the space domain. Hardware memory protection is standard on flight processors (MMU or MPU partitioning), so the control applies on-board. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-HRHost Reboot
    addresses
    low

    Derived by composition, not from a source that names this pair. D3FEND publishes that Host Reboot counters T1556 Modify Authentication Process; SafeMode's curated mapping records PER-0004 as addressing that same adversary behaviour in the space domain. A commanded reset is a normal spacecraft recovery action, so terminating running state by reboot applies on-board. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-HSHost Shutdown
    addresses
    low

    Derived by composition, not from a source that names this pair. D3FEND publishes that Host Shutdown counters T1556 Modify Authentication Process; SafeMode's curated mapping records PER-0004 as addressing that same adversary behaviour in the space domain. Powering a component down is a normal spacecraft safing action, so the control applies to flight subsystems as well as ground hosts. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-KBPIKernel-based Process Isolation
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Kernel-based Process Isolation counters T1556 Modify Authentication Process; SafeMode's curated mapping records PER-0004 as addressing that same adversary behaviour in the space domain. Kernel-level task isolation is what a partitioned real-time operating system provides on-board, so the control applies to flight software. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-PSProcess Suspension
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Process Suspension counters T1556 Modify Authentication Process; SafeMode's curated mapping records PER-0004 as addressing that same adversary behaviour in the space domain. Suspending a task is available to flight executives as well as to ground operating systems. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-PTProcess Termination
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Process Termination counters T1556 Modify Authentication Process; SafeMode's curated mapping records PER-0004 as addressing that same adversary behaviour in the space domain. Terminating a task is available to flight executives as well as to ground operating systems. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SCFSystem Call Filtering
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that System Call Filtering counters T1556 Modify Authentication Process; SafeMode's curated mapping records PER-0004 as addressing that same adversary behaviour in the space domain. Restricting which system services a task may invoke applies to a partitioned flight executive as well as a ground kernel. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • mitre-attack-enterpriseT1098Account Manipulation
    addresses
    high

    T1098 'Account Manipulation' addresses persistence-tactic adjustment of account credentials/keys to retain attacker access; SPARTA PER-0004 'Replace Cryptographic Keys' is the same activity applied to spacecraft-command-channel cryptographic credentials (replace TC auth keys, KEKs, session keys). Tactic and activity align.

  • mitre-attack-enterpriseT1531Account Access Removal
    relates to
    moderate

    Mapped by SPARTA, not curated by SafeMode Space.

  • mitre-attack-enterpriseT1556Modify Authentication Process
    addresses
    high

    T1556 'Modify Authentication Process' is in persistence tactic and addresses tampering with auth mechanisms to enable continued unauthorised access; replacing cryptographic keys IS modifying the authentication process at the key-material level. Tactic aligns directly.

  • mitre-attack-icsT0892Change Credential
    addresses
    moderate

    T0892 'Change Credential' addresses adversary modification of credentials and credential-related software/configuration; SPARTA PER-0004 'Replace Cryptographic Keys' is the same activity applied to spacecraft-command-channel cryptographic credentials (replace TC auth keys, KEKs, session keys to retain attacker access). Cross-tactic moderate (T0892 in inhibit-response-function vs SPARTA PER-0004 persistence); exact concept match.

  • nist-80053-rev5AC-14Permitted Actions Without Identification or Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17Remote Access
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(1)Monitoring and Control
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(10)Authenticate Remote Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(2)Protection of Confidentiality and Integrity Using Encryption
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-18Wireless Access
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-18(1)Authentication and Encryption
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-2(11)Usage Conditions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-25Reference Monitor
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3Access Enforcement
    mitigates
    moderate

    AC-3 mitigates PER-0004 by enforcing access authorization on key-management functions.

  • nist-80053-rev5AC-3(10)Audited Override of Access Control Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-6Least Privilege
    addresses
    moderate

    AC-6 mitigates PER-0004 by reserving key-management authority to a small set of need-to-know operators.

  • nist-80053-rev5AU-12Audit Record Generation
    addresses
    moderate

    AU-12 addresses audit-record generation on key-management events whose review surfaces adversary rekey attempts.

  • nist-80053-rev5AU-14Session Audit
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-2Event Logging
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3Content of Audit Records
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3(1)Additional Audit Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4Audit Log Storage Capacity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4(1)Transfer to Alternate Storage
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5Response to Audit Logging Process Failures
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(2)Real-time Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(5)Alternate Audit Logging Capability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(1)Automated Process Integration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(4)Central Review and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-8Time Stamps
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9Protection of Audit Information
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(2)Store on Separate Physical Systems or Components
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(3)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-3Information Exchange
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-7(6)Automation Support for Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-8(1)Independent Penetration Testing Agent or Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-8(3)Facility Penetration Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11(3)Automated Enforcement and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3(6)Cryptography Management
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-5Access Restrictions for Change
    mitigates
    moderate

    CM-5 mitigates PER-0004 by gating cryptographic-configuration changes (including key rotations) behind access restrictions.

