Our fourth presentation is a duo from the Office of the National Cyber Director at the White House, and here I thought I had a good office with a view.
Our presenters are Tanya Sims and Lauren Williams.
Tanya is the Director for Cyber Policy and Programs.
Lauren is the Senior Advisor of Strategy and Research.
Together, they will be speaking about how current and emerging threats to the space ecosystem is front and center as an area of intense innovation and growth across civil, military, and commercial sectors.
They will speak to the current gaps in today's policies and offer ways for the audience to get engaged in change.
To start that engagement, please give a round of applause to Tanya and Lauren.
So, hi, good afternoon everyone.
My name is Tanya Sims.
As that wonderful, I think, AI voice just said, I'm the Director for Cyber Policy and Programs within the Office of the National Cyber Director at the White House.
My role there is really to focus on how our nation is governed on critical infrastructure-related policies and programs, and space, of course, is no exception to that.
And hi everyone, again, I'm Lauren Williams, also with the White House Office of the National Cyber Director, and my focus and prioritization in our team at ONCD has been on space and cybersecurity as both a policy and a strategy imperative.
And so we're looking forward to talking to you as we go forward about the de-prioritization that we placed on that issue.
Next slide.
All right, so to start, we want to situate the broader issue of space and cybersecurity into the Biden-Harris administration in particular's broader strategic objectives and broader prioritization related to cybersecurity.
So, may or may not be news to you all, but the administration released its most recent cybersecurity strategy, national cybersecurity strategy, in March of 2023.
And this document notably lays the foundation for what we most care about as an administration when it comes to cybersecurity prioritization writ large, and that is working toward a defensible, resilient, and values-aligned digital ecosystem.
And there are five key pillars of that strategy, which focus on defending critical infrastructure, disrupting and dismantling threat actors, shaping market forces to drive security and resilience, investing in that resilient future, and then last but not least,
focusing on how we can leverage shared international partnerships to achieve those goals.
And our objective here is very much to tie these broad principles into everything that we do within ONCD, including to tackle very tangible challenges like cybersecurity for space systems.
And so, all of you may be thinking, right, strategies, a lot of really awesome keywords.
So, really what good is a strategy without some accountability, as well as some implementation prongs to make sure that different government agencies are following through on the commitments that we set forth in the strategy.
And so, we recently issued the implementation plan to tack on to the strategy.
And I would say that this is probably the first time that the White House has done something like this, where we are actually saying, hey, these government agencies are accountable for 69 different actual measures within the strategy to make sure that we can actually track progress and follow through.
And we actually tasked ourselves.
We tasked ourselves with 14 of those measures.
And I think that's also the first time the White House tasked ourselves to do something.
But all of this to say is that even in forecasting what would be the implementation plan, and really holding ourselves accountable, right, we started convening with private industry, as well as different government leaders in the most White House way at the White House.
And earlier in March, we gathered a lot of the top executives within the industry and brought together a lot of govies to the White House to talk about some current threats, really contextualizing why cybersecurity needed to be important for them in the context of the entire product life cycle.
Sorry.
Closer to my mouth.
Okay.
And Lauren and I, we love these slides.
We're in the arrow.
It's the red arrow in the corner, really talking and hearing about, you know, what are really the perspectives from industry leaders, right?
All of you are practitioners, but how do your CEOs, right, think about cybersecurity?
Are they even thinking about cybersecurity?
How do we make this relevant for them?
And so this was something that really kicked off our approach to focusing on space policy directive five.
I mean, it may surprise you to find out that really this is something that was released in September 2020.
It's still the current national policy when it comes to space system cybersecurity for the U.S.
And it's, you know, three years old to say the least, but also it provides a really nice sounding list of principles.
We can't say that this is not our current policy and we don't approve it.
We have to approve it because it is our current policy, but it is a set of very nice sounding principles.
Lauren?
And they're essentially what are listed on the slide here.
They are to, oh, one more.
Thanks.
They are to, you know, directing both private sector and government operators to use risk-based cybersecurity form engineering, to have integrated cybersecurity plans, to leverage, you know, widely adopted best practices without defining what those best practices are,
to collaborate, you know, across the public and private sector, to promote development of best practices and mitigations, and then finally to design space systems to be effective and able to manage risks.
And, of course, these are the objectives that we should be working toward, but what is lacking, at least in the existing policy, are tangible, specific guidelines and steps for both the private sector and for the government owners and operators to actually implement those principles.
