The Satellite Cybersecurity Act of 2025 passed the Senate Commerce, Science, and Transportation Committee on April 14, 2026, advancing legislation that would direct the federal government to publish voluntary cybersecurity guidance for commercial satellite operators. It is the third time a version of this bill has cleared a Senate committee since 2022, and more than six months later it still has no floor vote scheduled, the same outcome that ended both earlier attempts.
A Familiar Path to a Familiar Wall
Sens. Gary Peters (D-MI) and John Cornyn (R-TX) introduced the current bill, S. 3404, on December 9, 2025, after the previous version died without a vote at the end of the last Congress. Earlier versions went through the same cycle twice already, clearing the Senate Homeland Security and Governmental Affairs Committee in 2022 and again in 2023, only to stall once each reached the full chamber. This time sponsors routed the bill through the Commerce Committee instead, where Chairman Ted Cruz had originally scheduled a markup for March 25, 2026. That session produced no votes because no Democratic members attended, and Cruz rescheduled the executive session for April 14.
The rescheduled markup went smoothly. The Commerce Committee advanced nine bills without objection that day, including S. 3404, and most members had co-sponsored at least one of the measures on the agenda.
What the Bill Would Actually Require
The bill carries no binding mandates for satellite operators. Instead it requires the Commerce Department, working with the Cybersecurity and Infrastructure Security Agency and the FCC, to stand up a public online clearinghouse of satellite cybersecurity recommendations within 180 days of enactment, including material tailored to small businesses that build or operate satellites. The recommendations are meant to cover jamming, spoofing, eavesdropping, hijacking, and computer network exploitation. The bill also directs the Government Accountability Office to study how well existing federal programs support commercial satellite cybersecurity, and it tasks the National Cyber Director and the National Space Council with producing an interagency coordination strategy. None of it is enforceable. An operator can read the guidance, ignore it, and face no penalty either way.
Why Voluntary Guidance Keeps Losing the Floor Fight
The pattern is not unique to satellites. The Senate typically moves bills like this one by unanimous consent once they clear committee, since floor time is scarce and leadership reserves most of it for priority legislation. A single senator can block that consent with an objection or a hold, and once a must-pass measure like the annual defense authorization bill or an appropriations package consumes the calendar, smaller bills with no statutory deadline simply wait. The Satellite Cybersecurity Act has no trigger forcing a vote, so each Congress restarts the same sequence: introduction, committee approval, and an indefinite pause.
A Bundle With the Secure Space Act
Commerce advanced S. 3404 alongside the Secure Space Act, sponsored by Sens. Deb Fischer (R-NE) and Ben Ray Lujan (D-NM), which takes a harder line on a narrower problem. That bill would bar the FCC from granting satellite licenses or US market access to a company, or its affiliates, found to pose a national security risk, extending the 2019 Secure and Trusted Communications Networks Act, the law that pushed Huawei and ZTE equipment out of US telecom networks, to cover both geostationary and non-geostationary satellite systems as well as gateway stations. The FCC would get one year after enactment to write implementing rules. A House companion already passed that chamber in April 2025, giving the Secure Space Act a head start toward the president's desk that its bundled companion lacks.
Brussels Takes a Different Approach
While the Senate bill waits for floor time, the European Commission is pursuing binding rules rather than a voluntary clearinghouse. The EU Space Act, proposed in June 2025, would impose cybersecurity risk management duties on satellite operators across a spacecraft's life cycle and hold a company's management body personally liable for failing to meet them, an approach modeled on the bloc's NIS2 directive and its financial sector counterpart, DORA. The Commission's proposal leans on findings from ENISA's Space Threat Landscape report, published in March 2025, which flagged weak cryptographic practices, software misconfigurations, and supply chains dependent on off-the-shelf and open-source components as recurring weaknesses across commercial satellite fleets.
The gap between the two approaches matters more as the fleet it would cover keeps growing. KeepTrack's live catalog counted roughly 16,800 working satellites in orbit as of October 2026, with more than 10,800 of them Starlink spacecraft alone. Much of that growth has come from companies small enough that a mandatory, audited cybersecurity regime would strain their engineering budgets, which is the argument Peters and Cornyn have made since 2022 to justify starting with guidance rather than rules.
Neither the Commerce Committee nor the bill's sponsors have set a date for floor consideration, and the Senate's calendar for the rest of 2026 already carries the annual defense authorization bill and a government funding deadline, leaving little open floor time for a satellite cybersecurity vote before the 119th Congress adjourns.
First reported on the committee's advancement by Broadband Breakfast.