  • nist-80053-rev5CM-7(9)Prohibiting The Use of Unauthorized Hardware
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10System Recovery and Reconstitution
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10(4)Restore Within Time Period
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-2Contingency Plan
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-4(5)Self-challenge
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-4(9)Attribute Maintenance and Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5Authenticator Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5(7)No Embedded Unencrypted Static Authenticators
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-7Cryptographic Module Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3Incident Response Testing
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3(1)Automated Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3(2)Coordination with Related Plans
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4Incident Handling
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(11)Integrated Incident Response Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(12)Malicious Code and Forensic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(14)Security Operations Center
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(5)Automatic Disabling of System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5Incident Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5(1)Automated Tracking, Data Collection, and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5MA-7Field Maintenance
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-10Emergency Shutoff
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-11Emergency Power
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-11(1)Alternate Power Supply — Minimal Operational Capability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-14Environmental Controls
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8Security and Privacy Architectures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8(1)Defense in Depth
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8(2)Supplier Diversity
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PM-30Supply Chain Risk Management Strategy
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PM-30(1)Suppliers of Critical or Mission-essential Items
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-10Threat Hunting
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3(1)Supply Chain Risk Assessment
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3(4)Predictive Cyber Analytics
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(3)Hardware Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(4)Trusted Generation
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11Developer Testing and Evaluation
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-3System Development Life Cycle
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(5)System, Component, and Service Configurations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(9)Functions, Ports, Protocols, and Services in Use
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8Security and Privacy Engineering Principles
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(11)Inverse Modification Threshold
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(13)Minimized Security Elements
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(16)Self-reliant Trustworthiness
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(18)Trusted Communications Channels
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(19)Continuous Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(21)Self-analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(22)Accountability and Traceability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(23)Secure Defaults
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(24)Secure Failure and Recovery
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(26)Performance Security
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(3)Modularity and Layering
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(30)Procedural Rigor
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(31)Secure System Modification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(4)Partially Ordered Dependencies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-9External System Services
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-9(6)Organization-controlled Cryptographic Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-10Network Disconnect
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12Cryptographic Key Establishment and Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(1)Availability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(2)Symmetric Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(3)Asymmetric Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(6)Physical Control of Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-13Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(2)Anti-spoofing Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(3)Cryptographic Binding
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-24Fail in Known State
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-28(1)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-28(3)Cryptographic Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-32(1)Separate Physical Domains for Privileged Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5Denial-of-service Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5(3)Detection and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-51Hardware-based Protection
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7Boundary Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(10)Prevent Exfiltration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(11)Restrict Incoming Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(18)Fail Secure
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(5)Deny by Default — Allow by Exception
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(9)Restrict Threatening Outgoing Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8(1)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8(3)Cryptographic Protection for Message Externals
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10Information Input Validation
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(3)Predictable Behavior
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(5)Restrict Inputs to Trusted Sources and Approved Formats
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(6)Injection Prevention
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-13Predictable Failure Prevention
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-13(4)Standby Component Installation and Notification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-16Memory Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-17Fail-safe Procedures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-19(4)Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3Malicious Code Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(10)Malicious Code Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(8)Detect Unauthorized Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4System Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(1)System-wide Intrusion Detection System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(10)Visibility of Encrypted Communications
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(11)Analyze Communications Traffic Anomalies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(13)Analyze Traffic and Event Patterns
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(16)Correlate Monitoring Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(17)Integrated Situational Awareness
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(2)Automated Tools and Mechanisms for Real-time Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(23)Host-based Devices
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(24)Indicators of Compromise
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(25)Optimize Network Traffic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(4)Inbound and Outbound Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(5)System-generated Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(7)Automated Response to Suspicious Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-6Security and Privacy Function Verification
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(17)Runtime Application Self-protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(5)Automated Response to Integrity Violations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(8)Auditing Capability for Significant Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-1Policy and Procedures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-10Inspection of Systems or Components
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-11Component Authenticity
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-11(3)Anti-counterfeit Scanning
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-2Supply Chain Risk Management Plan
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-2(1)Establish SCRM Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-3Supply Chain Controls and Processes
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-4(3)Validate as Genuine and Not Altered
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-4(4)Supply Chain Integrity — Pedigree
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-5Acquisition Strategies, Tools, and Methods
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-5(2)Assessments Prior to Selection, Acceptance, Modification, or Update
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-6(1)Testing and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-9Tamper Resistance and Detection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-9(1)Multiple Stages of System Development Life Cycle
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • space-shieldT2013Key Management Infrastructure Manipulation
    addresses
    high

    T2013 'Key Management Infrastructure Manipulation' is the direct cross-framework counterpart of PER-0004 Replace Cryptographic Keys — both describe replacing TM/TC encryption keys to gain permanent access.

  • space-shieldT2013.001Replace / generate new Session Keys
    addresses
    high

    T2013.001 'Replace / generate new Session Keys' is the direct counterpart of PER-0004's session-key-replacement subset — both describe replacing TM/TC encryption session keys for permanent access.

  • space-shieldT2013.002Replace / generate new Master Keys
    addresses
    high

    T2013.002 'Replace / generate new Master Keys' is the direct counterpart of PER-0004's master-key/KEK-replacement subset — both describe replacing master keys to gain permanent access or interrupt owner control.

SPARTA countermeasures

Cite as SafeMode Space, PER-0004 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.