And then finally, I would note that going back to the national cybersecurity strategy, it does reinforce the importance of upholding the current national cybersecurity policy, SPD 5, but what our task within our office has been is to think about how we can build on it.
Yeah.
And also, if I didn't emphasize this before, there's only one policy right now, and that policy is three years old.
But the benefit of it is that it really does call on government to reach out and collaborate and work with private industry, wherever they may be, to make sure that there can be sort of a set of best practices, a set of standards that can be developed that further adds to the implementation.
Those steps are essentially what we're focused on.
Next slide.
All right.
And so this similarly will not surprise any of you.
It won't be new to this audience, that the space domain and the space landscape, the exponential growth of the commercial space sector is continuing to grow, and the importance of private sector to driving that the growth of this ecosystem, including in relation to,
as you can see there, kind of your traditional government, civil and military operators like NASA or DOD, the uses of space in that traditional sense are vastly dwarfed by the commercial space ecosystem and the growth there.
And so when we think about what might be necessary if we're thinking about what comes beyond Space Policy Directive 5 as of several years ago, we're thinking about this landscape and the fact that there has been rapid change in the last several years,
and policy should keep up with that.
Yeah, so I mean, even when it comes to nation states like China and Russia, right, their commercial space fleets or dual purpose space fleets, they've grown from 2019 to 2021 by 70%.
And so even from that context, right, it's not that we just want to outpace other countries or adversaries, it's simply a feature of how quickly the market is growing.
And then even when we talk about sort of, aside from those growth areas, right, we're just talking about a large number of assets in orbit.
It's not just that space is getting overcrowded, our orbits, when we talk about LEO, MEO, GEO, right, those orbits are getting overcrowded.
And so it's not just an issue from an adversary or a threat perspective, it's literally a physical and a cybersecurity issue at the same time.
We have companies like SpaceX, their Starlink fleets, right, that they have an incredible mission and they are launching 50 assets up into space in just one rocket.
That's a significant number and that's why we see sort of that exponential growth of just how crowded our orbits are getting.
And then when you think about even the market for embedded systems, right, and the space assets absolutely use embedded systems like secure bus or encryption, those are the types of things where I think In-Q-Tel recently released a finding where that market is expected to explode up to seven billion dollars a year,
and a portion of that is of course going to the space industry.
And so just from that perspective, what we're talking about also is that there's a large proliferation of satellites in low earth orbit.
We're not even talking about the development of human spaceflight vehicles, we're just simply talking about satellites.
And we see in the slide there, there's, you know, roughly 60 percent of all of our active payloads in space are in low earth orbit.
And that means, I mean, it's important for us from a cybersecurity perspective because LEO satellites are also the ones that are going to be the most interconnected, they're also the ones that are going to be largest in number, and that means a larger attack surface and potential for collision is absolutely something that we care about.
And so kind of thinking about this broad growth of and change and exponential kind of increase of commercial space activity as well as government activity over the last several years , it obviously creates a lot of opportunities in the ways that we've described,
but we have to also think at the same time about the risks and the threats.
And Odi, in the Office of the Director for National Intelligence, in that open source document mentioned there, very much highlights kind of the increased focus from threat actors, from nation-state actors on using offensive cyber capabilities against space assets.
And so that risk obviously has been underscored by multiple U.S.
government advisories, including several of the, you know, Department of Homeland Security, CISA advisories about routinely exported vulnerabilities related to kind of commonly used operating systems that we use across space systems as well as everything else that we do in our companies and in our government,
you know, activities.
As well as it's highlighted by a wide range of independent as well as think tank and academic research that highlights the threats that are currently affecting the space ecosystem from a cyber perspective.
And with that, we will further kind of complicate this picture.
We're talking about the change in the landscape, the threat environment, the increasing kind of attack surface and attack vector.
And then from our point of view at the White House, we are very much focused on what we can do and where we fit in as the White House Office of National Cyber Director within the national policy landscape, which looks a little bit like this.
And if you're overwhelmed by it, that's where we started our journey.
This is a simplified version.
Yes.
And so what we want to say here and what we want to show through this slide is that, and this is actually just focused on the executive branch policy landscape.
So a little bit kind of very much focused from our lens of how we're thinking about policy development.
There are major players, including the National Security Council, our office, the National Cyber Director, National Space Council, who we very much partner with along this journey, the Office of Science and Technology Policy, the Office of Management and Budget.
