2 - DRAFT CASR Readiness Plan.pdf

United States Space Force Space Systems Command

Commercial Space Office - Commercial Augmentation Space Reserve (CASR) Readiness Plan

4 August 2024

4 August 2024 i

Table of Contents

1.0 Background and Purpose

2.0 Readiness Assessment Categories

2.1 Mission Requirements Fit

2.2 Company Strategy and Experience

2.3 Core and Emerging Capabilities

2.4 Operations and Integration

2.5 Financials

2.6 Supply Chain Practices and Resilience

2.7 Cyber Security Practices and Resilience

2.8 Safety Standards and Regulatory Compliance

2.9 Exercise and Wargaming Participation

3.0 Timeline and Implementation

3.1 Timeline

3.2 Implementation

4.0 Readiness Score Calculation Methodology

4.1 Readiness Scoring Rubric

4.2 Readiness Scoring Matrix

4.3 Readiness Scoring Sub-Matrix

5.0 Appendix

5.1 Industry Feedback to Date

4 August 2024 1

1.0 Background and Purpose

To preserve its competitive advantage in the space domain and maintain readiness to rapidly scale and deploy commercial space capabilities across the spectrum of crisis and conflict, the U.S. Space Force (USSF) Space Systems Command (SSC) developed a framework to establish a Commercial Augmentation Space Reserve (CASR). Under CASR, when commercial partners volunteer to be CASR members, the Department of Defense (DoD) will have authority to establish agreements with those private sector companies to ensure that critical capabilities for mission areas like satellite communication and remote sensing are prioritized for U.S.

Government (USG) use during national security emergencies, while also denying service to certain subscribers.

To best determine a company’s suitability and reliability for participation in the CASR program, SSC established a framework that evaluates a commercial partner’s readiness and compliance with CASR objectives and standards. This readiness framework is comprised of assessment criteria that SSC finds critical to ensuring necessary services to the USG across the phases of CASR activation. The phases are:

1. CASR Commercial Baseline: Day-to-Day Operations up through Surge / Crisis

2. Full CASR Execution

To evaluate a company’s suitability and reliability for participation in the CASR program, SSC encourages voluntary disclosure of information pertinent to the evaluation criteria set out in this document to the greatest extent practicable. The analytical approach described in this document is underpinned by the principles, regulations, and standards set out in DoD Joint Doctrine, Federal Acquisitions regulations, Air Force publications, manuals and guidelines, USSF Commercial Space Strategy, and commercial industry best practices. SSC and USG partners will validate any information provided by CASR member companies and participants through the implementation of a robust verification process consisting of commercial due diligence activities.

Additionally, all the information provided to USG will be treated as commercial sensitive and not shared with other CASR companies.

2.0 Readiness Assessment Categories

2.1 Mission Requirements Fit

To properly determine suitability for CASR participation, potential partners must provide detailed information regarding the functionality and architecture of their capabilities to the SSC’s Commercial Space Office CASR Branch. CASR member companies must afford SSC opportunities to fully assess whether they are able to fill critical USG capability requirements throughout both phases of CASR activation. Due to the enduring nature of the CASR program, SSC must ensure that these CASR member companies can provide critical services not only in peacetime, but across time horizons and conditions spanning the spectrum of conflict. Therefore, both current and projected mission requirements emanating from the joint force (e.g. Geographic Combatant Commands, Services, Functional Combatant Commands, subordinates and partners) will be overlayed with CASR member capabilities to determine the suitability of a potential partnership. Through its internal verification process, SSC will ensure and verify that CASR

4 August 2024 2 member companies have the capacity to provide critical services during day-to-day operations up through full CASR execution.

2.2 Company Strategy and Experience

SSC must ensure that a company’s strategy aligns with and supports the CASR program and Space Force objectives. Companies will describe their corporate strategy, near-mid and long term (10+ years) objectives, and Key Performance Indicators (KPIs) and/ or their metrics for evaluating success, and associated measurements of performance. CASR member companies should provide a clear and accurate history of past performance to include contract qualification information relevant to CASR services throughout the spectrum, and annually thereafter, if under CASR contract. In addition to this, CASR members must have open dialogue with the Government on their current customers which will not be disclosed to anyone outside Government channels. Independent analysis of company strategy and Key Performance Indicators (KPIs) will be conducted to ensure compliance with CASR requirements.

