About
One fixed scope, fixed fee space cyber assessment, sized to your mission and answering three regimes from one control set.
Why the name#
Found To Fixed is named after the part of security advisory work that usually goes missing: the order to close findings in, who pays for each fix, and whether the result holds up in front of a customer six months later.
Findings arrive graded U1 to U5, irrecoverable breaches first, each with a consequence level and the reason it sits there.
One assessment#
We run a fixed scope, fixed fee space cyber assessment for Australian space companies. That is the whole offer.
A control set assembled fresh for each engagement is how a company ends up answering for a constellation it does not fly. Ours is scoped by payload class, bus model, and orbital layer, then mapped to NIST SP 800-171 Rev 2, the same 110 controls under CMMC Level 2.
One control set, three regimes#
Three regulatory regimes ask closely related questions in incompatible language. CMMC asks what your prime's flow-down requires. ITAR and EAR assume, without ever saying so, that you can show technical data never reached an unauthorised person. SOCI has not designated space as an asset class yet, though parts of what you already do sit inside somebody else's obligations.
Answering them separately means three engagements and three sets of evidence that do not agree. Answering them from one control set is the entire point.
Who built the control set#
The control set comes from the ISACA Sydney Chapter space cybersecurity guide and a nine stage enterprise architecture ending in 53 controls. The engineering half comes from fire detection software built under FUEGO at the UC Berkeley Space Sciences Laboratory and used during Californian wildfire seasons.
The governance half comes from regulated banking, payments, and insurance, where a control counts once a board can defend it. See the team.
Out of scope#
- Certification. The assessment confers no CMMC status, and no SOCI certification exists for a space asset.
- Export classification. That is your export lawyer's call.
- Penetration testing of live flight systems.