NIS2 Space Cyber Resilience Portal

The NIS2 Directive asks in-scope organizations to do more than write down their security measures. Article 21(2)(f) requires policies and procedures to assess whether those measures are actually effective, and Article 21(2)(b) and (c) place incident handling and crisis management among the measures in scope. In practice, that means exercising.

H3 is how we answer it: we prepare your organization to run its own exercise, and everything we use is published here at no fee. Below: who we are and the training options behind it.

Who we are What we have already done, the seats we hold today, how we think, and who backs the work.

Proving Duties NIS2 now writes down, carried under real pressure before the Directive made them law.

Satellite ground operations floor during a live incident — Incident handling and crisis management, on the clock · Illustrative image

Technical standards drafting room with spacecraft architecture drawings — Security built into the standard, not bolted on after · Illustrative image

Cybersecurity exercise hall with five team tables — Effectiveness, actually assessed · Illustrative image

1 / 3

The duties NIS2 now writes down are ones we have already carried under real pressure. Not advised on, carried. Each of these was done before the Directive made it a legal obligation, which is the only kind of evidence that means anything.

Incident handling and crisis management, on the clock. Led global cybersecurity operations at a European satellite operator through the February 2022 Viasat attack, when tens of thousands of modems went down across Europe in minutes. That is Article 21(2)(b) and (c) lived rather than documented.
Security built into the standard, not bolted on after. Over 500 hours as Technical Editor of IEEE P3536, from scoping through ballot, plus three peer-reviewed IEEE publications on space system security. That is Article 21(2)(e), security in the development and maintenance of systems, at the level where the requirements are written.
Effectiveness, actually assessed. Ran Operation Electro Magnetic Panic in Madrid in October 2025: five ground-station teams, eight challenges, 21 professionals certified. That is Article 21(2)(f), and the whole pack is published for anyone to check, now being packaged as the first H3 exercise bundle.

Leading The seats where the rules for this sector are still being written, held now rather than once.

Four linked domains drawn as one continuous network — Writing the standard your programme will be measured against · Illustrative image

Exploded view of a satellite bus with components catalogued — Extending supply chain transparency to whole space systems · Illustrative image

Open workshop space with a large taxonomy diagram on screen — Publishing the method instead of selling it · Illustrative image

1 / 3

The work did not stop when the standard reached ballot. We hold the seats where the rules for this sector are still being written, which means your programme is designed against what is coming rather than what has already been superseded. These are current appointments, not past ones.

Writing the standard your programme will be measured against. Technical Editor of IEEE P3536 and lead of its Integration Subgroup, the group making the user, link, ground and space segments hold together as one security picture instead of four.
Extending supply chain transparency to whole space systems. Co-chair of the Space System Extended (x) Bill of Materials Task Force at the Space ISAC, where bill of materials practice long familiar in software is being worked out for spacecraft and the supply chain behind them. That is Article 21(2)(d), before the tooling for it exists.
Publishing the method instead of selling it. METEORSTORM is an official MISP taxonomy, the H3 harness is published in full at no fee for anyone to run, and we are accredited by the Luxembourg Ministry of National Education as an organizer of continuing vocational training. That is Article 21(2)(g) and the sharing Article 29 encourages.

Thinking The Pentagon of Pain: the five transformations that make an adversary pay for the attempt.

The Pentagon of Pain is an internal transformation across departments, mindsets, and priorities, ideally evolving toward a Space Collective Defense community where ISAC information sharing of IOCs, IOAs, detection signatures, and resilience measures raises the bar for real-world platform exploitation. The five points below are reproduced as published.

1Decomposition 2Threat Modeling 3Detection 4Exposure 5Adversary

01 Master Decomposition “The adversary suffers when you know your platform better than they ever can.” Organizations must have a deeper understanding of their platforms than the adversaries targeting them, from development to decommissioning. Engineers reading a full platform breakdown across wall displays

Engineers reading a full platform breakdown across wall displays

Illustrative image

02 Master Contextualized Threat Modeling “The adversary suffers when every strike they imagine is already prepared for.” Organizations must develop an attack to defend capability for their platforms focused on kinetic, non-kinetic, electronic warfare, cyber warfare, and other key exposure domains including naturally occurring threats. Red and blue team tables working the same platform diagram from opposite sides

