Portal

NIS2 Space Cyber Resilience Portal

Art.
21(2)(f)

The NIS2 Directive asks in-scope organizations to do more than write down their security measures. Article 21(2)(f) requires policies and procedures to assess whether those measures are actually effective, and Article 21(2)(b) and (c) place incident handling and crisis management among the measures in scope. In practice, that means exercising.

Legilux

303 Overwatch A.S.B.L, a Luxembourg non-profit, publishes the method and the harness here at no fee so that you can run your own exercise. Accredited by the Luxembourg Ministry of National Education.

Directive (EU) 2022/2555, Articles 20, 21, 23 and 29. National transposition varies by Member State: see the infrastructure map. Check whether NIS2 reaches your space operation in five questions. Who we are and what we do are one fold down.

See the training options

Who

Who we are

What we have already done, the seats we hold today, how we think, and who backs the work.

Proving

Duties NIS2 now writes down, carried under real pressure before the Directive made them law.

Incident handling and crisis management, on the clock. Illustrative image.
Security built into the standard, not bolted on after. Illustrative image.
Effectiveness, actually assessed. Illustrative image.

The duties NIS2 now writes down are ones we have already carried under real pressure. Not advised on, carried. Each of these was done before the Directive made it a legal obligation, which is the only kind of evidence that means anything.

Incident handling and crisis management, on the clock. Led global cybersecurity operations at a European satellite operator through the February 2022 Viasat attack, when tens of thousands of modems went down across Europe in minutes. That is Article 21(2)(b) and (c) lived rather than documented.
Security built into the standard, not bolted on after. Over 500 hours as Technical Editor of IEEE P3536, from scoping through ballot, plus three peer-reviewed IEEE publications on space system security. That is Article 21(2)(e), security in the development and maintenance of systems, at the level where the requirements are written.
Effectiveness, actually assessed. Ran Operation Electro Magnetic Panic in Madrid in October 2025: five ground-station teams, eight challenges, 21 professionals certified. That is Article 21(2)(f), and the whole pack is published for anyone to check, now being packaged as the first H3 exercise bundle.

Leading

The seats where the rules for this sector are still being written, held now rather than once.

Writing the standard your programme will be measured against. Illustrative image.
Extending supply chain transparency to whole space systems. Illustrative image.
Publishing the method instead of selling it. Illustrative image.

The work did not stop when the standard reached ballot. We hold the seats where the rules for this sector are still being written, which means your programme is designed against what is coming rather than what has already been superseded. These are current appointments, not past ones.

Writing the standard your programme will be measured against. Technical Editor of IEEE P3536 and lead of its Integration Subgroup, the group making the user, link, ground and space segments hold together as one security picture instead of four.
Extending supply chain transparency to whole space systems. Co-chair of the Space System Extended (x) Bill of Materials Task Force at the Space ISAC, where bill of materials practice long familiar in software is being worked out for spacecraft and the supply chain behind them. That is Article 21(2)(d), before the tooling for it exists.
Publishing the method instead of selling it. METEORSTORM is an official MISP taxonomy, the H3 harness is published in full at no fee for anyone to run, and we are accredited by the Luxembourg Ministry of National Education as an organizer of continuing vocational training. That is Article 21(2)(g) and the sharing Article 29 encourages.

Thinking

The Pentagon of Pain: the five transformations that make an adversary pay for the attempt.

The Pentagon of Pain is an internal transformation across departments, mindsets, and priorities, ideally evolving toward a Space Collective Defense community where ISAC information sharing of IOCs, IOAs, detection signatures, and resilience measures raises the bar for real-world platform exploitation. The five points below are reproduced as published.

1Decomposition 2Threat Modeling 3Detection 4Exposure 5Adversary

Engineers reading a full platform breakdown across wall displays — Point 1, Master Decomposition. Illustrative image.

Red and blue team tables working the same platform diagram from opposite sides — Point 2, Master Contextualized Threat Modeling. Illustrative image.

Analyst desk where radio frequency spectrum and network telemetry are read side by side — Point 3, Master Converged Detection Engineering. Illustrative image.

Attack paths traced across a ground segment map with one route ending in a decoy — Point 4, Master Exposure Management. Illustrative image.

Point 5, Master Adversary Management. Illustrative image.

1

Master Decomposition

“The adversary suffers when you know your platform better than they ever can.”

Organizations must have a deeper understanding of their platforms than the adversaries targeting them, from development to decommissioning.
2

Master Contextualized Threat Modeling

“The adversary suffers when every strike they imagine is already prepared for.”

