Satellite Cybersecurity Act of 2025

What it does

• •Requires the Comptroller General to conduct a study and report within 2 years on Federal government actions supporting cybersecurity of commercial satellite systems, including effectiveness, resources, and coordination efforts.
• •Directs the Department of Commerce to establish a publicly available clearinghouse within 180 days to consolidate and distribute cybersecurity resources, guidance, frameworks, and tools for commercial satellite operators, with special materials for small businesses.
• •Requires the Department of Commerce to consolidate voluntary cybersecurity recommendations addressing engineering practices, supply chain risks, physical protection, foreign ownership vulnerabilities, and threat mitigation throughout satellite system lifetimes.
• •Mandates the Department of Commerce to submit biennial reports for 9 years on clearinghouse establishment, private sector partnerships, federal coordination, and feedback from non-federal entities.

Why it matters

• •Commercial satellites support critical infrastructure and Federal agency operations; the text identifies gaps in understanding Federal cybersecurity support, reliance on foreign-controlled systems, and coordination effectiveness.
• •The clearinghouse consolidates fragmented cybersecurity guidance into a centralized public resource, addressing identified vulnerabilities including jamming, unauthorized access, supply chain risks, and threats from foreign ownership or offshore infrastructure.
• •The study and recommendations inform Congress and agencies on resource allocation and potential policy gaps for protecting satellite-dependent critical infrastructure and Federal systems.

Who is affected

• •Commercial satellite operators and companies holding U.S. licenses, particularly small businesses developing or maintaining satellite systems.
• •Federal agencies reliant on commercial satellite systems, including the Departments of Commerce, Defense, Transportation, and Homeland Security, plus NASA and the FCC.
• •The private sector and international entities supporting satellite cybersecurity, which are consulted for clearinghouse development and voluntary recommendations.

What happens next

The Comptroller General must initiate the study immediately, the Department of Commerce must develop the clearinghouse within 180 days and submit initial reports within 1 year and every 2 years thereafter, and a joint strategy with the National Space Council is due within 120 days.