Application and Control Guide

Generated from the published catalog, so this page and the machine-readable export cannot disagree. 78 controls, 784 activities.

TM · Terrain Management

Inventory, classification, weighting, zones, connections, currency, ownership

TM-1 · Terrain Inventory and Overlay

Control. The organization shall maintain a current graphical overlay of all systems, data stores, and external actors within the authorization boundary, including the trust zones in which they reside.

Purpose. To establish one authoritative positional picture of the estate, so that every later judgment about priority, reachability and risk is made against the same ground.

A register in a spreadsheet is not terrain. Terrain is positional: it records where an element sits relative to boundaries and to other elements, because position determines how an adversary moves. The overlay is the single artifact from which every other ASOM product is derived, which means an error introduced here propagates to reachability, coverage, backlog ranking and the Brief without being independently detectable in any of them.

TM-2 · Defensive Layer Classification

Control. Every element on the terrain shall be classified to exactly one defensive layer: identity, devices, networks, applications and workloads, data, operational technology, workforce, facilities, or supply chain. Elements that enable maneuver across layers rather than constituting ground — visibility and analytics, automation and orchestration, governance — shall be classified to the cross-cutting domain.

Purpose. To make posture summable and comparable by layer, and to force an explicit ownership decision for every element.

Classification is what allows posture to be rolled up and compared. The one-layer rule is what keeps the matrix partitionable: coverage summed across layers must equal total coverage, and an element counted twice inflates both. The failure this correction addresses is structural — a framework that added four terrain layers in v2.0 and v3.0 while leaving the classification control at five made those layers doctrinally present and practically unscoreable.

TM-3 · Asset Weighting

Control. Each element shall carry a defensive weight derived from its criticality to the mission and its exposure to untrusted actors, on a defined and consistently applied scale.

Purpose. To convert an undifferentiated inventory into a priority order, so that coverage figures carry meaning and investment can be argued from mission consequence.

Without weighting, coverage percentages are misleading: protecting fifty low-value assets and leaving one crown jewel exposed can still report high compliance. The scale's integrity depends on calibration rather than on definition — two assessors applying a well-written scale will still diverge until they have scored a reference set together and reconciled the disagreement.

TM-4 · Trust Zone Definition

Control. Trust zones shall be defined with explicit boundaries, and every element shall reside within a declared zone.

Purpose. To establish boundaries that something enforces, so that reachability and denied-path analysis rest on configuration rather than on design intent.

A zone that exists only on a diagram is a description of intent. Everything downstream — KT-3 avenues, KT-4 reachability, M4 canalization — computes over zone boundaries, so an unenforced zone does not merely fail to protect: it produces confident false negatives in the analysis that depends on it.

TM-5 · Connection and Denied-Path Register

Control. All permitted connections between elements shall be recorded, and paths that are deliberately blocked shall be recorded distinctly as denied paths.

Purpose. To record connectivity as three distinct states — permitted, denied, unknown — so that reachability conclusions rest on tested denials rather than on absence of evidence.

Denied paths are the load-bearing entries. KT-4 concludes that a decisive point is unreachable precisely because certain paths are blocked; if those denials are not recorded and enforced, the conclusion is unfounded. The three-state distinction matters as much as the recording: treating unknown connectivity as absent is how a reachability model becomes confidently wrong.

TM-6 · Terrain Currency

Control. The terrain overlay shall be refreshed at a defined cadence and upon any material architectural change.

Purpose. To keep the overlay current against both the clock and the change, so that planning is conducted against ground as it currently is.

A stale overlay is more dangerous than no overlay, because it is trusted. Currency has two triggers, and a program honoring only the cadence will plan from a map that a deployment invalidated the week after it was drawn. Wiring the change trigger into change management is what stops the second trigger depending on someone remembering.

TM-7 · Terrain Ownership

Control. Every element shall have a named accountable owner recorded against it.

Purpose. To attach every element to a person who can be asked to act, so that findings convert into work rather than accumulating.

Ownership is what converts a finding into work. An unowned element cannot be remediated, re-scored or defended, because there is nobody the requirement attaches to. The acceptance requirement distinguishes this control from an org chart lookup: ownership assigned silently is routinely discovered, at the worst moment, to have been news to its holder.

KT · Key Terrain and Decisive Points

What must not be lost, and whether an adversary can reach it

KT-1 · Decisive Point Identification

Control. The organization shall identify and designate the elements whose compromise would unhinge the wider defense, and shall justify each designation.

Purpose. To concentrate defensive effort on the small number of elements whose loss is decisive, so that priority is a stated judgment rather than an emergent property of the asset register.

A decisive point is not the same as a high-weight asset. Weight measures consequence of loss; decisiveness measures whether losing it collapses everything else. An identity policy decision point may carry moderate weight and still be decisive, because holding it confers control of movement everywhere. The justification requirement exists because the designation is a judgment, and an unjustified judgment cannot be argued with or inherited by a successor.

KT-2 · Decisive Point Protection Floor

Control. Every designated decisive point shall have at least one defensive move assigned and operational, and shall meet a defined minimum effective coverage.

Purpose. To ensure designation produces protection, so that identifying a decisive point is an act with consequences rather than an annotation.

The gap between designation and protection is where most programs fail. An element can be starred on the overlay for four consecutive cycles with a planned maneuver against it and never receive one. The operational qualifier is doing the work here: a move recorded as planned or partial does not satisfy the floor, because an adversary is not slowed by intent.

KT-3 · Avenue of Approach Analysis

Control. The routes by which an adversary could approach designated decisive points shall be enumerated and assessed.

Purpose. To convert the estate's connectivity into a set of named approach routes, so that defense can be emplaced on the routes that exist rather than distributed evenly across ground.

An avenue of approach is a property of the architecture, not of any particular adversary, which is what makes it enumerable in advance. The assessment step matters more than the enumeration: a route with neither a barrier nor a compensating detection is an open approach, and knowing about it without acting is worse than not knowing, because it converts a gap into an accepted one without anyone accepting it.

KT-4 · Adversary Reachability Assessment

Control. The organization shall determine, on permitted paths only, whether any threat actor position can reach any designated decisive point, and shall record the result each cycle.

Purpose. To produce a computed, repeatable answer to the question a control catalog cannot ask — can they get there from here — and to record the answer as a trend rather than a one-time finding.

This is one of the framework's genuinely net-new controls: no federal catalog requires a computed reachability result. Its integrity depends entirely on the denied-path register under TM-5. A negative result — no route exists — is a claim about configuration that holds only while the barriers holding the line remain enforced, which is why KT-5 exists and why the two controls should never be assessed apart.