Organizations must develop an attack to defend capability for their platforms focused on kinetic, non-kinetic, electronic warfare, cyber warfare, and other key exposure domains including naturally occurring threats.
3

Master Converged Detection Engineering

“The adversary suffers when they cannot hide, and every move is seen.”

Organizations must evolve into a converged data and signals approach to illuminate complex attack patterns and reduce adversary dwell time.
4

Master Exposure Management

“The adversary suffers when every path they take ends in a trap.”

Organizations must continually enumerate the attack paths created by both exposed and isolated platform elements and work towards platform deception techniques.
5

Master Adversary Management

“The adversary suffers when their plans are known, broken, and turned against them.”

Organizations must align decomposition, contextualized threat modeling, converged detection engineering, and exposure management with real world adversary profiles to detect, disrupt, and deter adversaries targeting their platforms.

Sponsors and contributors

The partners who fund and pilot the work, and how to become one.

Research and Development Partners

303 Overwatch collaborates with a select group of Research and Development Partners on focused technical initiatives that extend METEORSTORM into domain-specific environments such as maritime, aerospace, orbital, and deep space operations. Each partnership is structured around a defined research topic.

Image Sea Solutions

Community Contributors

Community Contributors are individuals and organizations contributing their time, feedback, and hands-on piloting of METEORSTORM, validating the framework in real-world environments and strengthening the collective defense posture of the international space community.

CyberInflight

Octolution Tech

Become an R&D Partner Become a Community Contributor

Research, legal position and identifiers: what we study and publish, the law we work under, and the registers that identify the association.

Session

What we do

We set up your own exercise programme, run the method with you, and train your team.

H3

The harness, published in full: how you stand it up, and what it is made of.

The process

Setup, then validation, then your first exercise. One guide each.

Prepare: the roles, the hardware, and the baseline rating. Illustrative image.
Build: seven steps, finished a day ahead. Illustrative image.
Run: the eight-hour day, an observation at every step. Illustrative image.
Evidence: what the exercise leaves behind. Illustrative image.

What an exercise looks like, end to end. Four phases, from the planning you do a month out to the evidence you keep afterwards. The harness is built around them, and every phase leaves a file behind, so what you can show at the end is produced by the work rather than written up after it.

Prepare A month out Agree the people and their framework roles, the hardware and the access, then score your own maturity from 1 to 5 against each part of the process. The rating is the baseline you measure the exercise against. Leaves a maturity assessment
Build Finished 24 hours before Seven steps in the harness: select a cited exercise, review its concept of operations, define the team against NICE and ECSF, generate the analyst data, and write the deployment guide for each tool. It ends with the data imported, not with it generated. Leaves the analyst data, the deployment guides and two verifiable packages
Run The eight-hour day Every seat validated before the first block, then the day worked against the deadlines the Directive sets rather than the ones that are convenient, capturing an observation at each step as you go. Leaves an observation against every step
Evidence Afterwards, and it is the point The after-action report compiles from what the moderator captured on the day. Beside it, which professional roles the exercise actually exercised, and a file naming what could not be evidenced rather than quietly omitting it. Leaves the after-action report, the role coverage, and the honest gaps

How you get there. Three stages, in order, each with a written guide. Validation sits deliberately between setup and the first exercise: an organization that skips it makes its first real exercise double as its first test of the tool. The four phases above all happen inside guide 3.

The platform

20 agents in five bands, and what each one runs on. Read it three ways.

The agents Software AI

The H3 Agent Harness

All 20 agents serve over the Model Context Protocol today, and all 20 answer, from hash-verified copies of published frameworks including MITRE ATT&CK, CAPEC, D3FEND, ATLAS, FiGHT, EMB3D, SPARTA, NIST SP 800-53 and the CSA control matrices, each read with the standard library. The harness still reports a server that cannot read its corpus as such rather than counting one that knows nothing as working.

A · THE CONTROL PLANE

“Hold the state, route every call, record every one.” Two agents, and neither does any of the work.

H3 itself. The window is the standard library, so there is nothing to install for either.

This is the only band where a model runs, which is what makes that question answerable in one place.

h3-core The window: scope, select, review, team, and the analyst-data loop H3 only one model, named in the record
h3-federation Routes every call to every agent, and writes each one into the record H3 only no model

B · READ THE FRAMEWORKS

“Answer from the published frameworks, with a citation.” Ten agents. Install the ones your sector cites.

Each ships its reference bundled and hashed. No agent here reaches the network, ever.

