Sixth-generation non-terrestrial networks (6G NTN) can distribute communication and mission-operations functions across terrestrial, aerial, and space infrastructure. Threat analysis must therefore connect a selected deployment, sector threat context, adversary techniques, and enforceable controls. The European Union Agency for Cybersecurity (ENISA) Space Threat Landscape supplies lifecycle, asset, threat, impact, and control context, whereas the Space Attack Research and Tactic Analysis (SPARTA) matrix supplies space-specific adversary techniques and countermeasures. Neither source alone connects deployment-specific assets and authority conditions to compatible techniques and control locations. This paper proposes a security-oriented reference architecture that separates service/network, mission-operations, and lifecycle/artifact-admission planes and marks trust boundaries only when documented changes in operator, policy, identity, command authority, assurance, or lifecycle control affect technique compatibility or control placement. A malicious-commanding example illustrates how the architecture scopes ENISA context, constrains compatible SPARTA techniques, and locates layered controls. The result is an architecture-grounded basis for relating the two sources without asserting universal ENISA-to-SPARTA equivalence.