KT-5 · Barrier Sufficiency

Control. Where reachability is prevented by denied paths, those barriers shall be identified, enforced technically, and monitored for change.

Purpose. To make the barriers on which negative reachability results depend into named, owned, monitored controls, so that the assurance KT-4 provides cannot be silently withdrawn.

This control exists because of a specific failure sequence: a reachability assessment returns negative, the result is briefed, a firewall rule is changed six weeks later for an unrelated reason, and nobody recomputes. The assurance persists in the record long after the configuration that justified it has gone. Change monitoring on the barrier set is the only thing that closes that window.

ID · Identity Terrain

The identity plane as ground: planes, credentials, assurance, assertions, authorization integrity

ID-1 · Identity Plane Definition

Control. The organization shall identify on the terrain overlay every authoritative identity plane, the policy decision and enforcement points it operates, and the trust relationships between planes.

Purpose. To make identity positional, so that the plane controlling movement everywhere else is itself defensible ground rather than an assumed service.

Most estates have more than one identity plane and have never drawn the relationships between them: a primary provider, a legacy directory, a cloud tenant, one or more federated partners, and a set of local account stores that answer to nobody. Trust edges between planes are the highest-value terrain in the estate, because compromise of a low-assurance plane that a high-assurance plane trusts confers the higher assurance. That is the identity equivalent of an unmapped mobility corridor, and it is invisible on a network diagram.

ID-2 · Credential Strength and Binding

Control. Identities shall be proofed to a level commensurate with the access they confer, and bound to credentials whose strength matches that level.

Purpose. To ensure the credential is as strong as the access behind it, so that proofing and authentication assurance are matched rather than assumed.

The failure this addresses is drift rather than misconfiguration. A person proofed at one level and issued a credential appropriate to it accumulates access over subsequent years, and nothing re-examines whether the original proofing still justifies the current entitlement. WF-2 catches this for privileged humans; this control generalises it to every identity including non-human ones, where the problem is worse because service identities are routinely issued long-lived secrets and then granted whatever access their consuming application later requires.

ID-3 · Authentication Assurance

Control. Users, services and devices shall be authenticated at an assurance level commensurate with the terrain being accessed, and the assurance achieved shall be recorded with the authorization decision.

Purpose. To ensure authentication strength varies with what is being reached, and that the level achieved is available to the decision that relies on it.

M3 Envelopment's stated indicator is that a stolen credential alone yields no movement, and this is the control that makes it assessable. The requirement that assurance be recorded with the decision is the part usually missing: an estate can enforce strong authentication at the front door and then issue a session that every downstream service accepts without knowing how it was obtained. Carrying the assurance level into the authorization decision is what allows a service holding decisive-point data to refuse a session that was established weakly, which is the difference between authenticating once and authenticating appropriately.

ID-4 · Identity Assertion Protection

Control. Identity assertions, tokens and session material shall be protected against interception, replay and forgery, and their validity shall be bounded in time and scope.

Purpose. To prevent a valid authentication from becoming a durable, portable credential in an adversary's hands.

Strong authentication is routinely defeated downstream rather than at the point of authentication: the token issued after a phishing-resistant login is frequently a bearer credential with a long lifetime, broad scope and no binding to the device that obtained it. An adversary who takes it inherits the assurance without the credential. Signing key protection is the same problem one level up — an adversary holding the issuing key can forge assertions at any assurance level and will not appear in authentication logs at all.

ID-5 · Authorization Decision Integrity

Control. Authorization policy shall be enforced at a decision point that every access path consults, and changes to that policy shall be controlled, logged and reviewable.

Purpose. To ensure the policy that governs movement is actually consulted and cannot be altered without trace.

M3 Envelopment's precondition, in the framework's own words, is a policy decision point that something actually enforces — an authorization engine no service consults is a document, and it will score well. This control makes that testable in both directions: paths that bypass the decision point, and changes to policy that leave no trace. The second is the higher-value target. An adversary who can add a policy rule does not need to defeat any control in this family; they authorize themselves, and unless policy change is logged and reviewed against an expected-change baseline, the alteration is indistinguishable from routine administration.

DV · Devices Terrain

The entry fords: device identification, posture as an access precondition, sensor liveness, execution control, lifecycle and sanitization

DV-1 · Device Terrain Identification

Control. Every device with a path into the estate shall be represented on the terrain overlay with its management state, its owning population, and the terrain it can reach.

Purpose. To make devices positional, so that the crossings into the estate are known and can be defended rather than merely counted.

The distinguishing requirement is management state, and the category that matters is the one most inventories omit: devices that reach the estate and are not managed by it. Contractor laptops, personal devices under a bring-your-own arrangement, vendor maintenance endpoints and unenrolled cloud workstations all cross the ford, and an inventory built from the management console will report none of them because the console can only see what it manages. Reconciling against the identity plane rather than the endpoint platform is what surfaces them.

DV-2 · Device Posture as an Access Precondition

Control. Device health shall be evaluated as a precondition of access to designated terrain, and failing posture shall deny access rather than raise a notification.

Purpose. To ensure a compromised or non-compliant device cannot spend a valid credential, closing the gap M3 Envelopment leaves when identity alone is enforced.

The word doing the work is precondition. A posture check that reports non-compliance into a ticket queue has measured device health; it has not defended anything, and the adversary holding the device proceeds unimpeded. This control is also where identity and device terrain meet: ID-3 requires authentication assurance commensurate with terrain, and device assurance is an input to that assurance rather than a parallel track. An estate enforcing strong authentication from an unhealthy endpoint has bought half the control.

DV-3 · Endpoint Sensor Coverage and Liveness

Control. Sensor coverage across the device estate shall be reconciled to the device inventory rather than to the sensor console, and a sensor that stops reporting shall be treated as a security event.

Purpose. To know what the estate can actually see, and to detect the loss of that visibility as an event rather than at the next assessment.

Two failures hide behind a healthy coverage figure. The first is the console denominator: a platform reporting 100% coverage is reporting 100% of the devices it knows about, which is a tautology, and reconciling to DV-1's inventory is the only way to get a real number. The second is silence. A sensor removed, disabled or crashed produces no telemetry, and an absence of alerts is indistinguishable from an absence of adversary — which is precisely the condition an adversary works to create. Liveness is therefore a control in its own right, not a platform health metric.

DV-4 · Execution Control

Control. What may execute on designated device terrain shall be constrained to an approved, verified set, and unauthorized execution shall be prevented rather than recorded.

