ExecutiveOrdersEO
OtherOtherTrump 45 · R Quiet signal

Other

Cybersecurity Principles for Space Systems

This Space Policy Directive-5 establishes cybersecurity principles for U.S. space systems, directing executive agencies to foster practices that protect government and commercial space assets from cyber threats. It mandates risk-based, cybersecurity-informed engineering for space systems throughout their lifecycle, with specific requirements for encryption, access protection, jamming/spoofing defenses, supply chain security, and information sharing. The directive applies to government national security space systems, civil space systems, and private space systems.

Federal Register Open PDF 85 FR 56155

Impact dates

  1. Secretary of Commerce to publish memorandum in Federal Register

Key directives

  • Agencies directed to foster cybersecurity practices within Government space operations and across commercial space industry
  • Agencies directed to work with commercial space industry and non-government space operators to define best practices and establish cybersecurity-informed norms
  • Space system owners and operators should develop and implement cybersecurity plans incorporating positive control retention/recovery capabilities
  • Space system owners and operators should collaborate to promote best practices and share threat/warning/incident information
  • Secretary of Commerce authorized and directed to publish this memorandum in the Federal Register

Who is ordered

Timeline

Immediate

  • Memorandum takes effect upon signing
  • Secretary of Commerce directed to publish in Federal Register

Near term (90d)

  • Agencies to begin working with commercial space industry to define best practices and establish cybersecurity-informed norms

Long term

  • Integration of cybersecurity measures into design phases of future space vehicles
  • Development of industry-wide threat information sharing mechanisms
  • Evolution of space system cybersecurity standards through rules, regulations, and guidance

Risks & tensions

  • Vague on enforcement mechanisms—'should' language predominates over 'shall' for owner/operator obligations
  • Potential tension between security requirements and burden minimization in Section 4(e)
  • Commercial industry may resist government-defined norms as regulatory overreach
  • Supply chain tracking requirements may conflict with globalized space component manufacturing
  • Classification barriers may limit effective threat information sharing with commercial operators
Other: Cybersecurity Principles for Space Systems · Executive Orders