Found To Fixed

Compliance evidence that unlocks the next deal.

A fixed scope, fixed fee space cyber assessment for Australian space companies. Four to six weeks from start to a report you can hand to a customer, a prime, or a board.

Start a conversation What it answers

53
controls assessed
9
framework domains
4 to 6
weeks, fixed fee

Founded by Bradley Busch, author of the ISACA Sydney Chapter guide to Australian space cybersecurity, with Janis Lesinskis advising, who built wildfire detection pipelines under FUEGO at the UC Berkeley Space Sciences Laboratory.

What you are holding at the end

A report written to be shown, not filed

The same document answers a procurement questionnaire, a prime's security annex, and a board paper. One artefact, three audiences.

A control set sized to your mission

Scoped by payload class, bus model, and orbital layer, then mapped to NIST SP 800-171 — the same 110 controls under CMMC Level 2. Ground segment controls apply to the ground segment. You are not answering for a constellation you do not fly.

Every finding with its fix already sequenced

Findings arrive graded U1 to U5, cheapest and most load bearing first. Everyone finds problems. The order to close them is the useful part.

A consequence rating your board can act on

Each finding carries a consequence level and the reason it sits there, in language a director reads once and understands.

Governance and engineering in the same room

The method comes out of a wildfire detection pipeline built under FUEGO at the UC Berkeley Space Sciences Laboratory. If your payload is Earth observation or a detection system, the control set was written by people who have shipped one, not adapted from a generic checklist.

How the four to six weeks run

  1. Week 1

    Scoping and evidence request. We size the control set to your mission and tell you exactly what we need from you. Your engineers spend hours on this, not weeks.

  2. Weeks 2 to 4

    Assessment against the 53 controls across 9 domains, with working sessions where the evidence is thin rather than a finding written from a gap in a spreadsheet.

  3. Weeks 5 to 6

    Peer review, then the report and a walkthrough with whoever has to defend it. Two assessors sign every report.

One control set, three regimes it answers

SOCI, at home

Space is not a designated asset class yet. Parts of what you already do are.

When to run one

  • A customer or prime has asked a security question you cannot answer yet.
  • Design freeze, while a control still costs a decision instead of a redesign.
  • Pre-launch acceptance.
  • First flight, and annually after it.

Recent writing

  • Self-assessed does not mean unexamined

    Most of CMMC Level 2 is self-assessed and third party assessment is suspended. That makes the evidence behind your score more important, not less.

All posts →

Tell us what your customer asked for.

A 20 minute call is enough to say whether an assessment answers it, what the scope looks like against your mission, and the fee. Fixed before we start, with no variation without your sign off.

Start a conversation Contact page