Purpose. To deny the adversary the ability to run code on the ground they cross into, which is the cheapest point at which most engagements can be stopped.

Execution control is the highest-yield and least-adopted device control, because it trades operational friction now against an outcome that is invisible when it works. The framework's position is that the constraint belongs on designated terrain rather than universally — decisive points, privileged access workstations, and devices reaching the data layer — which makes it affordable and keeps it enforceable. Universal application is where these programs fail, and where they are subsequently downgraded to audit mode and forgotten.

DV-5 · Device Lifecycle and Sanitization

Control. Devices shall be provisioned from a trusted baseline and, on retirement, loss or reassignment, shall be removed from the estate's trust and their media sanitized within a stated period.

Purpose. To close the ends of the device lifecycle — the point of entry and the point of exit — where trust is granted and where it is most often left behind.

The exit end is where this control earns its place. A retired, lost or reassigned device frequently retains enrollment, certificates, cached credentials and stored data long after it has left the population it was issued to — which makes it an unattributed device holding valid trust, exactly the condition DV-1 is designed to surface and WF-5 assumes has been handled. The stated period matters as much as the action: a sanitization process that completes eventually is not a control against a device already outside the agency's physical control.

SM · Scheme of Maneuver

Choosing moves, assigning them to ground, honest implementation states, deception emplacement

SM-1 · Maneuver Catalog Adoption

Control. The organization shall adopt a defined catalog of defensive moves expressed as intent and mechanism rather than as product names.

Purpose. To fix a shared vocabulary of defensive moves stated as intent, so the plan survives replacement of the tools that implement it.

Products are replaced every few years; intent is durable. Expressing the catalog as intent means the framework survives procurement cycles and lets leaders direct without technical fluency. The adoption test is not whether the catalog exists but whether leadership can actually issue direction in its terms — a catalog nobody commands with is a glossary.

SM-2 · Maneuver Assignment

Control. Defensive moves shall be assigned to specific elements of terrain rather than declared at program level.

Purpose. To bind defensive intent to specific ground, so that coverage reflects what protects which element rather than what the program has bought.

Program-level declaration is the single largest source of coverage inflation. "We do microsegmentation" is true of an organization and false of most of its elements, and the gap between those two statements is invisible until an assignment register forces the question element by element. This control is what makes an unprotected-asset report possible at all.

SM-3 · Implementation State Tracking

Control. Each assigned move shall carry an implementation state of planned, partial, or operational, and only operational moves shall count in full toward risk reduction.

Purpose. To make the coverage figure reflect what is defending the estate rather than what is intended to, by weighting mitigation by implementation state.

This is the honesty control, and the entire posture computation rests on it. An adversary is not slowed by a planned maneuver, so a framework that counts one is producing a number about ambition rather than about defense. The control is also the framework's most fragile, because it can be defeated without any technical failure: if "operational" becomes the state recorded to avoid a finding, no assessment procedure downstream can recover. That is why the assessment tests production reality rather than the field.

SM-4 · Main Effort Designation

Control. For each phase, the organization shall designate where defensive priority is concentrated.

Purpose. To concentrate defensive priority at a declared point, so that subordinate decisions follow from it without referral.

Main effort is the concept a control catalog structurally cannot hold, because a catalog has no way to say that one requirement matters more this quarter. The designation is only real if resourcing moved: a main effort that changed no budget line, no staffing allocation and no queue priority is a label applied after the fact. The assessment procedure therefore examines resourcing rather than the declaration.

SM-5 · Branches and Sequels

Control. Pre-planned contingency maneuvers shall be defined for the most likely and most dangerous adversary courses of action.

Purpose. To decide contingency responses before contact, so that the decision loop under pressure is a selection rather than a design exercise.

The distinction between most likely and most dangerous is the whole value of the control. Planning only against the likely course produces a program that is efficient until the day it is not; planning only against the dangerous one produces a program that cannot afford its own contingencies. Holding both, and knowing which cells both demand, is where a single investment answers two threats.

SM-6 · Maneuver Effectiveness Validation

Control. The assumed effectiveness of each move shall be validated through exercise, testing, or observed incident performance, and adjusted where evidence contradicts assumption.

Purpose. To replace assumed effectiveness with demonstrated effectiveness, so the coverage figure reflects what controls do rather than what was assumed of them.

The framework's own design documentation concedes that the riskReduction weightings are an allocation model for prioritization rather than an empirical finding, and states that they should be re-based against an agency's own incident history. SM-6 is the control that discharges that obligation. An agency running the framework for several cycles without adjusting a single weighting has not validated anything — it has confirmed its priors, and its coverage figure remains a statement about doctrine rather than about its estate.

SM-7 · Deception Emplacement

Control. Deception shall be emplaced across designated terrain, and every interaction with a deception element shall raise an alert that reaches a human within a defined period.

Purpose. To obtain detection with no false-positive budget, and to ensure that signal is acted on rather than queued.

A deception element has a property no other detection has: nothing legitimate touches it, so an interaction is an incident with no triage burden and no false-positive budget. That property is destroyed by routing the alert into a queue triaged tomorrow, which is the ordinary failure and the reason the alert path is written into the control rather than left to detection engineering. The second requirement is placement: deception emplaced where an adversary would not look is decoration, and placement should follow the avenues enumerated under KT-3 rather than convenience.

TA · Tempo and Temporal Advantage

Making speed of decision measurable, governed and pre-authorized

TA-1 · Decision Loop Measurement

Control. The organization shall measure the elapsed time from detection through decision to containment, and shall record it each cycle.

Purpose. To make the defender's tempo a measured quantity rather than an impression, so that the numerator of temporal advantage exists at all.

The loop has three segments and they fail differently. Detection latency is a tooling and coverage problem; decision latency is an authority problem; containment latency is an execution problem. Reporting only the total hides which one is binding, and in most programs the binding constraint is the middle segment — which no amount of detection investment will shorten. Measuring the segments separately is what makes the metric actionable rather than merely honest.

TA-2 · Adversary Dwell Estimation

Control. The organization shall maintain a documented estimate of adversary dwell time relevant to its threat profile, with a stated basis.

Purpose. To establish the denominator of temporal advantage with an explicit, challengeable basis, so the comparison the framework rests on can be argued with.

This is the framework's most epistemically exposed control, and it should be stated plainly rather than buried. An agency can measure its own decision loop directly; it almost never measures adversary dwell against itself, because dwell is observable only in the intrusions that were eventually found — which is a biased sample by construction, and biased toward the slow adversaries. The estimate is therefore imported from external reporting and adjusted, and the signature metric consequently rests half on measurement and half on a cited assumption. The stated basis requirement exists so that this is visible to anyone reading the result rather than concealed inside a ratio.