Red and blue team tables working the same platform diagram from opposite sides

Illustrative image

03 Master Converged Detection Engineering “The adversary suffers when they cannot hide, and every move is seen.” Organizations must evolve into a converged data and signals approach to illuminate complex attack patterns and reduce adversary dwell time. Analyst desk where radio frequency spectrum and network telemetry are read side by side

Analyst desk where radio frequency spectrum and network telemetry are read side by side

Illustrative image

04 Master Exposure Management “The adversary suffers when every path they take ends in a trap.” Organizations must continually enumerate the attack paths created by both exposed and isolated platform elements and work towards platform deception techniques. Attack paths traced across a ground segment map with one route ending in a decoy

Attack paths traced across a ground segment map with one route ending in a decoy

Illustrative image

05 Master Adversary Management “The adversary suffers when their plans are known, broken, and turned against them.” Organizations must align decomposition, contextualized threat modeling, converged detection engineering, and exposure management with real world adversary profiles to detect, disrupt, and deter adversaries targeting their platforms. Mission operations floor tracking a named adversary profile against live platform status

Illustrative image

Sponsors and contributors The partners who fund and pilot the work, and how to become one.

Research and Development Partners

303 Overwatch collaborates with a select group of Research and Development Partners on focused technical initiatives that extend METEORSTORM into domain-specific environments such as maritime, aerospace, orbital, and deep space operations. Each partnership is structured around a defined research topic.

Image Sea Solutions

Community Contributors

Community Contributors are individuals and organizations contributing their time, feedback, and hands-on piloting of METEORSTORM, validating the framework in real-world environments and strengthening the collective defense posture of the international space community.

CyberInflight

Octolution Tech

Become an R&D Partner Become a Community Contributor

What we do We set up your own exercise programme, run the method with you, and train your team. The harness and the training, each in full.

H3 The harness, published in full: how you stand it up, and what it is made of.

The process Setup, then validation, then your first exercise. One guide each.

Planning meeting with role cards and a calendar board a month before an exercise — Prepare: the roles, the hardware, and the baseline rating · Illustrative image

Engineer assembling exercise packages at a workstation the evening before — Build: seven steps, finished a day ahead · Illustrative image

Exercise hall in progress with a moderator capturing an observation — Run: the eight-hour day, an observation at every step · Illustrative image

Compliance lead reviewing a bound after-action report beside evidence folders — Evidence: what the exercise leaves behind · Illustrative image

1 / 4

What an exercise looks like, end to end. Four phases, from the planning you do a month out to the evidence you keep afterwards. The harness is built around them, and every phase leaves a file behind, so what you can show at the end is produced by the work rather than written up after it.

Prepare A month out Agree the people and their framework roles, the hardware and the access, then score your own maturity from 1 to 5 against each part of the process. The rating is the baseline you measure the exercise against. Leaves a maturity assessment
Build Finished 24 hours before Seven steps in the harness: select a cited exercise, review its concept of operations, define the team against NICE and ECSF, generate the analyst data, and write the deployment guide for each tool. It ends with the data imported, not with it generated. Leaves the analyst data, the deployment guides and two verifiable packages
Run The eight-hour day Every seat validated before the first block, then the day worked against the deadlines the Directive sets rather than the ones that are convenient, capturing an observation at each step as you go. Leaves an observation against every step
Evidence Afterwards, and it is the point The after-action report compiles from what the moderator captured on the day. Beside it, which professional roles the exercise actually exercised, and a file naming what could not be evidenced rather than quietly omitting it. Leaves the after-action report, the role coverage, and the honest gaps

How you get there. Three stages, in order, each with a written guide. Validation sits deliberately between setup and the first exercise: an organization that skips it makes its first real exercise double as its first test of the tool. The four phases above all happen inside guide 3.

The platform 20 agents in five bands, and what each one runs on. Read it three ways.

The agents Software AI

The H3 Agent Harness

All 20 agents serve over the Model Context Protocol today, and all 20 answer, from hash-verified copies of published frameworks including MITRE ATT&CK, CAPEC, D3FEND, ATLAS, FiGHT, EMB3D, SPARTA, NIST SP 800-53 and the CSA control matrices, each read with the standard library. The harness still reports a server that cannot read its corpus as such rather than counting one that knows nothing as working.

A · THE CONTROL PLANE

“Hold the state, route every call, record every one.” Two agents, and neither does any of the work.

H3 itself. The window is the standard library, so there is nothing to install for either.