2.3 Core and Emerging Capabilities

SSC seeks to comprehensively evaluate a company’s core and emerging capabilities in determining suitability for CASR. A company must provide detailed information on both the capability or capabilities that it will deploy across both phases of CASR activation. SSC requests that CASR member companies provide information on both currently available and emerging operational capabilities across a one-, three-, five-, and ten-year lifecycle. SSC will develop and independent assessment of CASR member core and emerging/projected capabilities as part of the internal readiness/compliance process.

2.4 Operations and Integration

Within this readiness assessment category, SSC will assess a member company’s capacity/capability and throughput rates of products and/or services intended for CASR use. SSC requests that members provide all relevant information that enables SSC to analyze, test, and verify operational capability and throughput rates. CASR members should consider organizing operational information according to the phases of CASR program activation while providing information that speaks clearly to any additional resources required to increase capacity capability and/or improve throughput rates during progression from CASR Commercial Baseline up through to Full CASR Execution (i.e.: additional financial resources, raw materials, equipment, specialized labor/talent etc.).

Additionally, CASR members or current CASR vendors will provide information on recommended strategies and associated challenges related to integration of proposed CASR capabilities into warfighting operations (subsystem, system and system-of-system phases), informing CONOPS development, periodic updates and resolve/unresolved interdependencies necessary for CASR capability utilization across the spectrum of conflict.

No notice, on-site and third party verification of operational capabilities will be conducted to ensure CASR program readiness.

2.5 Financials

Financial solvency and enduring viability are vital requirements for CASR participation.

The USG must ensure exceptional reliability among its partners due to the enduring nature of the

4 August 2024 3

CASR program, and the need for participants to be able to rapidly deploy and up-scale capabilities when triggered by dynamic geopolitical events. The need to ensure exceptional reliability requires that SSC be able to assess and monitor a participant’s financial standing by analyzing a framework of key financial metrics. CASR members are therefore asked to provide the information that enables SSC to conduct such analysis and verify its authenticity and veracity. SSC will conduct independent financial diligence and analysis through a wide framework of financial metrics for CASR Members during initial diligence, and across regular periods of time.

2.6 Supply Chain Practices and Resilience

Supply chain security and resilience underpin a partner company’s ability to provide critical capabilities to the USG across the spectrum of conflict without delay or disruption. Due to the enduring and strategic nature of the CASR program, SSC must ensure that it fully understands the strengths and weaknesses associated with any CASR related supply chains.

Therefore, CASR member companies and program participants must fully disclose the details of their sub tier suppliers to SSC Commercial Space Office’s CASR Branch. Additionally, they must actively engage in Supply Chain Risk Management (SCRM) practices while proactively engaging in measures that ensure supply chain security, resiliency, and reliability for CASR use across the phases of program activation. SSC requests that industry partners provide detailed information that enable SSC analysts to assess levels a partner’s supply chain practices and resilience. Examples of such information include, but are not limited to, bills of materials (BOMs) for critical components, supplier relationships from immediate suppliers down through raw materials, and regular assessments of supply chain risks and mitigation practices. SSC will conduct independent supply chain illumination and analysis to determine CASR Member supply chain resilience, practices, and security.

2.7 Cyber Security Practices and Resilience

Cybersecurity is indicative of technical capability and strategic preparedness in terms of providing resilient and secure capabilities to the USG. SSC must ensure that potential partners are postured to meet or exceed the standards outlined in the Cybersecurity Maturity Model Certification (CMMC) in addition to its underlying laws, regulations, and standards. The review process for cybersecurity practices and resilience will include an assessment using open and closed source intelligence to evaluate CASR members using industry leading frameworks that include MITRE ATT&CK, NIST SP 800-171 and NIST SP 800-53 for both cyber hygiene and posture. Independent cyber security practices and resilience assessments will be periodically conducted as part of initial diligence and continued compliance monitoring of CASR Members.

2.8 Safety Standards and Regulatory Compliance

SSC considers adherence to safety standards and regulatory compliance as critical elements of CASR program readiness and key requirements for participation. SSC must ensure that CASR member companies and participants meet applicable industry, local, state, and federal safety standards, and are compliant with relevant regulatory frameworks. To make this determination, SSC will assess safety and compliance records. CASR members and participants are requested to provide information that enables such analysis. Examples of such information include, but are not limited to, company safety records and policies; serious safety incidents;

regulatory compliance frameworks and policies; incidents of breaches in compliance. SSC will

4 August 2024 4 ensure and actively monitor adherence to safety standards, practices, safety incidents and violations, as well as compliance with applicable/relevant regulatory frameworks as part of an independent assessment of CASR Members.

