A report written for the person who asked
The same document goes into a prime's security annex, a procurement questionnaire, or a board paper. Two assessors sign it after peer review, then walk it through with whoever has to defend it.
Compliance evidence that unblocks the next deal.
Your prime or customer has asked a security question you cannot answer yet. In four to six weeks, for a fixed fee, you get a report you can hand back to whoever asked, and a list of what to fix first.
Start a conversation What it answers
- 4 to 6
- weeks, fixed fee
- 12 to 14
- hours of your engineers' time
- 2
- assessors sign
Led by Bradley Busch, who was CISO at Tyro Payments and across AUB Group's insurance network, and wrote the ISACA Sydney Chapter guide to space cybersecurity. Janis Lesinskis, who prepared a satellite instrument for launch at the UC Berkeley Space Sciences Laboratory, advises on the engineering.
What you hold at week six
A fix list in order
Every finding carries a consequence rating from U1 to U5. Breaches you cannot undo come first, then design freeze items while the freeze is still open.
The evidence behind the number you sign
Under CMMC Level 2 you post your own score and affirm it every year. The report is what sits behind it.
The work is sized to what you fly. Payload class, bus model, and orbital layer set the scope, and ground segment only is a valid answer.
What it costs you
The fee is fixed before we start, with no variation without your sign off. Your engineers spend about 12 to 14 hours across the four to six weeks.
-
Week 1
You send the evidence we list. Your team spends 4 to 6 hours this week and about 2 hours a week after that.
-
Weeks 2 to 4
We assess the evidence. Where it is thin, we run a working session before writing the finding.
-
Weeks 5 to 6
Peer review, then the report and a walkthrough with whoever has to defend it.
The question your customer sent you
CMMC, for the US supply chain
Your prime's contract carries DFARS 252.204-7021. You post your own score and affirm it every year. We give you the evidence behind the number.
ITAR and EAR, for launch and dual use payloads
Your export lawyer classifies the data. We assess whether it stayed with authorised people: access control, segregation, and personnel screening.
SOCI, at home
Space has no designated asset classes yet, so no certificate exists to buy. Your customers' obligations already reach you, and we map your controls to them so the evidence holds if designation arrives.
What we do not sell
CMMC certification, a SOCI certificate, export classification, and penetration testing of live flight systems. If an assessment is not what you need, we say so on the first call.
When to call
- A customer or prime has asked a security question you cannot answer yet.
- Design freeze, while a control still costs a decision instead of a redesign.
- Pre-launch acceptance.
- First flight, and annually after it.
Recent writing
-
Self-assessed does not mean unexamined
Most of CMMC Level 2 is self-assessed and third party assessment is suspended. That leaves you as the only person who examined the score you affirm.
Tell us what your customer asked for.
A 20 minute call is enough to say whether an assessment answers it, what the scope looks like against your mission, and the fee. Fixed before we start, with no variation without your sign off.