INDUSTRY FACT FILE · SPACE, SATELLITE & GEOSPATIAL SERVICES

Cybersecurity FAQs for Space, Satellite and Geospatial Businesses

Forty frequently asked questions and answers in five categories, written for Boards and founders, CISOs and compliance teams, engineering and mission teams, ground and network operations, and data, supply chain and response teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Space, telecom, CERT-In and regulatory requirements 3.  Category 3: Satellites, mission control, launch and engineering 4.  Category 4: Ground stations, satcom networks and platforms 5.  Category 5: Data, supply chain, privacy and incident response

Audience: Boards, founders, CEOs and business leadership

Q1. Why is cybersecurity a concern for space and geospatial businesses?

Because every space service depends on computers on the ground. Ground stations, mission control, satcom networks, cloud platforms and APIs can be attacked like any IT system, and the result can be silenced terminals, missed passes, a misused satellite or leaked imagery and location data.

Q2. What are the biggest cyber risks in the sector?

Ground station and management network intrusion, misuse of command access and keys, malicious terminal updates, API and cloud flaws, supply chain compromise, ransomware on engineering IT, location data exposure, vendor remote access and slow detection that misses CERT-In's six-hour window.

Q3. Which public developments should leadership know about?

The February 2022 KA-SAT attack that disabled tens of thousands of terminals through the ground segment, ISRO's report of more than 100 attacks a day in 2023, India's Telecom Cyber Security Rules 2024, GNSS interference near Indian airports and the proposed EU Space Act.

Q4. Is space cybersecurity an IT problem or a leadership problem?

A leadership problem. One compromised management network or command path can trigger outages for many customers, licence and authorisation questions, lost government contracts and investor concern at once. Boards must fund secure engineering and monitoring and see evidence that controls work.

Q5. What should the Board review each quarter?

Ground network and management plane exposure, privileged and vendor access exceptions, command key custody, API and platform test findings, supplier assurance status, SOC coverage, incidents reported to CERT-In and the telecom authority, DPDP progress and readiness for customer and foreign partner requirements.

Q6. Who should own cybersecurity in a space or geospatial firm?

A CISO or head of security working with mission, ground operations, network, platform, procurement and the data protection officer, with a Board mandate and one inventory of satellites, ground systems, networks, platforms, keys, vendors and data stores.

Q7. How should we prioritise investment?

Lock down management planes, command paths and keys first, then segment ground networks and broker vendor access, test APIs and cloud platforms, assure critical suppliers, minimise location data, and build 24x7 monitoring and incident readiness over successive cycles.

Q8. How can Codec Networks help?

Codec Networks provides ground station and satcom network assessments, mission control and key custody reviews, API and cloud testing, identity and vendor access reviews, supply chain assurance, CERT-In empanelled audits, DPDP programmes, managed SOC and incident response for space and geospatial businesses.

Audience: CISOs, compliance, legal, regulatory affairs and audit teams

Q9. What does the Indian Space Policy 2023 change?

It sets out the roles of ISRO, NSIL, IN-SPACe and private entities, allowing non-government entities to build and operate satellites, launch vehicles and ground facilities and to sell services, subject to IN-SPACe authorisation. The Department of Space implements the policy.

Q10. What do IN-SPACe's authorisation norms cover?

IN-SPACe's Norms, Guidelines and Procedures of May 2024 set out which activities need authorisation, such as operating space objects, launch and establishing ground systems, the eligibility criteria and registration of space objects. Confirm current requirements with IN-SPACe before applying.

Q11. Can foreign satellites provide capacity in India?

From 1 April 2025, only foreign satellites and constellations authorised by IN-SPACe may provide capacity in India. Service providers using foreign capacity should confirm the authorisation status of each satellite and the conditions attached to it.

Q12. How has foreign investment in space changed?

The February 2024 FDI amendment allows up to 74% through the automatic route for satellites, data products and ground and user segments, 49% for launch vehicles and spaceports and 100% for components, with higher stakes possible through the government route.

Q13. Do the Telecom Cyber Security Rules apply to satcom providers?

They apply to telecommunication entities, which can include licensed satcom service providers. Notified on 21 November 2024, they require security incidents to be reported within six hours with details within 24 hours, a Chief Telecommunication Security Officer and security operations. Confirm applicability against your licence.

Q14. What do CERT-In's Directions require?

Service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them, keep ICT logs for 180 days in India and synchronise clocks. Ground systems, NMS, cloud and API logs should be designed with this in mind.

Q15. What do the Geospatial Data Guidelines require?

Since 15 February 2021, most acquisition and publication of geospatial data and maps in India needs no prior approval, security clearance or licence, but a list of sensitive attributes may not be shown and entities self-certify compliance. Confirm current DST guidance for your products.

Q16. Does the DPDP Act apply to location data?

Yes, where location data relates to identifiable people, such as drivers, field staff or app users. Organisations need lawful purposes, notices, minimisation, retention limits, reasonable safeguards and breach intimation, with most DPDP Rules obligations applying from May 2027.

Audience: CTOs, mission, flight software, launch and engineering teams

Q17. How should command access to a satellite be protected?

Restrict command rights to named, MFA-protected roles, authorise and log every command, hold command and encryption keys in hardware with controlled custody, isolate mission networks from corporate IT and monitor command and scheduling activity for anomalies.

Q18. What does a mission control review cover?

Mission control and TT&C software, flight dynamics and scheduling tools, command authorisation and logging, key custody, privileged access, network segmentation, engineering laptops, backups and how the team would detect and respond to an unauthorised command.

Q19. How do we protect flight software and its updates?