2.9 Exercise and Wargaming Participation

SSC, in coordination with CCMDs and services, will conduct annual readiness exercises for CASR participants to validate readiness and operational effectiveness of CASR. The exercises and wargames simulate and validate provision of services to the program during surge and full CASR execution Such exercises enable warfighters (CCMDs), operators (services), SSC planners and industry to gain operational insights and valuable lesson-learned that allow for the development of new, and integration of existing, strategies, tactics, techniques, and procedures.

SSC will provide feedback and input to participants following each exercise.

3.0 Timeline and Implementation

3.1 Timeline

The following is a timeline graphic depicting Readiness Plan execution lifecycle of a CASR Member company over a period of 16 months:

3.2 Implementation

A. The Implementation Operational Approach centers on: 1. Conducting Initial (Onboarding) Diligence to establish an analytical baseline of key data and metrics, and 2.

Periodic re-evaluation of the Onboarding Diligence, conducted at regular intervals of time, to detect and capture changes to the assessment categories (Continued Monitoring/Compliance Report).

B. The Initial (Onboarding) Diligence is comprised of the following categories:

1. CASR Compliance Statement: Analysis of member company’s compliance with

CASR standards/requirements

2. Executive Summary: Highlight of background and key analytical findings

3. Member Background: General company information, highlighting critical services/capabilities

4 August 2024 5

4. Competitors and Peers: Overview of companies with similar market share, capability portfolios, and possible alternates; analysis of industry trends

5. Key Personnel: Executive, managerial, operational, technical, and additional personnel of interest

6. Key Locations: Geographic distribution of key locations; geographic risk

7. Capability Evaluation Framework

I. Operational Capacity Assessment: Overview of capabilities and services currently offered and those in development

II. CASR Capabilities: Description of capabilities and services member company will provide within the CASR framework

III. Exercise and Wargaming Participation: Performance during SSC run exercises and/or wargames

8. Financial Diligence: Key financial indicators and metrics supporting analysis of viability along the following time horizons:

I. Historic II. Current

III. Forecasted

9. Commercial Interrelationships

I. Funding and Investors: Analysis of past, current, and future sources of funding

II. Corporate Family: Subsidiary/parent affiliation(s) III. M&A Activities: Past, current, and anticipated/planned mergers and acquisitions IV. Strategic Partnerships and Contracts: Overview of main clients, contracts, and other critical relationships

10. Cyber Findings: Summary of key points from a comprehensive cyber report

11. Member Risk:

I. Vulnerability Exploitation Analysis (Offensive): Findings of adversary penetration points; key vulnerabilities, nodes identified and mapped

II. Supplier Illumination: Illumination and mapping of supplier ecosystem

III. Risk Mitigation Recommendations and Findings (Defensive):

Strategies for mitigation of identified risks; recommendations for meeting CASR compliance standards/requirements

IV. Safety Standards V. Regulatory Compliance

VI. FOCI Risk Mitigation C. A periodic re-evaluation of baseline diligence findings, conducted at regular intervals of time, is comprised of the following:

1. CASR Compliance Statement: Analysis of member company’s compliance with

CASR standards/requirements

2. Executive Summary: Highlight of background and key analytical findings

3. Competitors and Peers: Changes in competitor/market landscape

4. Key Personnel: Turnover/retention of executive, managerial, operational, and personnel of interest

4 August 2024 6

5. Key Locations: Changes in geographic distribution of key locations and current geographic risk

6. Capability Evaluation Framework I. Operational Capacity Assessment: Updates of capabilities and services currently offered and in development II. CASR Capabilities: Changes in capabilities and services member company will provide within the CASR framework

7. Financial Diligence: Updated key financial indicators and metrics supporting analysis of viability along the following time horizons:

I. Historic

II. Current III. Forecasted

8. Updated Commercial Interrelationships I. Funding and Investors: Analysis of past, current, and future sources of funding II. Corporate Family: Subsidiary/parent affiliation(s)

