I 
118TH CONGRESS 
2D SESSION 
H. R. 8965 
To promote the development of certain plans, policies, and standards for 
managing cybersecurity risks and protecting sensitive technology relating 
to National Aeronautics and Space Administration spacecraft systems, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 9, 2024 
Mr. FROST (for himself and Mr. BEYER) introduced the following bill; which 
was referred to the Committee on Science, Space, and Technology 
A BILL 
To promote the development of certain plans, policies, and 
standards for managing cybersecurity risks and pro-
tecting sensitive technology relating to National Aero-
nautics and Space Administration spacecraft systems, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Spacecraft Cybersecu-
rity Act’’. 
SEC. 2. FINDINGS. 
Congress finds the following: 
VerDate Sep 11 2014 
23:22 Aug 14, 2024
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H8965.IH
H8965
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(1) Malicious actors have targeted sensitive 
technology data maintained at certain National Aer-
onautics and Space Administration (NASA) centers. 
(2) A 2019 NASA Inspector General audit re-
ported that potential infiltration into NASA’s space 
flight systems to acquire launch codes and flight tra-
jectories of spacecraft remains a particular concern 
of NASA’s information technology security man-
agers. 
(3) The 2011 United States–China Economic 
and Security Commission’s annual report stated that 
‘‘at least two U.S. Government satellites have each 
experienced at least two separate instances of inter-
ference apparently consistent with cyber activities 
against their command and control systems.’’. 
(4) Space Policy Directive-5 on ‘‘Cybersecurity 
Principles for Space Systems’’ issued guidance that 
Federal departments and agencies support practices 
within the Federal Government and across the com-
mercial space industry ‘‘that protect space assets 
and their supporting infrastructure from cyber 
threats and ensure continuity of operations.’’. 
(5) NASA relies on industry contractors and 
commercial entities to carry out development of its 
advanced space systems and to provide services such 
VerDate Sep 11 2014 
23:22 Aug 14, 2024
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H8965.IH
H8965
kjohnson on DSK7ZCZBW3PROD with $$_JOB
as transporting NASA crew to and from the Inter-
national Space Station. 
(6) A 2024 Government Accountability Office 
audit found that NASA lacks a plan and time 
frames to update its acquisition policies and stand-
ards to address cybersecurity controls. 
SEC. 3. PLAN AND POLICY REVIEWS. 
(a) SENSE OF CONGRESS.—It is the sense of Con-
gress that the Administrator of the National Aeronautics 
and Space Administration (NASA) should take every ac-
tion to ensure that robust cybersecurity measures are in 
place to protect sensitive technology data relating to space 
systems developed within NASA, at NASA contractors, or 
under commercial services arrangements. 
(b) IN GENERAL.—The Administrator shall ensure 
that NASA’s acquisition policies and standards for space 
systems and services— 
(1) include guidelines and controls for man-
aging cybersecurity risks to such systems and serv-
ices, consistent with Space Policy Directive-5 on 
‘‘Cybersecurity Principles for Space Systems’’; and 
(2) are updated, as appropriate, to address 
changing cybersecurity threats to such systems and 
services. 
VerDate Sep 11 2014 
23:22 Aug 14, 2024
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H8965.IH
H8965
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(c) IMPLEMENTATION PLAN.—Not later than 270 
days after the date of the enactment of the Act, the Ad-
ministrator of NASA shall complete an implementation 
plan to update NASA’s acquisition policies and standards 
for space systems and services, and incorporate guidelines 
and controls required to protect against cybersecurity risk 
and cybersecurity threats to such systems and services. 
The Administrator shall ensure the participation and 
input of the Chief Engineer, Chief Information Officer, 
and the Principal Advisor for Enterprise Protection of 
NASA in the development of such plan. Such plan shall 
include the following: 
(1) Milestone dates for completing such up-
dates. 
(2) A process and frequency for reviewing 
NASA’s cybersecurity policies, procedures, and con-
trols for spacecraft programs to address changing 
cybersecurity risks and cybersecurity threats to such 
systems and services. 
(3) An estimate of the resources required for 
carrying out the updates and reviews under para-
graphs (1) and (2), respectively. 
(d) BRIEFING.—Not later than 30 days after the 
completion of the implementation plan under subsection 
(c), the Administrator of NASA shall brief the Committee 
VerDate Sep 11 2014 
23:22 Aug 14, 2024
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H8965.IH
H8965
kjohnson on DSK7ZCZBW3PROD with $$_JOB