And each one of these kind of White House elements operate or kind of owns a different piece of the policy process that plays a role in developing, in particular, national cybersecurity policy, and then kind of narrowing down that lens to a focus on cybersecurity policies that are relevant and apply to the space ecosystem.
So I'd note there in that kind of second tier of interagency U.S.
government departments and agencies, that's about 30, 40, 30 plus agencies that not only play a role in operating space systems, but the majority are more so government agencies that utilize and or rely on space-based services.
And so that kind of gets you a much broader scope of agencies that are implicated when we think about what cybersecurity and ensuring resilient and secure space systems means for the broader U.S.
government.
Yeah, and just to expand on a couple examples, I know we've been talking about SPD-5, but based on this chart, right, we really wanted to show you how that actually came about.
So you had two elements of the National Security Council come together, along with the National Space Council, and maybe a little bit of input from the Office of Science and Technology Policy, right?
I mean, there are 17 different policy arms within the White House.
These are just three of them.
But these elements came together to really develop and work with the interagency, the federal interagency, to come out with SPD-5.
And so the ones circled in red are supposed to be ones that touch on cybersecurity and have some type of relevance for space systems, with arguably the only one in that list that is directly relevant to space systems as SPD-5, right?
SPD-7 is on PNT, and the only section within SPD-7 that touches on cybersecurity is the recommendation that governments and private sectors should have cybersecure GPS, which is a really good general-level, right, principle to follow.
What does that really mean?
It doesn't get into it.
Other things are Executive Order 14028, Improving the Nation's Critical Infrastructure, which is really a reflection of the importance of increasing sort of the growing importance of the commercial sector for different types of critical infrastructure.
We have, you know, 16 different critical infrastructure sectors, and each of them with a growing commercial nexus.
14028 calls on things like everybody should have sort of zero-trust architecture or principles in mind when developing their network architectures.
They should have encryption, they should have incident response plans and incident planning measures in place.
13905 also again touches on PNT to the extent that there should be some additional government and private sector collaboration.
13636 is the one that provides sort of NIST, the directive, the National Institute for Standards and Technology, the directive to come out with a cybersecurity framework for mostly critical infrastructure sector owners and operators.
And so this is just highlighting a couple of the national-level policies in place that should help critical infrastructure owners and operators, noting that when it comes to space system cybersecurity, again, it's really only SPD5.
And so with that...
To further complicate the landscape here, I think what we would say is that if the policy environment that we noted on the previous slide is not complex enough, then the U.S.
government-only standards and requirements landscape is even more complex across commercial, federal, and an integrated kind of batch of requirements.
Yeah, so these are again a snapshot of some of the relevant standards and guidelines that are out there that the space systems community can rely on or leverage voluntarily.
And so this does not cover your international standards for IT systems.
This does not cover every single government entity that has ever developed a directive or something like that.
This also does not cover every single standard or guideline that touches on IT or OT security.
But these are sort of a very, I think in our opinion, a complicated web, a snapshot of the ones that would be the most relevant.
And so in terms of for the applicability to different segments of space, so we're thinking ground, link, user, space, there just isn't one that touches on every single segment, right?
And so with those specifics in mind... Yeah, so I think that that is, we'll talk a little bit later about some of the work that we've been doing in terms of outreach to industry and listening to how our private sector partners in particular perceive this web of standards.
But in particular, what we have taken away from those conversations is that a lot of these standards, which I'll touch on a couple of them, are applicable to kind of broader information security requirements and, you know, protection of kind of controlled information,
but not specifically tailored to the space systems environment.
And that's really a challenge when we're thinking about the differences and how we should think about securing space systems as opposed to kind of terrestrial and other sorts.
And so a couple of requirements that we would flag, just maybe starting from the commercial side of the house, might be, you know, NIST standard SP 800-171, which is derived from, on the other side, the federal requirement for, you know, NIST SP 800-53.
But that sort of crosswalking takes place in kind of the context of NIST standards, which are voluntary requirements.
And then as Tanya noted there, there's kind of a few specific standards that apply, specifically apply to the space systems environment.
And one of them, and actually recently released, and we would highlight for this audience, is NIST interagency report 82-70, which is, which applies the cybersecurity framework to satellite operations.
And so that's a specific requirement that focuses on space systems.
