Regulation 171 Operator security programme

(1)

Where there is a requirement to appoint a security manager under Chapter 1 of Part 3, the security manager for a spaceflight operator (“the security manager”) must draw up and maintain an operator security programme (“the programme”) for spaceflight activities in respect of which that manager is responsible.

(2)

The programme must be integrated with the space site security programme.

(3)

The spaceflight operator must comply with the requirements of the programme.

(4)

The programme must—

(a)

comply with the requirements mentioned in paragraph (5), and

(b)

describe the methods and procedures mentioned in paragraph (6).

(5)

The requirements are that the programme must—

(a)

be kept up to date,

(b)

be reviewed no more than 12 months after the date on which the licence was granted and, subsequently, at intervals not exceeding 12 months,

(c)

be sent to the regulator as soon as possible following a review referred to in sub-paragraph (b),

(d)

comply with international obligations of the United Kingdom and be consistent with those obligations,

(e)

be specific and proportionate to the spaceflight activities being carried out by the spaceflight operator, and

(f)

be based on a security risk assessment which—

(i)

has been carried out by the security manager,

(ii)

is reviewed no more than 12 months after the date on which the licence was granted and, subsequently, at intervals not exceeding 12 months, and

(iii)

is kept up to date.

(6)

The programme must describe—

(a)

the appropriate measures for protecting launch vehicles, payloads and carrier aircraft at the spaceport (see regulations 182 and 183),

(b)

the appropriate security controls for flight safety systems (see regulation 184),

(c)

the appropriate training, qualifications and national security vetting procedures necessary for individuals carrying out security functions for the operator (see regulations 187 to 190),

(d)

how compliance with methods and procedures mentioned in this paragraph is to be monitored by the security manager, and

(e)

the procedures in place for protection of US technology at the site (see regulations 192 to 202).