No model. These retrieve and normalize; the generating happens once, in band A.

h3-attack MITRE ATT&CK H3 · bundled reference no model
h3-fight MITRE FiGHT H3 · bundled reference no model
h3-atlas MITRE ATLAS H3 · bundled reference no model
h3-capec MITRE CAPEC H3 · bundled reference no model
h3-sparta Aerospace SPARTA H3 · bundled reference no model
h3-emb3d MITRE EMB3D H3 · bundled reference no model
h3-d3fend MITRE D3FEND H3 · bundled reference no model
h3-aicm CSA AI Controls Matrix H3 · bundled reference no model
h3-ccm CSA Cloud Controls Matrix H3 · bundled reference no model
h3-800-53 NIST SP 800-53 H3 · bundled reference no model

C · PRODUCE THE DATA AND THE DEPLOYMENT GUIDES

“Turn the accepted enumeration into the material an exercise runs on, and the guide to stand each tool up.” The tooling is Maltego and MISP.

Only h3-maltego and h3-misp need anything installed beyond H3 itself, and each writes its own deployment guide.

None of these calls a model. They transform a record a person already signed.

h3-maltego Entities, links, exact answers about the graph, and the Maltego deployment guide H3 · Maltego CE no model
h3-misp MISP events, tagged, loadable and purgeable, and the MISP deployment guide H3 · MISP no model
h3-ccsds Synthetic spacecraft telemetry, on by default, dropped when a scenario’s scope has no telemetry angle H3 only no model

D · MAP THE PEOPLE

“Say which professional roles the exercise actually exercised.” Install one, or neither.

Each ships its framework data pinned, so both work offline.

No model. Coverage is computed from the record, never estimated.

h3-nice NICE work roles, and which tasks the exercise covered H3 · NICE Components v2.2.0 no model
h3-ecsf ECSF profiles, and ENISA’s NIS2 role mapping H3 · ECSF v1 no model

E · DELIVER THE PACKAGE

“Assemble it, hand it over, and deploy it only if asked.” Three agents, in that order.

H3 only, until you deploy. What deployment needs depends on the target you choose.

No model. A package is assembled from the record by rule, never composed.

h3-package The analyst data, the tool deployment guides and the record, with a hash per file H3 only no model
h3-deliver Hands it over in your format, and says what is needed to run it H3 only no model
h3-deploy Presents the options and stops. Deploying needs a person who names themselves H3 · whatever the target needs no model

Each agent is a separate MCP server None of them is required by another

What this agent needs installed H3 itself has no dependencies at all

One model, in h3-core, and nowhere else in the product The other 19 agents look things up, transform files, or write deployment guides

Training

Training options

SCOR Associate: live instructor led, evening cohorts. Illustrative image.
SCOR Practitioner: your platform flown under simulation. Illustrative image.
The five functions, delivered privately for your team. Illustrative image.

The method is yours to run. Some organisations want it taught rather than read, want their team assessed rather than self-assessed, or want a credential at the end of it. That is what the SCOR micro-credentials are for, and they are how the work is sustained.

SCOR-A

SCOR Associate

A focused four-hour live instructor led micro-credential introducing Resilient Cyber Operations for space platforms.

Fee: 250.00 EUR, or 150.00 EUR for Space ISAC members
Next cohort: 9 and 10 November 2026, 18:00 to 20:00 CET
Duration: 4 hours, one live cohort
CPE: 4 credits

What this course covers: SCOR Associate Preregister for SCOR Associate

SCOR-P

SCOR Practitioner

An immersive eight-hour micro-credential with a hands-on incident response exercise on a spacecraft digital twin.

Fee: 2,500.00 EUR, or 1,500.00 EUR for Space ISAC members
Next cohort: Week of 9 November 2026, Mon to Thu, 18:00 to 20:00 CET
Duration: 8 hours, live instructor led
CPE: 8 credits

What this course covers: SCOR Practitioner Preregister for SCOR Practitioner

As of
2026-08-15

Fees indicative until preregistration; cohort dates from the Center of Excellence schedule of 2026-08-15, checked 2026-10-17.

Single modules

The five functions, taught one at a time: one hour live each, then a week of instructor support, scheduled on demand.

SCOR-M01

Concept of Operations Decompose a space platform into the enumerated elements every later security finding attaches to.
SCOR-M02

Contextualized Threat Modeling Anchor known adversarial threats to the specific platform elements they target.
SCOR-M03

Converged Detection Engineering Trace attack paths and enumerate the data and signal sources a defender must hold to see them.
SCOR-M04

Incident Response Preparation Write the detection signatures and response playbooks that run when they fire.
SCOR-M05

Adversary Management Build resilience measures that shrink, harden, or remove the platform elements adversaries keep coming back to.

For a team, the five functions can be delivered privately, and a Hackathon-as-a-Service session sets up your own exercise programme with you. Both start as a group training request.