But many of the others, especially I would say on the federal government side of the house, are much more tailored broadly to information security.
And so, again, to the element of kind of complication, I won't confuse us all by going into the specific weeds, but just for one example, CNSSI 12-53, which is a federal standard, includes 389 controls, which are cybersecurity controls, compared to, on the other side,
NIST 800-53, which includes 262 controls.
And further to some of the questions and conversations that we've had with our private sector partners, it would take, it has taken us kind of a binder about, you know, this thick, to kind of read through and understand this landscape here, much less for our private sector partners,
who honestly have to invest resources, have to invest in, you know, personnel and man and woman power to kind of apply, understand this complex compliance environment, which in many cases takes away from kind of the tradeoff between actually being able to think about how to address the specific risks by trying to understand how to comply with the complex landscape.
So that's what we would leave you with from this slide.
All right.
So maybe transitioning into what we've been doing, in particular, Tanya and I, and another member of our team, Anjana and the audience there, we have been traveling around the country for the last, ever since that executive forum that took place in March,
which was a kind of CEO-level event.
But we immediately realized, or we immediately took the parallel approach of engaging with working-level, kind of on-the-ground technical experts who were thinking about these issues on a daily basis.
And so we have been on a roadshow.
We started off in California at the end of April, where we, the companies there were primarily sort of your, you know, California startup, very kind of cutting-edge companies.
And we went to, we held an event at the White House in Washington in June.
We held an event at the Kennedy Space Center later in June.
We went to Colorado Springs.
We were at U.S.
Space Command a couple weeks ago.
We held an international engagement with international companies just this week.
We will go to Texas and Houston, should any of you be in the area and like to participate in our conversations there, later this week.
And that has led us to a total number of...
Yeah, so just a couple things to flag here, right?
The numbers have been updated a little bit from when we submitted these slides.
So the international workshop that we held earlier this week had, you know, roughly 55 participants total in a hybrid sort of virtual in-person environment.
We had multiple different international space agency equivalents, as well as some of their regulating entities and different industry representatives as well.
And total participants so far, right, that makes it about 260 across sort of U.S.
industry, international industry, U.S.
government agencies, international space-related agencies, and including sort of your information sharing and analysis organizations, as well as different industry associations.
So it's been sort of a wild ride so far.
And then we are sort of going to end all of this in Texas.
And I think maybe the other point to make here is that what the fact that we have been kind of investing our, you know, White House resources, time, and energy in traveling around to hubs of space industry across the country and listening, very much listening to our private sector partners,
I think speaks for us, speaks to the fact that you can't think about securing the space ecosystem, especially in the United States and as well as abroad, without having a private sector-first informed approach.
And that's what we're going to look to take back into the U.S.
government internal sort of policy process.
Yeah.
And so to close out this part of the slide, right, or the presentation, what have we learned?
What are our key takeaways?
So far, we talked to small, medium, and large-sized companies.
And really, one of our first key takeaways is when it comes to cybersecurity by design, how are these different-sized companies thinking about baking in cybersecurity by design through each aspect of the product life cycle?
And what we're getting is that people all have different, no matter what the size is, even large company to large company, medium to medium, small to small, right, they're not going to have a same set of opinions in terms of what standards, what guidelines,
what best practices to even follow, right?
There is a missing sort of standard baseline there that everybody can agree on.
And then the second, right, is about resourcing.
Resourcing not just from a monetary challenge, but also from a people perspective, right?
We talk often about the fact that this is a community where it's traditionally been aerospace engineers and then cybersecurity or network engineers and the like, right?
And so those two have not traditionally talked.
And then what we're saying right now is that your rocket scientists need to also appreciate cybersecurity or have at least an understanding of the risks and the threats associated.
And the cybersecurity folks need to understand some of the priorities from the engineering side.
And so there's a resourcing challenge in terms of how do you even find these people, right?
Where are these pink unicorns?
And we don't really know where they are, right?
The government agencies are struggling.
Private industry is struggling.
And so this is a huge resourcing challenge.
And this is, I think, why in terms of what we've done, what ONCD has done earlier, right, in issuing the National Cybersecurity Workforce Strategy is really imperative in that these conversations are going to be flushed out further in terms of how do we create incentives?
How do we create mechanisms that helps alleviate some of the stress of just finding people to do the work?
And then I think there were a couple other key takeaways, right?
The next one being differences in sort of contractual language that industry is faced with.