TA-3 · Temporal Advantage Threshold

Control. The organization shall define the minimum acceptable ratio of adversary dwell to defender decision loop, and shall treat a deficit as a reportable condition.

Purpose. To convert the temporal advantage figure into a governed condition with an escalation consequence, so that being behind is a decision the organization has to make rather than a number it can note.

The sequencing requirement is what makes this control real. A threshold set after the first measurement will be set wherever the organization already passes, which produces a governed-looking metric that has never once reported a problem. Approving the threshold before the figure is known — or at minimum recording that it was approved after, and by whom — is the difference between a risk appetite and a post-hoc justification.

TA-4 · Pre-authorized Response

Control. Defensive actions that may be executed without escalation shall be defined in advance and approved by the accountable authority.

Purpose. To remove authority latency from the decision loop, so that the segment most programs cannot shorten with tooling is shortened by governance.

This is the highest-leverage control in the family and the cheapest to implement, because it costs no technology. TA-1's segment breakdown usually shows the decide segment dominating the loop, and decide latency is almost entirely the time spent locating someone with authority. Pre-authorization converts that from an incident-time search into a design-time decision. The constraint is that it must be genuinely bounded: an authority so broad that it permits degrading a public service without reference will not survive its first use, and one so narrow that every real action falls outside it changes nothing.

TA-5 · Tempo Degradation Trigger

Control. Conditions under which the defender decision loop is expected to degrade shall be identified, with compensating measures defined.

Purpose. To plan for the periods in which tempo predictably falls, so that the measured advantage is not a statement about the organization's best hours only.

Tempo is not a constant, and its degradation is not random. Nights, weekends, federal holidays, shift handovers, key-person absence, hiring gaps, contract transitions and major change windows all reduce the loop — and adversaries select those windows deliberately. A temporal advantage figure computed across a cycle averages over these conditions and therefore overstates the position at exactly the moments contact is most likely. This control exists so the average is not mistaken for the floor.

EN · Engagement and Pursuit

Declaration, triage, reconstruction, evidence, escalation, eradication, communication

EN-1 · Event Declaration and Triage

Control. Adverse events shall be declared as incidents against defined criteria, and every declared incident shall be triaged, validated, categorized and prioritized within a stated period.

Purpose. To convert raw events into a decided position quickly, since this is the segment of the decision loop that most often binds.

TA-1 measures the decide segment; this control is what the decide segment consists of. Declaration criteria matter more than they appear: an estate without them declares incidents by judgment, which means the threshold moves with analyst experience, workload and the hour of day, and the resulting tempo measurement compares populations that were selected differently in each cycle. Validation is the second half — a triage process that categorizes without validating produces confident categorizations of events that never happened, and the cost lands on the eviction path.

EN-2 · Engagement Reconstruction

Control. For every declared incident, the organization shall reconstruct what took place — the entry, the movement, the dwell interval and the scope reached — and shall record the actions taken during the investigation.

Purpose. To establish what actually happened, since every consolidation activity depends on a reconstruction and none of them can be performed without one.

M10's stated precondition is a dwell reconstruction, and the framework's own material observes that the reconstruction gets harder every day after the ticket closes. This is the control that makes it a requirement rather than an intention. The reconstruction is also load-bearing far beyond the incident it describes: RC-4 selects a restore point against it, TA-2 corrects the imported dwell estimate against it, M10.02 verifies avenue closure against it, and CE-2 revises intelligence requirements from what it showed could not be seen. An agency that closes incidents without reconstructing them has disabled four controls it believes it operates.

EN-3 · Evidence Preservation

Control. Incident data and metadata shall be preserved at a fidelity and for a period sufficient to support reconstruction, legal action and subsequent analysis, under a defined chain of custody.

Purpose. To ensure the material an engagement depends on still exists when it is needed, and is admissible where that matters.

Retention is the failure that cannot be remediated after the fact. If telemetry retention is thirty days and plausible dwell is ninety, the reconstruction under EN-2 cannot reach the entry point, RC-4 cannot select a safe restore point, and no amount of subsequent investment recovers the data. Retention should therefore be set against the dwell estimate rather than against storage cost, which is the same reasoning applied by FC-2 to physical crossing logs. Chain of custody is the second requirement and is frequently omitted until an incident turns out to involve an insider or a criminal referral, at which point it cannot be established retrospectively.

EN-4 · Escalation and Engagement Authority

Control. Incidents shall be escalated against defined criteria to an authority that is reachable within a stated period, and the authority exercised shall be recorded against the action taken.

Purpose. To remove the search for a decision-maker from the decision loop, which is where the decide segment is usually spent.

TA-4 defines what may be done without escalation; this control governs what happens when escalation is required, and the two together constitute the decide segment. The binding constraint in most programs is not deliberation but locating someone with authority, and that is an availability problem rather than a judgment problem. Recording authority against action closes the loop in the other direction: an operator who acted correctly under written authority and is later questioned needs the record more than the organization does, and without it the practical effect is that the next operator escalates instead.

EN-5 · Eradication and Transition to Recovery

Control. Incidents shall be eradicated, the eradication verified, and the transition to recovery made against defined criteria with recovery actions selected, scoped and prioritized.

Purpose. To ensure the adversary is actually gone before the mission is restored, and that the transition is a decision rather than a drift.

The transition from M8 Isolation to M11 Reconstitution is the most consequential judgment in an engagement and is usually made informally, under pressure to restore availability, on the basis that nothing further has been observed. Absence of observation is not verification, particularly where EN-2 found visibility gaps. The recovery-action scoping requirement addresses the other half: RC-3 sequences rebuild paths and RC-5 exercises them, but nothing selected which actions this particular incident requires, and restoring more than necessary extends outage while restoring less leaves the adversary a foothold.

EN-6 · Engagement Communication

Control. Incident and recovery information shall be shared with designated internal stakeholders, external partners and the public as the situation and the agency's obligations require, within stated periods.

Purpose. To ensure the people who must know, do — inside the agency, across the federal community, and among those the mission serves.

This control covers three audiences with different clocks and is distinct from CE-7, which distributes the cycle Brief internally on a cadence. Internal stakeholder notification is an operational obligation; federal reporting to CISA and sector partners is frequently a statutory one with a defined window; and public communication during a recovery is where a federal agency's obligation to the people it serves becomes concrete. The framework's own material puts the community reporting case well: reporting is not altruism in a federal community — it is how the next agency's spoiling attack becomes possible, and how yours does.

