I 
117TH CONGRESS 
2D SESSION 
H. R. 7629 
To require a report on Federal support to the cybersecurity of commercial 
satellite systems, establish a commercial satellite system cybersecurity 
clearinghouse in the Cybersecurity and Infrastructure Security Agency, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 28, 2022 
Mr. MALINOWSKI (for himself and Mr. GARBARINO) introduced the following 
bill; which was referred to the Committee on Homeland Security, and in 
addition to the Committee on Science, Space, and Technology, for a pe-
riod to be subsequently determined by the Speaker, in each case for con-
sideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
A BILL 
To require a report on Federal support to the cybersecurity 
of commercial satellite systems, establish a commercial 
satellite system cybersecurity clearinghouse in the Cyber-
security and Infrastructure Security Agency, and for 
other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Satellite Cybersecurity 
Act’’. 
VerDate Sep 11 2014 
15:39 May 02, 2022
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H7629.IH
H7629
pamtmann on DSKBC07HB2PROD with BILLS
SEC. 2. REPORT ON COMMERCIAL SATELLITE CYBERSECU-
RITY; CISA COMMERCIAL SATELLITE SYSTEM 
CYBERSECURITY CLEARINGHOUSE. 
(a) STUDY.— 
(1) IN GENERAL.—The Comptroller General of 
the United States shall conduct a study on the ac-
tions the Federal Government has taken to support 
the cybersecurity of commercial satellite systems, in-
cluding as part of any action to address the cyberse-
curity of critical infrastructure sectors. 
(2) REPORT.—Not later than two years after 
the date of the enactment of this Act, the Comp-
troller General of the United States shall report to 
Congress on the study conducted under paragraph 
(1), which shall include information on— 
(A) the effectiveness of efforts of the Fed-
eral Government in improving the cybersecurity 
of commercial satellite systems; 
(B) the resources made available to the 
public, as of the date of the enactment of this 
Act, by Federal agencies to address cybersecu-
rity risks and cybersecurity threats to commer-
cial satellite systems; 
(C) the extent to which commercial sat-
ellite systems are reliant on or are relied on by 
critical infrastructure and an analysis of how 
VerDate Sep 11 2014 
15:39 May 02, 2022
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7629.IH
H7629
pamtmann on DSKBC07HB2PROD with BILLS
commercial satellite systems, and the cybersecu-
rity threats to such systems, are integrated into 
Federal and non-Federal critical infrastructure 
risk analyses and protection plans; 
(D) the extent to which Federal agencies 
are reliant on commercial satellite systems and 
how Federal agencies mitigate cybersecurity 
risks associated with those systems; and 
(E) the extent to which Federal agencies 
coordinate or duplicate authorities and take 
other actions focused on the cybersecurity of 
commercial satellite systems. 
(3) CONSULTATION.—In carrying out para-
graphs (1) and (2), the Comptroller General of the 
United States shall coordinate with appropriate Fed-
eral agencies, including— 
(A) the Department of Homeland Security; 
(B) the Department of Commerce; 
(C) the Department of Defense; 
(D) the Department of Transportation; 
(E) the Federal Communications Commis-
sion; 
(F) the National Aeronautics and Space 
Administration; and 
VerDate Sep 11 2014 
15:39 May 02, 2022
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7629.IH
H7629
pamtmann on DSKBC07HB2PROD with BILLS
(G) the National Executive Committee for 
Space-Based Positioning, Navigation, and Tim-
ing. 
(4) BRIEFING.—Not later than one year after 
the date of the enactment of this Act, the Comp-
troller General of the United States shall provide a 
briefing to Congress relating to carrying out para-
graphs (1) and (2). 
(5) CLASSIFICATION.—The report under para-
graph (2) shall be unclassified but may include a 
classified annex. 
(b) CISA COMMERCIAL SATELLITE SYSTEM CYBER-
SECURITY CLEARINGHOUSE.— 
(1) ESTABLISHMENT.— 
(A) IN
GENERAL.—Not later than 180 
days after the date of the enactment of this 
Act, the Director shall establish a commercial 
satellite system cybersecurity clearinghouse. 
(B) REQUIREMENTS.—The clearinghouse 
shall— 
(i) be publicly available online; 
(ii) contain current, relevant, and 
publicly available commercial satellite sys-
tem cybersecurity resources, including the 
recommendations consolidated under para-
VerDate Sep 11 2014 
15:39 May 02, 2022
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7629.IH
H7629
pamtmann on DSKBC07HB2PROD with BILLS
graph (2), and any other appropriate ma-
terials for reference by entities that de-
velop commercial satellite systems; and 
(iii) 
include 
materials 
specifically 
aimed at assisting small business concerns 
with the secure development, operation, 
and maintenance of commercial satellite 
systems. 