So when you think about companies that want to do business with the government, a lot of the requirements that they have to follow comes from contracts.
And so from those contracts, there may be cybersecurity requirements that are not complete or are limited in scope or not actually applicable to space systems.
And so that gets us back to the issue of the lack of standards, the lack of applicable standards in the earlier slide for different aspects of the space ecosystem that is highly complex and very segmented.
Yeah, maybe last but definitely not least because we have learned so much from these conversations.
We've had very lively conversations related to information sharing and specifically whether or not that is being done well in a kind of bi-directional manner from the federal government to the private sector.
And when we receive information from the private sector, is it coming back in a way that allows the private sector to be able to address the threats that they're facing?
And also have heard generally that that information from the federal government in particular is not always actionable or in kind of less cases than we would like as government officials, it is not actionable.
And so that's another key takeaway that we are taking from this conversation.
So how to get involved now that we've talked about how what we're doing, how do you actually get to help?
And so we actually have two things on here, not just one, but the first that we'll touch on is regulatory harmonization.
So we recently issued a request for comments or request for information from the public on different types of regulation that might be impacting their companies or their organizations and how do we actually harmonize some of what may be perceived to be competing or contradictory regulations.
And so for the space community, right, why this is relevant, right, space is not yet designated as a critical infrastructure sector formally within the U.S.
However, even when you're talking about some companies that have a global footprint, right, you're talking about a lack of standards or regulations within the U.S., but then you may have certain companies like the U.K.
or even the E.U.
that have designated space as a critical infrastructure sector.
And so how are the regulations that even companies are following internationally contradicting with some of the standards or guidelines that companies need to follow in the U.S.
and what is the delta there, as a perfect example.
The second one is really just to better understand what are the standards and frameworks that you all are following and really just a listing of them so that we can add them to that really complicated chart that we showed you earlier.
But it's really just to figure out what mechanisms are you all using when it comes to making sure that you are following with regulations or lack thereof, right.
And then also to touch on that, right, even when your specific space assets in the development of them, you might leverage cloud services.
And so cloud is not a regulated sort of type of service within the information technology sector, but many of you that touch on cloud or use cloud services may be a regulated entity because you touch on other or you provide services to another critical infrastructure sector that actually is regulated.
And so in that sense, when we think about cloud as 65% of cloud or tax against cloud is from misconfigurations, right, it's something where we definitely want to hear from the community in terms of how is this impacting you, how do you view this issue,
are there competing sort of requirements or regulations or standards that you all are thinking, well, this applies to my work here for this sector, but it doesn't necessarily translate over to my work or my product in this space sector.
And then last but not least, and so hot off the presses that it is not on this slide, ONCD also recently released an RFI related to open source software, and our colleague Anjana and I see others who are involved in the development of that are here today,
and we have further had very lively debates in our conversations with commercial space operators about, you know, what the federal government guidance and our prioritization of utilizing memory safe software languages in everything that we do, what that means for the space ecosystem.
And so that makes it very exciting for us here today to announce that we have an RFI that is open.
It was just released this week, so it's not up on here, but if you just Google White House RFI, or ask any one of us and we can share the link with you.
I believe the deadline to provide information back to us is on October 9th.
And so given the security risks, obviously, related to utilizing open source and commercial off the shelf software, we are looking for information as the White House to help the development and kind of build out of a strategy or action plan related to moving toward the usage of memory safe languages in the future and going forward in order to reduce the vulnerabilities related with the use of kind of the opposite.
And so with that, those are two kind of open out for public comment RFIs that we very much urge and ask for your active engagement with, because there are ways for us as a government to hear from all of you and help inform the direction that national strategy and policy takes.
And so with that...
I guess we'll take some questions if you have them for us.
Thank you for that.
So I guess the question is, NASA has some particular ways of going about doing their business.
How have we worked with them?
Great.
Yeah.
Okay.
So NASA has been an integral player in all of the workshops that we've been convening.
They've been listening to the input from industry and as well as providing some of their own thoughts, maybe some of their limitations as well.
And so it's actually been really helpful to have not just the private sector owners and operators in the room, but also the ones that are responsible for a lot of the government scientific missions and all of that.
So it's something that I think we will flesh out further when it comes to actual solution space, but it's something that we definitely have had their input on nearly every single workshop.
Yeah.
