US Space Policy Directive 5 - Cybersecurity Principles for Space Systems
US policy establishing cybersecurity principles for space systems. Requires Zero-Trust architecture and comprehensive logging for ground and space operations.
What SPD-5 draws on
This framework pulls on all three pillars — which is why running them as three separate tools means reconciling three sets of evidence at audit time.
Compliance
Security
What your auditor cites,
and what produces the evidence
The regulator's text is quoted below in italic, exactly as written. What follows each one is what the platform records, detects, or proves — not a claim about your compliance status, which no tool can confer.
Zero Trust Architecture
Space systems MUST implement Zero-Trust logging for all ground and space operations.
Authorisation is configured in the database; proving it holds is what this requirement actually needs. Vulnerability scanning surfaces excessive privilege and role sprawl, default and weak credentials, and stale or orphaned accounts — including privilege inherited through nested roles, which is where least-privilege reviews usually go wrong. Real-time SQL auditing then shows which of those grants were exercised, so an access review reflects observed use rather than intent.
Command and Control Security
REQUIRES traceability of command-and-control (C2) database telemetry and access.
A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.
Ground System Protection
Ground segment operations MUST implement comprehensive access logging and monitoring.
A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.
Incident Response
Operators MUST maintain incident response capabilities with forensic-ready logging.
Findings route by severity to Slack, Teams, email, PagerDuty, or your SIEM, and escalate automatically when nobody acknowledges them and again when nobody resolves them. Every alert arrives with the query, the identity, and the data classification already attached, so the response starts with context rather than with an investigation. The acknowledge-to-resolve history is retained, which is what evidences that the procedure was followed. Your ticketing system stays where it is — what this produces is a finding worth opening a ticket for.
What SPD-5 covers
This instrument defines no data category of its own. A set of PRINCIPLES directed at US agencies. It names no data category, and reaches an operator only through whatever licence or contract adopts it.
How SPD-5 is enforced
Every figure below is the ceiling the instrument publishes about itself, not a prediction of what anything would cost. Enforced by Nobody directly. It is a policy directive to federal agencies, not a rule binding operators.
A voluntary standard. No regulator enforces it.
Space Policy Directive 5 sets cybersecurity principles for space systems and directs agencies to consider them. It creates no obligation on a commercial operator by itself. Where it bites is downstream, in the licence conditions and contract clauses agencies subsequently adopt.
Check the licence or contract that governs your mission; that is where any enforceable version of these principles will be.
Uncapped exposure that sits outside this instrument
These come from company law rather than from SPD-5, and they are not penalties — they are liability for a loss, which is why nothing caps them at a published maximum.
Duty of oversight
Delaware, and followed in most US corporate jurisdictions. It is a rule of company law, not of any privacy or security statute.
Triggered by. A sustained or systematic failure by the board to establish a reporting system for a mission-critical risk — or, having one, consciously disregarding what it reported. The second limb is what a documented, unremediated finding goes to.
Who. Directors, in their personal capacity, in a derivative action brought on behalf of the company.
This is liability for the loss the company suffered, not a statutory penalty, so nothing caps it at a published maximum. A bad-faith finding also takes the conduct outside the exculpation and indemnification the charter would otherwise provide.
In re Caremark Int’l Deriv. Litig. (Del. Ch. 1996); Marchand v. Barnhill (Del. 2019); In re Boeing Co. Deriv. Litig. (Del. Ch. 2021).
Enforcement data reviewed August 2026. Several figures are indexed annually and move.
Built for SPD-5,
not configured for it afterwards
Space Ground Ops Monitoring
Zero-Trust logging for satellite command and control
SPD-5 Compliance Report
Traceability evidence for C2 operations
Space System Data
Identify telemetry, C2 commands, and orbital data
C2 Access Alert
Alert on command and control database access
Other Critical Infrastructure frameworks
Walk into the SPD-5 audit knowing the answer
228 cited requirements across 57 frameworks are mapped to the controls that evidence them. A fixed-fee gap assessment tells you which of them you can already prove today.