Found To Fixed

Compliance evidence that unblocks the next deal.

A fixed scope, fixed fee space cyber assessment for Australian space companies. Four to six weeks from start to a report you can hand to a customer, a prime, or a board.

Start a conversation What it answers

53
controls assessed
9
framework domains
4 to 6
weeks, fixed fee

Founded by Bradley Busch, author of An Australian Guide to Space Cybersecurity, published by the ISACA Sydney Chapter, with Janis Lesinskis advising, who built wildfire detection pipelines under FUEGO at the UC Berkeley Space Sciences Laboratory.

What you are holding at the end

A report written to be shown

The same document answers a procurement questionnaire, a prime's security annex, and a board paper.

A control set sized to your mission

Scoped by payload class, bus model, and orbital layer, then mapped to NIST SP 800-171 Rev 2, the same 110 controls under CMMC Level 2. Ground segment controls apply to the ground segment. You are not answering for a constellation you do not fly.

Every finding with its fix already sequenced

Findings arrive graded U1 to U5: irrecoverable breaches first, then design freeze controls while the freeze is still open. Everyone finds problems. The order to close them is the useful part.

A consequence rating your board can act on

Each finding carries a consequence level and the reason it sits there, in language a director reads once and understands.

Governance and engineering in the same room

The control set comes from the ISACA Sydney Chapter space cybersecurity guide and a nine stage enterprise architecture ending in 53 controls. The engineering half comes from fire detection software built under FUEGO at the UC Berkeley Space Sciences Laboratory and used during Californian wildfire seasons.

How the four to six weeks run

  1. Week 1

    Scoping and evidence request. We size the control set to your mission and list the evidence we need. Your team spends 4 to 6 hours in week 1 and about 2 hours a week after that.

  2. Weeks 2 to 4

    Assessment against the 53 controls across 9 domains. Where evidence is thin, we run a working session before writing the finding.

  3. Weeks 5 to 6

    Peer review, then the report and a walkthrough with whoever has to defend it. Two assessors sign every report.

One control set, three regimes it answers

SOCI, at home

Space has no SOCI asset classes yet. Your customers' obligations already reach you.

When to run one

  • A customer or prime has asked a security question you cannot answer yet.
  • Design freeze, while a control still costs a decision instead of a redesign.
  • Pre-launch acceptance.
  • First flight, and annually after it.

Recent writing

  • Self-assessed does not mean unexamined

    Most of CMMC Level 2 is self-assessed and third party assessment is suspended. That leaves you as the only person who examined the score you affirm.

All posts →

Tell us what your customer asked for.

A 20 minute call is enough to say whether an assessment answers it, what the scope looks like against your mission, and the fee. Fixed before we start, with no variation without your sign off.

Start a conversation Contact page