And kind of speaking of the real, you know, rocket scientists, which we are policy people and the rocket scientists and then the cyber security experts, yes, our NASA colleagues have really provided that deep, deep subject matter.
You know, what are the differences and what are the challenges of operating on orbit, particularly for NASA systems kind of input into all of the conversations.
Hey, so the RFI that you put out on the memory safe, what was the driver for that specifically?
Was that feedback from industry that they really needed memory safe implementations on board as they feel like that's like the biggest threat vulnerability that they're dealing with?
Yeah, I think specifically, right, it's one of the implementation prongs within, well, it's specifically called out within the national cyber security strategy under shaping market forces.
So under that construct, we're saying, you know, it's not just up to the sys admin or whomever that is, you know, literally monitoring some traffic day in and day out and relying on them to be having a good day or a bad day that an entire sort of network outage happens.
Right.
And so every moving sort of accountability from maybe different levels of of the software that people use or the applications that they use, right, moving that accountability to different players maybe makes more sense.
And so I wouldn't necessarily say that that was just simply, you know, ONCD saying, okay, no, this looks like a really good thing.
Let's let's work on this.
I would say that a lot of this is also, you know, the National Security Agency says they've also come out with a lot of really good material to talk about some of the inherent risks in different types of programming languages, not to say that those programming languages are unsafe in and of themselves,
but perhaps how they are being exploited, right, is and how do we best address that.
And I think this is what this RFI is getting at, right?
What are the perspectives out there in terms of memory safety?
Is it an issue, right?
Do people I mean, we've heard both sides extensively, right?
We've heard that, you know, there's, you know, memory safe languages, right, can also be exploited.
And I think there's a DEF CON workshop on that.
But it's really how do we make sure that that there is a discussion around what is sort of the solution that we can all agree on to make sure that the software that we that we use, the off-the-shelf software that we use can be more secure.
Yeah, and maybe to the to the purpose of the RFI and truly the request for for information and for feedback, particular to, you know, this space ecosystem as well as to other sectors.
Again, we have learned along the way, including by very much leveraging our NASA, you know, colleagues expertise, some of the challenges that come with thinking about, you know, space systems that are a legacy that are being developed today and that will be developed in the future.
And particularly for those legacy systems, what, you know, migration to memory safe languages might mean or imply.
And so that's that is very much why we we open the door to feedback.
So you've talked pretty specifically about space and there's a lot of overlap in the civil airspace and defense air military airspace sectors.
Do you see the initiative that's going on in space flowing out to contribute to those regulations or do you think that's more of a start over because they come from a lot of different, you know, FAA and DOD and so on because they they get regulated differently?
Yeah, I think the way I would answer that is also in an RFI context to the RFI that Tanya noted related to broader regulatory harmonization.
I think that that RFI is very much open-ended in the sense that it's not scoped to any particular infrastructure sector or just sector in general because I think we do very much recognize kind of the broader just the broader criticism as well as reality that there are just so many different regulations and so many different requirements across different federal government agencies that apply to to each different sector.
And so harmonization as a as a goal and as an objective is one that we are looking for for your your input and moving toward.
Yeah, and then to the point of or to the question of, you know, can sort of what we're doing here be modeled for our work in other sectors?
I think absolutely is the answer, right?
And we only started focusing on space earlier this year, right, around the time of when the the National Cybersecurity Strategy was released.
And so it's something where this is our first attempt to take a focused look at how do we have better conversations?
Like we keep on talking about public-private partnership, but really what does that mean?
How do we actually take this conversation on the road to meet industry where they are?
And so that we can have localized perspectives from every single location, right?
And so I think this is absolutely a model for even conversations that we that we could potentially have with other other critical infrastructure that may not be designated as a critical infrastructure yet, right?
We don't necessarily, and I think we saw this with election systems, right?
The bad thing happened and then the sector was declared.
We want to sort of get ahead of that to say this is something that we see based on, you know, all of the growing market trends for that, you know, exponential growth that we saw earlier.
We see sort of different attack vectors for connected space assets.
We see our adversaries sort of exponentially looking at how do they not just go after our assets, but also proliferate their own space assets.
And so there's this whole sort of trend in terms of how do we not just look at this as an important domain when something bad happens and then think should we declare this as a critical infrastructure sector, then slap on some regulations and make one government agency accountable.
We're saying this is something that we're seeing as sort of the maturity or sort of the growth of this industry right now.
And we really want to have those conversations before anything bad really does happen to our own assets here in the U.S.