(C) EXISTING PLATFORM OR WEBSITE.— 
The Director may establish the clearinghouse 
on an online platform or a website that is in ex-
istence as of the date of the enactment of this 
Act. 
(2) CONSOLIDATION
OF
COMMERCIAL
SAT-
ELLITE
SYSTEM
CYBERSECURITY
RECOMMENDA-
TIONS.— 
(A) IN GENERAL.—The Director shall con-
solidate voluntary cybersecurity recommenda-
tions designed to assist in the development, 
maintenance, and operation of commercial sat-
ellite systems. 
(B) REQUIREMENTS.—The recommenda-
tions consolidated under subparagraph (A) shall 
include, to the greatest extent practicable, ma-
terials addressing the following: 
VerDate Sep 11 2014 
15:39 May 02, 2022
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H7629.IH
H7629
pamtmann on DSKBC07HB2PROD with BILLS
(i) Risk-based, cybersecurity-informed 
engineering, including continuous moni-
toring and resiliency. 
(ii) Planning for retention or recovery 
of positive control of commercial satellite 
systems in the event of a cybersecurity in-
cident. 
(iii) Protection against unauthorized 
access to vital commercial satellite system 
functions. 
(iv) Physical protection measures de-
signed to reduce the vulnerabilities of a 
commercial satellite system’s command, 
control, or telemetry receiver systems. 
(v) Protection against jamming or 
spoofing. 
(vi) Security against threats through-
out a commercial satellite system’s mission 
lifetime. 
(vii) Management of supply chain 
risks that affect the cybersecurity of com-
mercial satellite systems. 
(viii) As appropriate, and as applica-
ble pursuant to the requirement under 
paragraph (1)(b)(ii) (relating to the clear-
VerDate Sep 11 2014 
15:39 May 02, 2022
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H7629.IH
H7629
pamtmann on DSKBC07HB2PROD with BILLS
inghouse containing current, relevant, and 
publicly available commercial satellite sys-
tem cybersecurity resources), the findings 
and recommendations from the study con-
ducted by the Comptroller General of the 
United States under subsection (a)(1). 
(ix) Any other recommendations to 
ensure the confidentiality, availability, and 
integrity of data residing on or in transit 
through commercial satellite systems. 
(3) IMPLEMENTATION.—In implementing this 
subsection, the Director shall— 
(A) to the extent practicable, carry out 
such implementation as a public-private part-
nership; 
(B) coordinate with the heads of appro-
priate Federal agencies with expertise and expe-
rience in satellite operations, including the enti-
ties described in subsection (a)(3); and 
(C) consult with non-Federal entities devel-
oping commercial satellite systems or otherwise 
supporting the cybersecurity of commercial sat-
ellite systems, including private, consensus or-
ganizations that develop relevant standards. 
(c) DEFINITIONS.—In this section: 
VerDate Sep 11 2014 
15:39 May 02, 2022
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H7629.IH
H7629
pamtmann on DSKBC07HB2PROD with BILLS
(1) CLEARINGHOUSE.—The term ‘‘clearing-
house’’ means the commercial satellite system cyber-
security clearinghouse required to be developed and 
maintained under subsection (b)(1). 
(2) COMMERCIAL
SATELLITE
SYSTEM.—The 
term ‘‘commercial satellite system’’ means an earth 
satellite owned and operated by a non-Federal enti-
ty. 
(3) CRITICAL
INFRASTRUCTURE.—The term 
‘‘critical infrastructure’’ has the meaning given such 
term in section 1016(e) of Public Law 107–56 (42 
U.S.C. 5195c(e)). 
(4) CYBERSECURITY RISK.—The term ‘‘cyberse-
curity risk’’ has the meaning given such term in sec-
tion 2209 of the Homeland Security Act of 2002 (6 
U.S.C. 659). 
(5) CYBERSECURITY THREAT.—The term ‘‘cy-
bersecurity threat’’ has the meaning given such term 
in section 102 of the Cybersecurity Information 
Sharing Act of 2015 (6 U.S.C. 1501). 
(6) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the Cybersecurity and Infrastructure 
Security Agency. 
(7) SMALL
BUSINESS
CONCERN.—The term 
‘‘small business concern’’ has the meaning given the 
VerDate Sep 11 2014 
15:39 May 02, 2022
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H7629.IH
H7629
pamtmann on DSKBC07HB2PROD with BILLS
term in section 3 of the Small Business Act (15 
U.S.C. 632). 
Æ 
VerDate Sep 11 2014 
15:39 May 02, 2022
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H7629.IH
H7629
pamtmann on DSKBC07HB2PROD with BILLS