CE · Cycle Execution and Assurance

Cadence, intelligence requirements, posture computation, the evidentiary record

CE-1 · Cycle Cadence

Control. The organization shall execute the full analytic cycle at a defined cadence and shall not allow the interval to lapse without recorded justification.

Purpose. To keep the loop turning, so that defensive posture is a maintained position rather than a periodic assessment.

The cycle is the first thing sacrificed when the SOC is busy, and the SOC is busy precisely when the cycle would be most valuable. That inversion is the failure mode this control exists to catch. A lapse is also invisible by default — nothing alerts when a cadence quietly stretches from monthly to quarterly, and a program can discover it only by looking at dates it has no reason to look at. Requiring a recorded justification makes the lapse an event rather than an absence.

CE-2 · Priority Intelligence Requirements

Control. Each cycle shall begin with a defined set of priority intelligence requirements that drive collection and hunting.

Purpose. To direct analytic effort at named questions, so that collection and hunting answer what the accountable authority needs rather than processing what arrives.

Hunting without a requirement is sampling, and sampling an estate of federal scale returns whatever the analyst already expected to find. The tracking requirement is what separates this from a wish list: requirements that are recorded, never answered, and silently carried forward for four cycles describe an intelligence function that is busy rather than one that is directed. A requirement should close — as answered, as no longer relevant, or as unanswerable with current collection, which is itself a finding about visibility.

CE-3 · Fusion and Confidence

Control. Analytic conclusions shall be recorded with an explicit confidence level and the basis for that confidence.

Purpose. To distinguish assessment from assertion, so that decisions taken on analytic conclusions carry the uncertainty of those conclusions with them.

Confidence is what makes an analytic product falsifiable. A conclusion offered without it cannot be wrong in any useful sense, because it never committed to a degree of belief. The scale also has to be usable in both directions: if every product is issued at high confidence, the scale conveys no information and the field is decorative. An analytic function that has never published a low-confidence assessment on a significant question is not being careful, it is being unfalsifiable.

CE-4 · Coverage and Residual Risk Computation

Control. Defensive coverage and residual risk shall be computed from asset weighting, layer maturity, and operational move mitigation, using a documented method.

Purpose. To produce a posture figure that can be reproduced and challenged rather than asserted, so that the number carries authority beyond the tool that generated it.

The denominator determines the answer, and the choice of denominator is a judgment that must be published rather than embedded. Counting techniques evidenced rewards tagging a crowded intersection over a sparse one for identical effort; counting ground held — terrain × form cells occupied — does not, which is why the framework scores that way. But the reasoning is only defensible if it is stated where the figure appears. A coverage percentage whose denominator is undisclosed is not a measurement, and an adopter who cannot reproduce it cannot argue with it.

CE-5 · Remediation Backlog Prioritization

Control. Identified gaps shall be ranked by the residual risk they retire per unit of effort, and shall be assigned owners and target dates.

Purpose. To make the backlog answer where the next hour of work goes, rather than enumerate everything wrong.

Ranking by risk alone produces a backlog headed by items nobody can afford; ranking by effort alone produces a quarter of completed busywork with the risk position unchanged. The ratio is the whole point, and it is also the part most often dropped in implementation, because effort estimates are uncomfortable to produce and easy to omit. A backlog with risk scores and no effort estimates has not implemented this control.

CE-6 · Cycle Record and Trend

Control. Each cycle shall be recorded with its posture result, and the trend across cycles shall be reported.

Purpose. To answer whether the program is improving — a question no point-in-time assessment can address.

A trend is only interpretable if the denominator did not change between its points, and the framework's own versioning rules make this concrete: a structural change adds or removes a form, a terrain layer or a phase, and every coverage score computed against the prior version becomes incomparable. A series that silently spans a version boundary is not a trend, it is two trends drawn as one — and it will show improvement or decline that is an artifact of the denominator rather than of the estate. Recording the framework version against each point is what makes the series honest.

CE-7 · Brief Generation and Distribution

Control. Each cycle shall produce a brief recording terrain, decisive points, scheme of maneuver, posture, findings, and trend, distributed to the accountable authority.

Purpose. To produce one document per cycle that an Authorizing Official can decide from, rather than a dashboard nobody decides from.

Generation and distribution are the easy halves; use is the control's actual object. A Brief that is produced, distributed and never decided from satisfies every literal reading of the requirement and delivers nothing, which is why the assessment interviews recipients rather than examining distribution lists. The Brief is also the framework's compliance exhaust: because each section cites the controls it evidences, a retained series of Briefs is the FISMA continuous-monitoring record, produced as a by-product of defending.

CG · Command and Governance

Intent, phase, rules of engagement, findings disposition, inheritance

CG-1 · Defensive Intent

Control. The accountable authority shall issue a defensive intent stating the end-state to be protected and the risk that is acceptable, expressed in plain language.

Purpose. To give subordinate decisions a reference point, so that people can act correctly without referring upward.

The test of an intent is operational, not literary: can someone two levels down, at three in the morning, make a decision from it without calling? Most published intents fail that test because they state aspiration rather than acceptable risk. "Protect mission-transaction integrity and sensitive records; degrade gracefully, never fail open" tells an operator what to trade when they must trade something. A statement that lists everything as important tells them nothing, and they will escalate — which is the decide-segment latency TA-1 measures.

CG-2 · Phase Declaration

Control. The organization shall declare its current campaign phase, and shall align main effort and resourcing to it.

Purpose. To make "we are in Phase III" a sentence that changes behavior, rather than a label applied to a state of affairs.

Phase declaration shares a failure mode with main effort designation: both are trivially satisfiable as labels and both are meaningless unless something downstream is keyed to them. The framework's design keys real consequences to phase — pre-authorized response sets widen (TA-4), session lifetimes shorten, dominant forms change, and resourcing shifts. If none of those change on transition, the declaration is a status field. The assessment therefore tests what changed, not what was declared.

CG-3 · Rules of Engagement

Control. The organization shall maintain approved rules of engagement defining which defensive actions may be executed at which authority level.

Purpose. To let operators act inside a known mandate rather than guessing at one, and to make the boundaries of that mandate legally and operationally sound.

Rules of engagement carry a constraint the rest of the framework does not: some defensive actions have statutory consequences. Degrading a public service where a statute sets a deadline, or acting on a system holding regulated records, is not purely a security decision. The ROE is where those limits are recorded, and it is also where the framework's boundary sits — nothing in ASOM-Fed contemplates action outside the agency's own terrain, and the ROE should say so explicitly rather than leaving it to inference from doctrine.

