I 

118TH CONGRESS 

2D SESSION H. R. 8965 

To promote the development of certain plans, policies, and standards for 

managing cybersecurity risks and protecting sensitive technology relating 

to National Aeronautics and Space Administration spacecraft systems, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 9, 2024 

Mr. FROST (for himself and Mr. BEYER) introduced the following bill; which 

was referred to the Committee on Science, Space, and Technology 

A BILL 

To promote the development of certain plans, policies, and 

standards for managing cybersecurity risks and protecting sensitive technology relating to National Aeronautics and Space Administration spacecraft systems, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Spacecraft Cybersecu5 rity Act’’. 

6 SEC. 2. FINDINGS. 

7 Congress finds the following: 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•HR 8965 IH

1 (1) Malicious actors have targeted sensitive 

2 technology data maintained at certain National Aer3 onautics and Space Administration (NASA) centers. 

4 (2) A 2019 NASA Inspector General audit re5 ported that potential infiltration into NASA’s space 

6 flight systems to acquire launch codes and flight tra7 jectories of spacecraft remains a particular concern 

8 of NASA’s information technology security man9 agers. 

10 (3) The 2011 United States–China Economic 

11 and Security Commission’s annual report stated that 

12 ‘‘at least two U.S. Government satellites have each 

13 experienced at least two separate instances of inter14 ference apparently consistent with cyber activities 

15 against their command and control systems.’’. 

16 (4) Space Policy Directive-5 on ‘‘Cybersecurity 

17 Principles for Space Systems’’ issued guidance that 

18 Federal departments and agencies support practices 

19 within the Federal Government and across the com20 mercial space industry ‘‘that protect space assets 

21 and their supporting infrastructure from cyber 

22 threats and ensure continuity of operations.’’. 

23 (5) NASA relies on industry contractors and 

24 commercial entities to carry out development of its 

25 advanced space systems and to provide services such 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•HR 8965 IH

1 as transporting NASA crew to and from the Inter2 national Space Station. 

3 (6) A 2024 Government Accountability Office 

4 audit found that NASA lacks a plan and time 

5 frames to update its acquisition policies and stand6 ards to address cybersecurity controls. 

7 SEC. 3. PLAN AND POLICY REVIEWS. 

8 (a) SENSE OF CONGRESS.—It is the sense of Con9 gress that the Administrator of the National Aeronautics 

10 and Space Administration (NASA) should take every ac11 tion to ensure that robust cybersecurity measures are in 

12 place to protect sensitive technology data relating to space 

13 systems developed within NASA, at NASA contractors, or 

14 under commercial services arrangements. 

15 (b) IN GENERAL.—The Administrator shall ensure 

16 that NASA’s acquisition policies and standards for space 

17 systems and services— 

18 (1) include guidelines and controls for man19 aging cybersecurity risks to such systems and serv20 ices, consistent with Space Policy Directive-5 on 

21 ‘‘Cybersecurity Principles for Space Systems’’; and 

22 (2) are updated, as appropriate, to address 

23 changing cybersecurity threats to such systems and 

24 services. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•HR 8965 IH

1 (c) IMPLEMENTATION PLAN.—Not later than 270 

2 days after the date of the enactment of the Act, the Ad3 ministrator of NASA shall complete an implementation 

4 plan to update NASA’s acquisition policies and standards 

5 for space systems and services, and incorporate guidelines 

6 and controls required to protect against cybersecurity risk 

7 and cybersecurity threats to such systems and services. 

8 The Administrator shall ensure the participation and 

9 input of the Chief Engineer, Chief Information Officer, 

10 and the Principal Advisor for Enterprise Protection of 

11 NASA in the development of such plan. Such plan shall 

12 include the following: 

13 (1) Milestone dates for completing such up14 dates. 

15 (2) A process and frequency for reviewing 

16 NASA’s cybersecurity policies, procedures, and con17 trols for spacecraft programs to address changing 

18 cybersecurity risks and cybersecurity threats to such 

19 systems and services. 

20 (3) An estimate of the resources required for 

21 carrying out the updates and reviews under para22 graphs (1) and (2), respectively. 

23 (d) BRIEFING.—Not later than 30 days after the 

24 completion of the implementation plan under subsection 

25 (c), the Administrator of NASA shall brief the Committee 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•HR 8965 IH

1 on Science, Space, and Technology of the House of Rep2 resentatives and the Committee on Commerce, Science, 

3 and Transportation of the Senate on such plan. Such 

4 briefing shall also address how such plan can inform the 

5 development of a cybersecurity risk management frame6 work for spacecraft developed or used by NASA in pursuit 

7 of its missions that encompasses end-to-end mission sys8 tems and operations. 

Æ 


kjohnson on DSK7ZCZBW3PROD with $$_JOB