Build in protected pipelines, sign and verify images, keep an SBOM, test on isolated benches, control who can approve uploads, verify what is loaded against known-good hashes and keep records that prove what software is running in orbit.

Q20. How should we assure supplier components and software?

Assess suppliers' security and update processes, require SBOMs and integrity evidence, verify delivered images, test samples on isolated benches, include notification and audit clauses in contracts and reassess critical suppliers at least annually.

Q21. How should launch start-ups secure test and range sites?

Segment test stands, cleanrooms, telemetry and range networks from business IT, control engineering laptops and removable media, broker vendor access, keep tested offline backups and include these sites in independent OT audits.

Q22. How do we protect designs and mission data?

Restrict CAD, PLM and repositories by role, use MFA, monitor large downloads and unusual access, encrypt laptops, control sharing with partners, remove access promptly when people leave and align controls with export control and contract terms.

Q23. Can a satellite itself be hacked?

Attacks on spacecraft are rarer and harder than attacks on the ground, but weak command authentication, poor key custody or tampered software can expose them. Most practical risk sits in the ground systems and people who command the satellite, so that is where assurance should start.

Q24. How does Codec Networks test mission systems safely?

Codec Networks agrees scope, windows and safety controls with mission teams, tests ground and mission systems without affecting live passes or spacecraft, uses test environments where possible and performs any link testing only with authorisation under the applicable licences.

Audience: Ground operations, network operations, platform and DevSecOps teams

Q25. What should a ground station assessment cover?

Antenna control units, modems and baseband equipment, scheduling and booking systems, links to mission control and the cloud, segmentation between customers and from corporate IT, vendor access, logging and how quickly the station could recover from ransomware.

Q26. How do we secure a satcom management network?

Protect every management and VPN account with MFA, remove shared and default accounts, segment NMS and update servers, restrict which systems can reach terminals, monitor management activity and test the network regularly, as CISA and the FBI urged after the KA-SAT attack.

Q27. How should terminal updates be protected?

Sign firmware and configuration updates, have terminals reject unsigned or downgraded images, stage updates to a small group first, watch for abnormal behaviour before full roll-out and keep a tested plan for recovering terminals if an update goes wrong.

Q28. What should we test in an EO or geospatial API?

Authentication, object-level authorisation on every order, tasking and delivery call, tenant isolation, rate limits, retirement of old versions, storage and download link controls, logging and the ability to detect enumeration and bulk downloads.

Q29. How should cloud ground segment deployments be secured?

Use separate accounts per environment, least-privilege roles, private storage by default, managed secrets and keys, secure portal authentication with MFA, logging to a central SOC and regular configuration reviews against recognised benchmarks.

Q30. How should vendor remote access be handled?

Use named accounts with MFA, time-bound approval for each session, a brokered jump host rather than always-on tunnels, session recording and least privilege, and review vendor access with each customer at least quarterly.

Q31. How can link and receiver resilience be tested responsibly?

Only with authorisation, in controlled environments, under the applicable licences and permissions, coordinated with the customer. Codec Networks focuses on how systems detect and respond to interference and reviews encryption, integrity checks and fallbacks; it does not generate interference outside such conditions.

Q32. How does Codec Networks assess ground and network operations?

Codec Networks reviews ground stations, teleports, hubs, NMS, terminals, cloud platforms and APIs, with testing scheduled in agreed windows that protect live passes and customer services, and maps findings to licence conditions, CERT-In requirements and customer contracts.

Audience: Privacy, procurement, security operations and incident response teams

Q33. How do we protect precise location data?

Collect only what the service needs, reduce precision where possible, keep histories for short, defined periods, restrict and log queries, authenticate every API version and review SDKs so they do not collect more than the customer agreed.

Q34. How do we handle sensitive geospatial attributes?

Map your products against the sensitive attribute list in the Geospatial Data Guidelines and any client restrictions, build checks into production and publication workflows, control access to raw data and keep records that support self-certification.

Q35. How should we assess ground and network vendors?

Review their remote access methods, account management, patching and vulnerability processes, incident notification terms and subcontractors, and require evidence such as ISO 27001 certificates or independent test reports for critical vendors.

Q36. What should the SOC monitor in a space or geospatial business?

Management plane and VPN logins, terminal update activity, command and scheduling anomalies, ground station and vendor sessions, cloud and API abuse, privileged account use, engineering repository access and relevant CERT-In advisories.

Q37. What should we do in the first hour after a ground segment incident?

Protect spacecraft and customer services, contain affected accounts and systems, preserve logs and images, assess customer and data impact, report to CERT-In and, where applicable, the telecom authority within six hours, and inform customers and partners as needed.

Q38. How do we investigate a terminal or ground network incident?

Preserve NMS, update server, VPN, ground station and cloud logs, collect affected terminal and server images, build a timeline, compare firmware with known-good versions and confirm the root cause before restoring services.

Q39. Should we run space incident exercises?

Yes. Annual tabletops with leadership, mission, ground and network operations, platform, legal and communications teams, using terminal outage, lost pass, command misuse and data leak scenarios, test decisions on containment, recovery, reporting and customer communication.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your satellites, ground stations, satcom networks, platforms, suppliers, data and obligations; Codec Networks will propose a practical testing, audit and monitoring plan mapped to IN-SPACe, telecom, CERT-In, DPDP and customer expectations.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, regulatory, licensing, spectrum or export control advice. Confirm obligations against the official instruments applicable to your organisation, authorisations, licences and services, the countries you serve and your contracts. Radio frequency and link testing is referred to only as authorised testing in controlled environments, under the applicable licences and permissions.