The First Ninety Days Need a Paragraph, a Map, and a Decision.
Nothing in Phase A requires new tooling, which is precisely why it is the part most programs skip. An agency that publishes a defensive intent, builds one honest terrain overlay, and settles its rules of engagement has done more for its tempo than a year of procurement.
Doctrine, Then Maneuvers, Then Tempo.
The order is not negotiable. Emplacing maneuvers before the intent is written produces a set of controls with no main effort; chasing tempo before the maneuvers are in place produces a fast loop around an empty scheme. Phase A/B/C below is this rollout's own three-stage numbering — a different thing from the framework's six campaign phases, which a program keeps declaring long after adoption is finished.
Get intent, terrain and authority written down. Nothing here requires new tooling.
- Publish the defensive intent paragraph, signed by the Authorizing Official.
- Stand up the intelligence cell that will own the Frame and Fuse steps.
- Build the first Cyber Terrain Overlay across the portal, the crown-jewel records and the identity plane.
- Set the initial Priority Cyber Intelligence Requirements.
- Define the rules of engagement: which defensive fires are pre-authorized, and which need the AO.
Put the first forms of maneuver on the ground and start turning the loop on a fixed cadence.
- Envelopment on the identity plane — continuous authorization and just-in-time privilege.
- Obstacle emplacement between the public filing tier and the mission tier.
- A deception grid seeded through the data terrain.
- Wire the orchestration layer so pre-authorized fires actually execute at machine speed.
- Run the cycle monthly, then weekly.
Move from running the loop to winning on it.
- Hunt team operational against hypotheses raised in Fuse, not against a calendar.
- Containment pre-authorized and measured.
- Spoiling-attack integration with CISA, JCDC and the sector ISAC.
- The temporal-advantage scoreboard live in front of leadership.
- Zero-trust pillars advancing to Advanced and Optimal on the main effort.
Agency-Agnostic on Purpose.
Every ASOM-Fed artifact is instantiated against a generic Federal Reference Agency rather than a named one. That is what makes it portable: map your real systems onto the slots below and every artifact downstream becomes yours.
Archetype Slots — Substitute Your Own Systems
| Slot used across the artifacts | Your agency’s equivalent |
|---|---|
| Public Service Portal | your primary public-facing mission application |
| Case Filing System | your intake or e-filing front door |
| Case Processing System | your internal mission and caseload system |
| Public Data / Open API | your bulk-data or open-data surface |
| CI/CD Pipeline | your build and release pipeline — usually a decisive point |
| Sensitive Mission Records | your highest-value non-public records |
| PII / Financial Data Store | your privacy and payments data stores |
| Mission-Staff Workstations | your internal workforce endpoints |
| ICAM / PDP | your identity provider and policy decision point |
Public Service Portal
- Your agency’s equivalent
- your primary public-facing mission application
Case Filing System
- Your agency’s equivalent
- your intake or e-filing front door
Case Processing System
- Your agency’s equivalent
- your internal mission and caseload system
Public Data / Open API
- Your agency’s equivalent
- your bulk-data or open-data surface
CI/CD Pipeline
- Your agency’s equivalent
- your build and release pipeline — usually a decisive point
Sensitive Mission Records
- Your agency’s equivalent
- your highest-value non-public records
PII / Financial Data Store
- Your agency’s equivalent
- your privacy and payments data stores
Mission-Staff Workstations
- Your agency’s equivalent
- your internal workforce endpoints
ICAM / PDP
- Your agency’s equivalent
- your identity provider and policy decision point
Then re-score tower coverage from your own zero-trust maturity assessment, and set criticality and exposure per asset to reflect your mission. Defensive weight, coverage and residual risk recompute from there.
Ten Agency Archetypes, Pre-Scored.
Nobody should build a first terrain overlay from an empty canvas. Each archetype below loads as a real estate in the Diagram Studio — laid out, weighted, and already scored against the framework — so the work starts as editing rather than as invention.
Public Benefits Administration
High-volume citizen transactions on statutory timelines.
Regulatory & Licensing
Pre-decisional records and an external filing population.
Research Laboratory
Open collaboration culture against high-value intellectual property.
Law Enforcement
Sensitive case data with a strict need-to-know boundary.
Federal Health Services
Clinical availability where degradation has physical consequences.
Financial Regulator
Market-moving non-public information on a disclosure clock.
Land & Resource Management
Dispersed sites and substantial operational technology.
Defense-Adjacent Civilian
Controlled unclassified information and a deep supplier tier.
Small Independent Agency
Real obligations, a handful of defenders, no room for ceremony.
Shared Service Provider
A compromise here is a compromise of every tenant.
Three Things That Will Make This Fail.
Stated here rather than discovered in month seven. None of them is a tooling problem, which is why none of them can be bought around.
No Engagement Authority
If every containment action needs an approval chain, the loop cannot close faster than the adversary adapts, and the rest of the framework is decoration. Settle the pre-authorized fires first.
A Terrain Overlay Nobody Owns
An overlay that is not refreshed is worse than none, because it produces confident decisions about ground that has moved. Name the owner and the cadence in Phase A or do not build it.
Measuring Only Performance
Reporting coverage percentages without temporal advantage lets a program look healthy while losing. If leadership will not accept a metric that can go negative, the scoreboard is theatre.
New to this vocabulary? Asset, tier and mission are different classes of thing, and swapping two of them produces work that looks correct and decides nothing. The object model states each one with the question it answers and the class it is most often mistaken for.
Adopt It, Extend It, or Argue with It.
ASOM-Fed is published unclassified and built entirely from public doctrine and public sources. Agencies, integrators and researchers are encouraged to adopt it, extend it, and publish what they find — including where it turns out to be wrong.