Yeah, I guess maybe the very, very last point I'd make on that is that it also, having these conversations with industry related to space and being humble, I think, we have tried to be in terms of kind of our listening posture.
It's also helped us challenge our own kind of assumptions when it comes to, you know, what the right policy approach might be or what a specific, you know, policy adjustment might be needed specifically in that, you know, space policy directive five context.
But I think very much is something that, you know, our offices is committed to across all sorts of different sectors and hopefully, I think, across the government at large.
So you have the, actually just on the next slide, you have the list of like the myriad of applicable frameworks.
And I'm just kind of curious, because let's take like 853, for example, there's like a thousand and eight controls there.
And the feedback you're getting from the commercial side is there's just there's a lot, right?
I could sympathize with that.
But I'm curious, because that really kind of jumps to step three, step one and two is about tailoring and implementing those controls and using threats to define like, what is the subset?
It's like a catalog that you're supposed to... where do you think the disconnect is?
Or what have you been hearing about the disconnect that informs and helps industry, like have an approach and methodology to making sure that you select the right subset of controls.
And you don't worry about a thousand and seven things, but you worry about the right 90 things.
My quick answer on that would be that the right 90 set of controls for any one of these standards, right?
Which multiplies when you're talking about the complexity of the landscape that exists right now without kind of a common baseline standard.
And so I think that just it speaks to the amount of time and energy and kind of expertise that's required, especially for smaller companies if they're kind of starting from scratch and have to pick up where things exist today.
So I think even with that subset of controls, it scales quickly when you look at that standards environment.
Yeah, and I'll go back to the resourcing point that we made earlier, right?
And so we're talking about, I mean, even the stuff that we've listed here, we're talking like maybe 2,000 pages worth of reading and churning through and trying to figure out which ones apply to your segment or which one applies to your specific company.
And so it's something where just from a resourcing perspective, like are you hiring people to just do reading and do compliance checks?
Or are you really wanting to build people who understand the unique infrastructure that they're dealing with, right?
And you're not going to get that if you're just going to have people sitting there day in and day out churning through these documents and these pages.
And so even right here, right, you see there's a lot more on the federal side than there is on the commercial side when we're talking about companies that do business with government infrastructure, right, the ones that directly support national security systems.
You're seeing even just a small smattering of different CNSS policies that are out there, but that's just for national security systems.
Who's making the checks to make sure that those aren't conflicting with what is available for commercial industry?
And I mean, with the sort of dual use nature of a lot of our space infrastructure, how do you actually just segregate the two types of requirements, right?
And so there's that type of harmony that is kind of missing right now just from even this snapshot.
So one of the feedbacks I've gotten from customers is that designated national security systems is like, why are we doing all this?
To his point, they seem to jump to step three and ignore step one and two.
And then my response has been, well, we're supposed to tailor these.
And they seem to not understand that point.
And after a lot of long conversations, we kind of come to a mutual point.
But is the guidance... I guess my question is, is the White House going to try and clarify that?
Are they just going to let the DOD and the DHS and the various branches put out their own guidance?
Because it is really wildly complicated, but they don't seem to understand that at first.
I think part of that, right, the challenge that you're talking about has to do with the availability of the contextual information that puts things into perspective for industry.
And so a lot of the things... I mean, Lauren touched on the key finding that we had, or the key takeaway that we had from all of our conversations in terms of the disparity in how information was getting passed from government to private sector.
We're talking about classified things that maybe shouldn't be classified.
We're talking about the speed of things that should be... the lack of speed makes things not actionable.
Or even the relevance of things that are shared are just not relevant for whatever industry that they're sharing to, right?
And so even from that perspective, I think contextualizing or even working on ways to make it... make some of the standards and the requirements a little bit more contextualized in a uniform manner, that is something that we're trying to examine right now in terms of how do we improve even the reasons why somebody needs to focus on these types of risk measures.
Yeah, and then instead of only, as we've been doing for the last several months, kind of gathering information from the private sector and seeking your perspectives, which has been incredibly helpful and important, we have, in parallel, been having conversations with our interagent... with our federal government partners as well,
just because of exactly the landscape that exists and because private sector is engaging with multiple government agencies, which have multiple requirements.
So we are thinking about both of these things in parallel from the White House point of view, and it's a hard challenge, but it's been a very intellectually stimulating one, and we'll continue with it into the future.