CG-4 · Findings Disposition

Control. Findings raised by architectural review shall be dispositioned as remediated, accepted with justification, or transferred, within a defined period.

Purpose. To ensure every finding reaches a decision, so that the open set reflects work in progress rather than accumulated neglect.

Acceptance is where this control is defeated. A finding accepted permanently, by someone without the authority to accept it, disappears from view while the risk remains — and a program with a large accepted set can report a small open set indefinitely. Two requirements close that: acceptance must be by a person whose risk authority covers the exposure, and it must expire, forcing periodic re-decision rather than one-time disposal.

CG-5 · Control Inheritance Mapping

Control. The organization shall maintain the mapping between these controls and its existing control baseline, and shall assess inherited controls once rather than twice.

Purpose. To keep the framework additive, so that adopting it adds assessment effort only where it adds assessable content.

This is the control adoption depends on. A framework layered onto SP 800-53 that re-assesses what 800-53 already covers doubles the assessment burden and will be declined regardless of merit — and the decline will be correct. The mapping has to be maintained rather than published once: control baselines are tailored, overlays change, and an inheritance claim citing an assessment that no longer covers the requirement is worse than no claim, because it retires a requirement that nothing is actually testing. FO-3 applies the same discipline at a different scope: CG-5 verifies inheritance from a control baseline, FO-3 verifies it from a service provider, and a requirement can fall between the two if neither is checked.

RC · Reconstitution and Recovery

Recovery held outside the blast radius and proven by exercise

RC-1 · Recovery Objectives

Control. Every mission service shall have a declared recovery time objective and recovery point objective, approved by the service owner, recorded on the terrain overlay before an incident occurs.

Purpose. To establish what recovery must achieve, so that restoration can succeed or fail rather than simply take however long it takes.

Without a stated time and a stated tolerable data loss, recovery has no success condition. The approval requirement matters as much as the numbers: an objective set by the security or infrastructure function is a capability estimate, whereas one set by the service owner is a mission judgment about what the agency can survive. Those are different claims, and only the second can justify the investment the first implies. A declared objective is also not a demonstrated one — that distinction is RC-5's object, and an agency holding objectives it has never tested holds aspirations.

RC-2 · Isolated Recovery Capability

Control. The means of recovery shall be held outside the trust boundary of the production identity plane, such that compromise of production credentials cannot reach, alter, or destroy them.

Purpose. To ensure the recovery capability survives the compromise it exists to recover from.

This is the ransomware lesson stated as a control. Backups that authenticate against the production identity provider are reachable by anyone who holds production administrative credentials, which is precisely the position an adversary occupies at the moment recovery becomes necessary. The operative test is narrower and more useful than "held outside the boundary": can a production administrator credential, used adversarially, reach the recovery store? That question has a demonstrable answer, and a great many recovery architectures that satisfy the general statement fail the specific test.

RC-3 · Trusted Rebuild Path

Control. For every decisive point, the organization shall maintain a documented and tested path to rebuild the element from trusted media within its declared recovery time objective.

Purpose. To ensure that what must not be lost can be rebuilt, from a source the adversary did not touch, inside the time the mission requires.

Most rebuild procedures assume a working identity plane — they begin with authenticating to something. Where identity is itself the decisive point that was compromised, the procedure contains a circular dependency, and it surfaces at the worst possible moment. The identity plane's own rebuild path therefore has to be tested independently and first, because every other path in the estate depends on it. The trusted-media requirement carries the second half of the problem: media stored, indexed or validated by the compromised environment is not trusted media regardless of where it physically sits.

RC-4 · Recovery Integrity Verification

Control. Restored data and rebuilt systems shall be verified against an integrity record maintained independently of the system being restored, before the service is returned to use.

Purpose. To ensure restoration returns the mission to a known-good state rather than reinstating the compromise.

Recovery has a failure mode that looks exactly like success: restoring from a point after the intrusion began returns the service, the data and the adversary together. The integrity record therefore has to satisfy two conditions rather than one — it must be maintained independently of the system being restored, and it must predate the earliest plausible compromise. The second condition is what connects this control to dwell estimation: if adversary dwell may have been ninety days, an integrity baseline taken thirty days ago verifies nothing useful, and the restore point has to be chosen against the dwell estimate rather than against the last known-good backup.

RC-5 · Reconstitution Exercise

Control. The organization shall exercise reconstitution against a stated failure scenario on a defined cadence, and every declared recovery objective shall have been demonstrated within its stated period.

Purpose. To convert declared recovery capability into demonstrated capability, so that objectives are proven before they are needed.

This is the control that makes the rest of the family real, and it is the one the framework's own analysis identifies as most often asserted rather than demonstrated. The scenario is where exercises usually fall short: an exercise that restores a single application from a clean environment demonstrates a procedure, not a reconstitution. The scenarios that test what RC-2 and RC-3 actually claim are the uncomfortable ones — loss of the identity plane, loss of the management plane, recovery under an assumption that production credentials are held by the adversary. An exercise program that has never run those has not tested the family's central dependency.

FO · Federal Obligations

Terrain that exists because the organization is a federal one

FO-1 · Privacy Terrain Identification

Control. Elements holding personally identifiable information shall be identified on the terrain overlay, with the authority under which the information is held recorded against each.

Purpose. To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.

Privacy terrain is the only ground in the framework where holding more of it is itself the risk. Everywhere else, an element on the overlay is an asset to be defended; here, an element holding personal information without a recorded authority is an exposure that should be removed rather than protected. The authority requirement is therefore doing double duty — it satisfies the federal obligation, and it surfaces holdings that no authority covers, which are the ones a defense should not be built around in the first place.

FO-2 · Controlled Unclassified Information Handling

Control. Elements processing, storing, or transmitting controlled unclassified information shall be identified on the terrain overlay, and the boundaries across which that information may move shall be declared.

Purpose. To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.

CUI is defined by the information, not by the system, which means it moves — into a spreadsheet, an email, a ticketing system, a contractor's environment — and each move takes the obligation with it. Marking elements is therefore only half the control; declaring permitted flows is what makes an undeclared movement a detectable event rather than an invisible one. The failure mode is a correctly marked estate with no declared flows, in which every element is compliant and the information is nonetheless everywhere.

FO-3 · Tenancy and Inheritance Boundary

Control. For every element hosted in a shared or authorized service, the overlay shall record which controls are inherited from the provider and which remain the organization's responsibility.

