Security-First Organization

Data Protection & Security

Security-first protection built for the pace exploration demands.

Our security program is designed around recognized government and industry frameworks, structured to protect engineering data and program information while enabling the decision velocity and commercial integration that next-generation exploration architectures require.

Report a Security Concern

Last updated: August 2026

Disclaimer: This public summary is informational and describes our general security posture. It does not constitute a certification, accreditation, or warranty. Additional details are available under NDA.Related: Privacy Policy · Cookie Policy · AI Governance · Platform Trust Center

Executive Summary

Monarch Space Systems, Inc. implements a layered security program to protect proprietary engineering data, sensitive program information, supplier and customer data, and limited human resources data. Our controls are mapped to recognized government and industry frameworks including NIST SP 800-171, NIST SP 800-53, and the NIST Cybersecurity Framework.

Data may reside across cloud services, endpoints, and controlled repositories. All environments are subject to access controls, encryption, monitoring, and periodic review consistent with the data classification assigned.

Consistent with NASA's emphasis on streamlined operations and commercial integration, our security architecture is designed to enable rapid, secure collaboration with government customers, prime contractors, and commercial partners — ensuring that data protection accelerates mission progress rather than constraining it.

Public

Internal

Confidential

Controlled / Regulated

Framework Alignment

Controls aligned with recognized government and industry frameworks.

NIST SP 800-171

Protecting Controlled Unclassified Information (CUI)

Security controls aligned with NIST SP 800-171 requirements for protecting CUI in nonfederal systems and organizations.

Official Source

NIST SP 800-53

Security & Privacy Controls

Organizational controls designed consistent with the NIST SP 800-53 catalog of security and privacy controls for information systems.

Official Source

NIST Cybersecurity Framework

CSF 2.0

Risk management practices structured around the NIST CSF core functions: Govern, Identify, Protect, Detect, Respond, and Recover.

Official Source

DFARS 252.204-7012

Safeguarding Covered Defense Information

Practices designed to address DFARS cyber incident reporting and safeguarding requirements applicable to covered defense information.

Official Source

CMMC Readiness

Cybersecurity Maturity Model Certification

Implementing practices intended to support future CMMC assessment readiness as the program matures and requirements are finalized.

Official Source

Export Control Awareness

ITAR / EAR

Processes to support handling of export-controlled data in accordance with ITAR and EAR requirements as applicable to a given contract or data set.

Official Source

Core Security Controls

Public-safe overview of implemented security practices.

A. Access Control & Identity

Multi-factor authentication (MFA) enforced across all sensitive systems and administrative interfaces.
Role-based access control (RBAC) with least-privilege principles; access reviewed periodically.
Single sign-on (SSO) implemented where applicable for centralized identity management.
Privileged access management with separate administrative accounts and session monitoring.
Joiner/mover/leaver procedures to provision, adjust, and revoke access promptly.

B. Data Protection & Encryption

Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent industry standard).
Key management procedures with separation of duties and periodic key rotation.
Data classification framework: Public, Internal, Confidential, and Controlled/Regulated.
Dedicated handling procedures for sensitive aerospace engineering data and program information.

C. Secure Engineering & SDLC

Mandatory code review and branch protection on all production repositories.
Dependency scanning and static/dynamic application security testing (SAST/DAST) integrated into CI/CD.
Secrets management using dedicated vaults; no credentials stored in source code.
Environment separation (development, testing, production) with restricted promotion workflows.
Documented change management process with approvals and audit trails.

D. Monitoring, Logging & Incident Response

Centralized logging with alerting for anomalous activity and security events.
Audit trails maintained for access, configuration changes, and data operations.
Documented Incident Response Plan: detection → triage → containment → eradication → recovery → lessons learned.
Suspected incidents can be reported to security@beyondrocketry.com; initial acknowledgment within 4 business hours.
Post-incident reviews conducted with findings incorporated into control improvements.

E. Vulnerability & Patch Management

Routine patch cadence for operating systems, applications, and firmware; emergency patching for critical vulnerabilities.
Vulnerability disclosure intake process for responsible reporters.
Periodic security testing including vulnerability assessments and third-party evaluations.
Remediation workflows tracked to resolution with risk-based prioritization.

F. Backup, Business Continuity & Disaster Recovery

Regular backups with restore testing; recovery point and recovery time targets defined per data classification.
Business continuity planning with documented procedures for critical operations.
Resilience principles: redundancy, failover, and geographic considerations for key services.

G. Third-Party / Supplier Security

Vendor risk assessments conducted prior to engagement and periodically thereafter.
Least-access principles applied to all third-party integrations and data sharing.
Data processing agreements and security addenda required where applicable.
Subprocessor transparency maintained for customer-requested reviews.

H. Physical & Device Security

Endpoint protection with disk encryption, managed device policies, and remote wipe capability.
Device management ensuring operating system and security software currency.
Secure office practices including access-controlled facilities where applicable.

Data Handling Lifecycle

Principled approach to data from collection through disposal.

CollectGather only necessary data

UseProcess per authorized purpose

StoreEncrypt and control access

ShareNeed-to-know, authorized only

RetainPer policy & contract terms

DisposeSecure deletion & sanitization

Retention & Disposal: Data is retained only as long as required by contract, regulation, or legitimate business need. Secure deletion and media sanitization procedures are applied consistent with NIST SP 800-88 guidelines.

Privacy & Confidentiality

We minimize the collection of personal data to what is necessary for business operations, contractual obligations, and legal requirements. Customer and partner confidential information is protected through access controls, NDAs, and contractual commitments.

Where applicable, our practices consider requirements under data protection regulations. For details on personal data handling, see our Privacy Policy.

Analytics access is restricted to authorized personnel and is used exclusively for aggregated performance evaluation. Security controls applicable to production systems extend to analytics administration infrastructure.

Export-Control & Government Program Sensitivity

We maintain processes intended to support handling of export-controlled and program-sensitive information (e.g., ITAR/EAR) as applicable to a contract or data set. This includes need-to-know access controls, U.S. Person verification, and technology control plans where required by contract or regulation.

For a comprehensive overview of our export compliance posture, visit our ITAR & Export Compliance page. Official regulatory references:

Assurance, Reviews & Continuous Improvement

Security policies and procedures are reviewed at least annually and updated to reflect evolving threats, regulatory changes, and lessons learned from incidents and assessments. Audits and assessments are conducted as required by customer contracts and internal governance.