This is the only band where a model runs, which is what makes that question answerable in one place.

h3-core The window: scope, select, review, team, and the analyst-data loop H3 only one model, named in the record
h3-federation Routes every call to every agent, and writes each one into the record H3 only no model

B · READ THE FRAMEWORKS

“Answer from the published frameworks, with a citation.” Ten agents. Install the ones your sector cites.

Each ships its reference bundled and hashed. No agent here reaches the network, ever.

No model. These retrieve and normalize; the generating happens once, in band A.

h3-attack MITRE ATT&CK H3 · bundled reference no model
h3-fight MITRE FiGHT H3 · bundled reference no model
h3-atlas MITRE ATLAS H3 · bundled reference no model
h3-capec MITRE CAPEC H3 · bundled reference no model
h3-sparta Aerospace SPARTA H3 · bundled reference no model
h3-emb3d MITRE EMB3D H3 · bundled reference no model
h3-d3fend MITRE D3FEND H3 · bundled reference no model
h3-aicm CSA AI Controls Matrix H3 · bundled reference no model
h3-ccm CSA Cloud Controls Matrix H3 · bundled reference no model
h3-800-53 NIST SP 800-53 H3 · bundled reference no model

C · PRODUCE THE DATA AND THE DEPLOYMENT GUIDES

“Turn the accepted enumeration into the material an exercise runs on, and the guide to stand each tool up.” The tooling is Maltego and MISP.

Only h3-maltego and h3-misp need anything installed beyond H3 itself, and each writes its own deployment guide.

None of these calls a model. They transform a record a person already signed.

h3-maltego Entities, links, exact answers about the graph, and the Maltego deployment guide H3 · Maltego CE no model
h3-misp MISP events, tagged, loadable and purgeable, and the MISP deployment guide H3 · MISP no model
h3-ccsds Synthetic spacecraft telemetry, on by default, dropped when a scenario’s scope has no telemetry angle H3 only no model

D · MAP THE PEOPLE

“Say which professional roles the exercise actually exercised.” Install one, or neither.

Each ships its framework data pinned, so both work offline.

No model. Coverage is computed from the record, never estimated.

h3-nice NICE work roles, and which tasks the exercise covered H3 · NICE Components v2.2.0 no model
h3-ecsf ECSF profiles, and ENISA’s NIS2 role mapping H3 · ECSF v1 no model

E · DELIVER THE PACKAGE

“Assemble it, hand it over, and deploy it only if asked.” Three agents, in that order.

H3 only, until you deploy. What deployment needs depends on the target you choose.

No model. A package is assembled from the record by rule, never composed.

h3-package The analyst data, the tool deployment guides and the record, with a hash per file H3 only no model
h3-deliver Hands it over in your format, and says what is needed to run it H3 only no model
h3-deploy Presents the options and stops. Deploying needs a person who names themselves H3 · whatever the target needs no model

Each agent is a separate MCP server None of them is required by another

What this agent needs installed H3 itself has no dependencies at all

One model, in h3-core, and nowhere else in the product The other 19 agents look things up, transform files, or write deployment guides

Training options The SCOR micro-credentials: Associate and Practitioner, prices, and preregistration.

Instructor leading an evening online cohort with a five-point diagram on screen — SCOR Associate: live instructor led, evening cohorts · Illustrative image

Team working a spacecraft digital twin during a scored simulation exercise — SCOR Practitioner: your platform flown under simulation · Illustrative image

Instructor walking one team through a five-function diagram in a training room — The five functions, delivered privately for your team · Illustrative image

1 / 3

Everything above is yours to run. Some organizations want the method taught rather than read, want their team assessed rather than self-assessed, or want a credential at the end of it. That is what the SCOR micro-credentials are for. They are how the work above is sustained.

SCOR Associate

250.00 EUR

150.00 EUR for Space ISAC members

Four hours, live instructor led, evening cohorts in CET
All five functions worked in order against a scoped scenario
Covers the NIS2 Directive and Space ISAC information sharing
Closes with a 25 question workforce readiness assessment
4 CPE credits

Preregister

SCOR Practitioner

2,500.00 EUR

1,500.00 EUR for Space ISAC members

Eight hours, live instructor led, evening cohorts in CET
Everything in Associate, then your team flies it under simulation
A digital twin of the platform you defend, deployed on a real spacecraft simulation platform
Five scored missions, closing with a full incident response exercise flown and scored
8 CPE credits

Preregister

The five functions are also taught one at a time, one hour each, scheduled on demand, or delivered privately for your team: start an organizational request.