Purpose. To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.

The customer responsibility matrix is the most reliably unread document in federal cloud adoption. The provider states that a control is the customer's responsibility; the customer assumes that a FedRAMP-authorized service handles it; and the control is implemented by neither while appearing satisfied to both. That gap is invisible on any inventory and visible on this overlay, because an unassigned customer responsibility appears as an element with an inheritance claim and no owner. This control and CG-5 are the same discipline applied at different scopes — CG-5 verifies inheritance from a control baseline, FO-3 verifies it from a service provider.

FO-4 · Operational Technology Terrain

Control. Operational technology, industrial control, and physical-effect systems shall be represented on the terrain overlay as a distinct defensive layer, with their connections to enterprise terrain declared.

Purpose. To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.

Operational technology is ground you cannot maneuver freely on. Systems that cannot be patched or restarted on the defender's schedule remove whole classes of move from availability, and the consequence of loss is physical rather than informational. Scoring OT against enterprise expectations produces findings the agency cannot action and obscures the ones it can. The connections are where the real risk sits: engineering workstations, vendor remote access, historian replication and shared identity are the paths by which enterprise compromise becomes physical consequence, and they are routinely absent from network diagrams that show an air gap.

FO-5 · Statutory Availability Floor

Control. Where statute, regulation, or an authorizing instrument sets a deadline the mission must meet, the affected services shall be identified and their recovery objectives shall be set no weaker than that deadline requires.

Purpose. To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.

This is the control that tells the SOC when it must not degrade. Isolation and retrograde under M8 trade availability for containment, and that trade is ordinarily the accountable authority's to make — except where a statute sets a deadline the agency must meet, at which point the trade has a legal boundary that no security judgment overrides. Recording the floors in advance is what allows that boundary to be respected at three in the morning by someone who is not a lawyer, and it is why FO-5 feeds directly into the rules of engagement under CG-3.

FO-6 · Supply Chain Obligation

Control. The organization shall maintain a supply chain risk management program meeting its federal obligations, and shall record which acquisitions fall within its scope.

Purpose. To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.

The distinction between this control and LC-1 is the difference between an obligation and an operation. LC-1 asks who has a path into the estate and what it reaches — a terrain question, answered on the overlay. FO-6 asks whether the agency runs the program it is required to run, and to which acquisitions that program applies. Scope is where this control does its work: supply chain obligations rarely apply to every acquisition, and an agency that has never recorded the boundary cannot demonstrate either compliance inside it or a considered position outside it.

FO-7 · Obligation Profile Declaration

Control. The organization shall declare which federal obligations it stands on, with the basis for each inclusion and exclusion, approved by the accountable authority; obligations outside the declared profile shall be scored out of scope rather than as gaps.

Purpose. To make the scope of the FO family an approved position, so that coverage figures are comparable and exclusions are decisions rather than silences.

This control exists because a denominator that is never written down cannot be compared or challenged. Two agencies reporting FO coverage of sixty percent may have scored against entirely different obligation sets, and neither figure means anything without the profile behind it. The exclusion basis carries more weight than the inclusion basis: including an obligation that does not apply is merely wasteful, while excluding one that does is a compliance failure concealed inside a scoping decision that nobody recorded.

WF · Workforce Terrain

The people who operate the estate, held as ground

WF-1 · Workforce Terrain Identification

Control. The organization shall identify on the terrain overlay the roles whose compromise would materially advance an adversary, and record the population holding each.

Purpose. To make the workforce positional, so that defensive effort concentrates on the roles an adversary would actually target.

Identifying roles rather than individuals is what makes this terrain defensible without becoming personnel monitoring. A role is a standing property of the estate; the people in it change, and defending the role survives that change. Population size is the second half of the picture and is routinely omitted: a privileged role held by three named engineers can be defended by measures that are absurd for a role held by four hundred caseworkers, and a program that records only the role list will apply the wrong move to one or the other.

WF-2 · Privileged Human Register

Control. Every privileged account shall resolve to a named, currently employed, appropriately vetted individual, and the register shall be reconciled on a defined cadence.

Purpose. To ensure privilege is held by accountable people, so that every privileged action has a person behind it.

Three failure classes hide behind an apparently clean privileged account list: accounts bound to departed staff, accounts bound to nobody at all — shared, service, or legacy — and accounts bound to people whose vetting no longer covers the access they hold. The reconciliation cadence catches the first, the resolution requirement catches the second, and the vetting check catches the third, which is the one most often missed because it fails silently as access accumulates around a person who was correctly cleared for their original role.

WF-3 · Role-Based Readiness

Control. Personnel in identified workforce terrain shall receive preparation specific to how their role is actually attacked, and their readiness shall be measured rather than attested.

Purpose. To prepare people for the attacks their role attracts, and to know whether the preparation worked.

Completion is attestation; performance is measurement, and the gap between them is where most awareness programs live. A hundred percent completion rate across generic annual training tells you about administration, not about readiness. Role specificity is the other half: the attacks aimed at a finance approver, a systems administrator and a public-facing caseworker are different, and generic content prepares none of them well. The design constraint worth stating is that measurement here is of a role's readiness, and results should be used to direct preparation rather than to identify individuals for sanction — a program that punishes failure gets under-reporting, which is the opposite of what it needs.

WF-4 · Insider Risk Position

Control. The organization shall define, and be able to execute, a rights-respecting process for resolving an indication of insider risk, with a stated disposition period.

Purpose. To be able to resolve an indication proportionately and lawfully, so that the organization is neither unable to act nor acting without safeguards.

This control is written around resolving an indication, not around monitoring a population, and the distinction is the whole design. A process that begins with an indication and proceeds under defined safeguards is insider risk management; a capability that continuously scores individuals for propensity is workforce surveillance, and it corrodes exactly the cooperation that makes the rest of this family work. The rights safeguards are therefore assessed as part of the control rather than treated as an external constraint: legal and privacy review of the process, defined authority to initiate, minimum-necessary access to personal information, a disposition period that prevents indefinite open suspicion, and a route by which a closed indication leaves no residue against the person.

WF-5 · Separation and Revocation Tempo

Control. All access held by a departing or suspended individual shall be removable in a single action, within a period measured against the tempo at which that access could be misused.

Purpose. To close the window between a person ceasing to be trusted and their access ceasing to work.

