NASA pushes back on GAO’s cyber recommendations for spacecraft

A recent audit by the Government Accountability Office (GAO) has highlighted significant shortcomings in NASA’s integration of cybersecurity practices into its agency policies, especially for major spacecraft projects. The audit warns that the lack of standardized cybersecurity requirements could lead to inconsistent cybersecurity controls across NASA’s projects.

The GAO report revealed that NASA officials attribute their delayed incorporation of cybersecurity guidance into acquisition policies and standards to the lengthy standard-setting process. While the GAO recognizes that setting standards is time-consuming, it stresses the importance of doing so due to the heavy reliance of spacecraft on software.

To address these concerns, the GAO recommends that NASA’s Chief Engineer, Chief Information Officer, and the Principal Advisor for Enterprise Protection develop a specific timeline for updating spacecraft acquisition policies to include cybersecurity measures. However, NASA has expressed reservations about some recommendations, with the CIO stating that a single set of controls for all mission spacecraft is not feasible. The GAO countered this response, suggesting NASA use its space security guide to determine controls that address potential threats.

Furthermore, NASA has been reluctant to commit to establishing a timeline for these updates, citing the need for careful consideration of requirements. Meanwhile, related cybersecurity discussions are ongoing, with trade groups from the electric, telecommunications, and finance sectors criticizing a new draft rule for cyber incident reporting during a House hearing, arguing that it places excessive demands on critical infrastructure entities.

The Daily Scoop Podcast is available every Monday-Friday afternoon.
If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast on Apple Podcasts, Google Podcasts and Spotify.