The space segment depends on the ground infrastructure that commands it: control stations, telemetry and telecommand links, data processing centres and the networks connecting them. That infrastructure is the realistic target of a cyber attack, far more accessible than the satellite itself, and the consequences show up in services other sectors use every day: positioning and time synchronisation through GNSS, backup communications, Earth observation for agriculture, environment and emergency response. Time synchronisation in particular is an invisible dependency of energy and financial networks.
Directive (EU) 2022/2555 (NIS 2) lists the space sector in Annex I, with the focus on operators of ground based infrastructure owned, managed or operated by Member States or by private parties. The obligations cover risk analysis, technical and organisational measures, incident reporting and service continuity.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The Space sector
Essential entities:
Operators of ground based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space based services, excluding providers of public electronic communications networks.
- Operators of satellite control and telemetry stations
- Operators of ground segment data reception and processing centres
- Providers of GNSS augmentation and timing services
- Operators of the networks connecting ground stations to control centres
Sector-specific cyber threats
- Unauthorised access to telemetry and telecommand links
- Jamming or spoofing of positioning and timing signals
- Attacks on ground station scheduling and control software
- Compromise of data processing and distribution chains
- Interception or alteration of Earth observation data
- Supply chain attacks through specialised ground segment software
NIS 2 requirements for the space sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Energy and financial networks depend on GNSS time synchronisation
- Emergency response and agriculture depend on Earth observation data
- Dependency on terrestrial communications networks connecting the ground segment
- Cross-border effects, since services span multiple Member States
In the space sector, the attack surface that matters is on the ground. NIS 2 requires operators of ground infrastructure to treat cyber risk as an operational risk, because the services depending on them are used far beyond the sector itself.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.