Two properties are being required, and they fail independently. Single action fails when access exists outside the primary identity provider — local accounts, SaaS applications provisioned outside single sign-on, VPN credentials, API keys, shared secrets — each of which survives a correctly executed identity-provider disablement. Within tempo fails when the process is complete but slow: a revocation that takes four days is not a control against access that could be misused in twenty minutes. The tempo comparison is what connects this control to the TA family, and the period should be derived from what the access could do rather than from what the offboarding process currently achieves.

FC · Facilities Terrain

Buildings, zones, and the maintenance paths reaching through them

FC-1 · Facility Terrain Identification

Control. Facilities housing mission systems, data, or personnel in identified workforce terrain shall be represented on the terrain overlay, with the elements each contains recorded.

Purpose. To resolve the estate to physical locations, so that defense, recovery and continuity can be reasoned about in the place things actually are.

The test that makes this control concrete is whether every designated decisive point resolves to a named facility. An agency that cannot say which building its identity provider's hardware sits in cannot defend it physically, cannot plan its rebuild under RC-3, and cannot assess whether the environmental sustain period of that building satisfies the recovery objective of everything depending on it. Cloud-hosted elements resolve to a provider region rather than an agency facility, and recording that distinction is part of the control rather than an exemption from it.

FC-2 · Physical Zone Boundary

Control. Facilities shall be divided into zones whose boundaries are enforced and logged, and the zone containing each decisive point shall be identified.

Purpose. To establish physical boundaries that constrain movement and produce a record of crossing, so that physical terrain can be defended in depth rather than at a perimeter.

These are physical zones and they are not the logical trust zones of TM-4; conflating the two produces an overlay that claims segmentation it does not have in either dimension. The word doing the work here is enforced, and its physical failure mode is specific: a boundary that opens for an authorized badge and admits whoever follows has controlled a door without attributing an entry. Enforcement in this control means individual attribution at the crossing, because a log that records which badge opened a door — rather than who passed through it — cannot answer the question an investigation will ask.

FC-3 · Maintenance Access Control

Control. Vendor and remote maintenance shall occur only within an approved, time-boxed, supervised window, and no maintenance path shall exist outside one.

Purpose. To ensure the maintenance path — authorized, expected, and outside the normal identity plane — is bounded in time and observed while open.

Maintenance access is the path that bypasses everything else precisely because it is legitimate. It is often granted outside the agency's own identity plane, frequently at a level of privilege the vendor specifies rather than the agency scopes, and it is renewed indefinitely because removing it risks a support contract. The requirement that no path exist outside a window is the whole control; a maintenance account that is disabled between windows and a maintenance account that merely goes unused between windows look identical in a register and behave completely differently under compromise.

FC-4 · Environmental Continuity

Control. For each facility carrying a mission service, the environmental conditions the service depends on shall be identified, and the period the facility can sustain the service without them shall be stated.

Purpose. To know how long the physical ground holds without support, so that recovery objectives are not contradicted by the buildings the services sit in.

This control's value is almost entirely in a comparison that two separate documents make impossible: the environmental sustain period of a facility against the recovery time objectives of the services housed in it. A four-hour uninterruptible supply under a twenty-four-hour recovery objective is a contradiction that is obvious once the two figures are placed side by side and invisible while they live in a facilities record and a continuity plan respectively. Putting facilities on the overlay is what makes the comparison routine.

LC · Lines of Communication

Suppliers, components, and the routes they reach the estate on

LC-1 · Supplier Terrain Register

Control. Suppliers, integrators and managed-service providers with a path into the estate shall be registered on the terrain overlay, with the access each holds and the elements it reaches recorded.

Purpose. To make third parties positional, so that supplier risk is assessed against what a supplier can reach rather than against what they were contracted to do.

Procurement already holds a vendor list; this is not that. The distinguishing requirement is the elements it reaches — a supplier with a narrow contract and broad technical access is the case this control exists to surface, and it is invisible on any acquisition record because the contract describes intent while the entitlement describes capability. Reconciling the register against provisioned access rather than against contracts is therefore the control's operative activity, and it routinely finds access that outlived the engagement that justified it.

LC-2 · Component Provenance

Control. Software and hardware components deployed into the estate shall resolve to a verified origin, and the organization shall maintain a current inventory of what those components contain.

Purpose. To know where deployed components came from and what is inside them, so that a compromise disclosed anywhere can be located here.

Provenance and contents are two different questions and both are required. Provenance answers where a component came from; the inventory answers what it carries. A correctly signed package containing a vulnerable transitive dependency has verified provenance and unknown content, and an agency holding only the first cannot answer the question that actually arrives — are we running this? — when a component compromise is disclosed. The practical measure of this control is time to answer that question across the whole estate, which is why that is its outcome metric rather than inventory completeness.

LC-3 · Supplier Access Constraint

Control. Supplier access shall be brokered through the organization's own identity plane and constrained to the elements the engagement requires, with no standing access to a decisive point.

Purpose. To keep supplier access scoped, observable, and revocable by the agency rather than by the supplier.

Brokering is the requirement that carries the rest. Where a supplier holds credentials the supplier issued, the agency can request removal but cannot perform it — which means LC-5's severance capability does not exist regardless of what the contract says. Routing access through the agency's own identity plane converts severance from a negotiation into an action. The scoping requirement addresses the second failure: supplier access is habitually provisioned at the privilege level the supplier requests, which reflects their convenience across all customers rather than this engagement's need.

LC-4 · Update Integrity and Staging

Control. Supplier-provided updates shall be integrity-verified before deployment and shall pass through a staging ring for a stated period before reaching the whole estate.

Purpose. To limit the blast radius of a compromised trusted update, so that supply chain compromise reaches a ring rather than the estate.

The soak period is the control, and its length is the part most often chosen arbitrarily. A staging ring protects only if the soak exceeds the time the organization needs to notice something wrong — so the period should be derived from the measured detection segment of the decision loop under TA-1, not from a release calendar. An estate with a ten-day detect segment and a twenty-four-hour soak has implemented staging and gained almost nothing from it, and that mismatch is invisible unless the two figures are compared deliberately.

LC-5 · Supplier Severance Capability

Control. The organization shall be able to sever a supplier's access within a stated period and continue the mission, and shall have demonstrated it.

Purpose. To retain the option of cutting a line of communication, so that a compromised or failed supplier is a decision rather than a dependency.

Two halves, and the second is the one usually missing. Severing access is an identity and network action that LC-3's brokering makes achievable. Continuing the mission afterwards is an operational question that nobody answers until it is urgent — and for a managed-service provider or a sole-source integrator, the honest answer may be that the mission cannot continue, which is itself a finding worth having in advance rather than during. Severance without continuity is not a defensive option; it is an outage the agency chose.