III. M&A Activities: Past, current, and anticipated/planned mergers and acquisitions

IV. Strategic Partnerships and Contracts: Overview of main clients, contracts, and other critical relationships

9. Cyber Findings: Summary of key points from a comprehensive cyber report

10. Member Risk:

I. Vulnerability Exploitation Analysis (Offensive): Findings of adversary penetration points; key vulnerabilities, nodes identified and mapped

II. Supplier Illumination: Illumination and mapping of supplier ecosystem

III. Risk Mitigation Recommendations and Findings (Defensive):

Strategies for mitigation of identified risks; recommendations for meeting CASR compliance standards/requirements

IV. FOCI Risk Mitigation

4.0 Readiness Score Calculation Methodology

4.1 Readiness Scoring Rubric

A Readiness Scoring Rubric is used to determine an overall Readiness Score of a CASR member company. The Rubric is composed of a Readiness Scoring Matrix, which calculates the Readiness Score for each company, and Readiness Scoring Sub-Matrices for each Readiness Category, used to calculate individual Category Scores.

4.2 Readiness Scoring Matrix

Each Readiness Assessment Category is assigned a Weight ranging from 1 (Less Critical) to 3 (More Critical), and a Rating, ranging from 1 (Not Ideal), 3 (Good) to 5 (Best). Weights are assigned by SSC analysts after considering the relative importance of each Category relative to the others.

Multiplying a Readiness Category Weight by a Readiness Scoring Rating (e.g. Weight of 1 multiplied by Rating of 3) determines the Weight Score of a Readiness Category. Weighted

4 August 2024 7

Scores are added together to determine a Cumulative Score for every CASR Member Company.

A company is considered Ready when its Cumulative Score exceeds or is equal to 84 (80% of 105, the maximum achievable Cumulative Score). A company is considered Not Ready if its Cumulative Score falls below that threshold. The Scoring Rubric automatically colors company Cumulative Scores green if a company is Ready and red if it is Not Ready.

4.3 Readiness Scoring Sub-Matrix

A Category Score is calculated for each Readiness Category (e.g.: 2.1 Mission

Requirements Fit, 2.2 Strategy and Experience) in a corresponding Scoring Sub-Matrix. Each Readiness Category is comprised of one or more Factors which are assigned a score from 1 to 5 (e.g. Total Revenue, EBITDA, Net Income etc. for 2.5 Financials). A score is determined after conducting a comprehensive analysis of each Factor. Factors within each Readiness Category are added together and divided by the total number of Factors to determine the Readiness Category Average Score. Average Scores from each sub-matrix worksheet are automatically populated in the corresponding field in the main Readiness Scoring Matrix for calculation of the member company Cumulative Score.

5.0 Appendix

5.1 Industry Feedback to Date

SSC/COMSO sought information in the form of a review and feedback from Industry on the Commercial Space Augmentation Reserve (CASR) Framework. SSC analyzed the responses received, and incorporated Industry feedback when drafting this document. The following is a selection of such responses:

Reviewing Element 5: Risk Mitigation, do you have any concerns or recommendations on how the government plans to perform commercial due diligence to mitigate risk?

“USG should share their Risk findings with the commercial companies so that the companies can take steps to remediate those risks to the maximum extent practicable.”

“SATCOM provider commercial due diligence should include the following elements: (1) Business profile outlining a company’s background, products and service offerings; (2) Overview of historical market and sales data; (3) Historical and projected financial data; (4) Operational and supply chain risks.”

“USG should share their Risk findings with the commercial companies so that the companies can take steps to remediate those risks to the maximum extent practicable.”

“SSC/COMSO establish a timeline for defining the process and completing the assessments..

Any evaluations should be part of elements 1, 3, 4, and 6 where standard evaluation of technical merit, financial soundness, and FOCI occur.”

“There are a number of reputable firms that produce studies that provide extensive coverage of many of the factors listed in Element 5.”

“There is a critical necessity to properly vet commercial personnel to ensure they are both qualified and in possession of the appropriate clearances.”

4 August 2024 8

“As discussed above, we urge the government to take a holistic approach to evaluating risk, rather than focusing on single elements such as country of ownership, country of origin for supply chain components, etc.”

“Risk mitigation is also an ongoing process that requires continuous monitoring and evaluation.

The government should establish mechanisms to track changes in risk profiles over time and adjust mitigation strategies accordingly.”