A readable web version of the 14-slide deck, generated from the deck's own slide text so the two cannot drift. Download the .pptx above to present it.
ASOM-Fed
- The Analytic Scheme of Maneuver for Federal Network Defense
- A recommended reference framework — applying U.S. Army maneuver + intelligence-analysis doctrine to any U.S. federal agency network (generic Federal Reference Agency model)
- Version 6.1 · August 2026 · Original synthesis · Unclassified / Illustrative — public information only
THE PROBLEM
- We defend like a garrison; adversaries maneuver
- GARRISON DEFENSE (today)
- Static controls & perimeter guards
- Compliance checklists as the goal
- Reaction after the alert
- One slow, undifferentiated 24/7 grind
- MANEUVERING ADVERSARY
- Seeks positional & temporal advantage
- Masses at a decisive point
- Exploits the defender's slowest loop
- Nation-state IP theft, portal fraud, ransomware
- ASOM-Fed makes the defender a maneuvering, thinking force on its own terrain.
THE REFRAME
- Fuse two mature Army doctrines onto federal terrain
- I
- Scheme of Maneuver
- Operational art — how a force arrays and moves to gain positional & temporal advantage. Allen (2020): pick durable categories of maneuver, in sequence; intent over perishable tools.
- II
- Intelligence Analysis (ATP 2-33.4)
- The analytic engine — Screen → Analyze → Integrate → Produce, structured analytic techniques, and IPB; every product carries an explicit confidence level.
- The Analytic Scheme of Maneuver (ASOM)
- A commander's-intent-driven, intelligence-led plan that arrays defensive analytic and response capabilities across cyber terrain to seize and hold positional and temporal advantage over an adversary — then continuously re-maneuvers as the situation develops.
THE ROSETTA STONE
- Army doctrine → federal cyber → your agency
- Army / ASOM term
- Federal meaning (ASOM-Fed)
- Reference-agency instantiation
- Commander
- Authorizing Official / CISO who owns risk & intent
- Agency CISO
- Key terrain
- Systems/data whose control is decisive
- the Public Service Portal, sensitive mission records corpus, ICAM
- IPB
- CPE — Cyber Preparation of the Environment
- Map portal attack surface + threat COAs
- PIR
- PCIR — Priority Cyber Intelligence Requirements
- “Are external-user accounts being taken over?”
- Fires
- Active defensive actions: block, isolate, deceive
- Auto-revoke session; quarantine; deploy decoy
- Tempo
- Rate of decision & action vs. the adversary
- Mean time to contain vs. adversary dwell
MAP BEFORE YOU MANEUVER
- The Cyber Terrain Model — nine terrain layers
- HIGH GROUND
- Identity
- ICAM · policy-decision point
- ENTRY FORDS
- Devices
- managed and unmanaged endpoints
- CORRIDORS
- Networks
- segmentation · TIC 3.0 zones
- URBAN TERRAIN
- Applications and Workloads
- portals, case systems, pipeline
- THE OBJECTIVE
- Data
- sensitive records · PII · fee data
- CONTESTED GROUND
- Operational Technology
- SCADA · clinical devices · sensors
- THE FORCE ITSELF
- Workforce
- privileged staff · contractors
- GROUND YOU STAND ON
- Facilities
- data centers · maintenance paths
- LINES OF COMMUNICATION
- Supply Chain
- MSPs · suppliers · update channels
- Cross-Cutting enablers of maneuver:
- Visibility = ISR · Automation = mobility & speed · Governance = command authority & rules of engagement
THE OPERATING LOOP
- The ASOM Cycle — run it faster than the adversary
- 1
- FRAME
- Intent + PCIRs
- →
- 2
- MAP
- CPE: terrain + threat COAs
- →
- 3
- ARRAY
- Design the scheme
- →
- 4
- MANEUVER
- Execute fires
- →
- 5
- FUSE
- Analyze + confidence
- →
- 6
- ASSESS
- Measure + re-frame
- ↺ continuous loop
- Winning =
- defender decision loop < adversary adaptation loop, at required confidence
INTENT OVER TOOLS
- The Maneuver Catalog — eleven defensive forms
- M1
- Screen / Guard
- M2
- Defense in Depth
- M3
- Envelopment
- M4
- Obstacle / Canalization
- M5
- Ambush
- M6
- Delay
- M7
- Counterattack
- M8
- Isolation / Retrograde
- M9
- Spoiling Attack
- M10
- Exploitation & Pursuit
- M11
- Reconstitution
- A scheme of maneuver names a sequence with one main effort — e.g.
- Screen → Ambush → Delay → Counterattack → Exploitation
- Each form is authored as durable intent + mechanism (mapped to a zero-trust pillar), not a perishable product name — so the doctrine survives tool churn.
A CAMPAIGN, NOT A GRIND
- Phasing — a main effort for every phase
- 0 — Shape
- Continuous CPE, ZT hardening, partnerships
- M1 · M2 · M3 · M9
- I — Deter
- Visible hardening, deception grid, attribution
- M3 · M4 · M5
- II — Seize Initiative
- Detect early, canalize, buy time
- M1 · M4 · M6
- III — Dominate
- Hunt, contain, evict
- M7 · M8 · M5
- IV — Stabilize
- Eradicate, verify, preserve availability
- M8 · M10 · M11
- V — Restore
- Recover, harden, update doctrine & PCIRs
- M11 · M10 · M2
MEASURING POSITIONAL ADVANTAGE
- One honest scoreboard: temporal advantage
- SIGNATURE METRIC — TEMPORAL ADVANTAGE
- Defender decision tempo (detect → decide → contain) vs. adversary dwell time.
- A cycle wins when temporal advantage is positive at the required confidence.
- Positional advantage
- % of attempts canalized into instrumented terrain
- Cost imposition
- Decoy interactions; adversary re-tooling forced
- Resilience
- Incidents contained without loss of statutory availability
- Maturity vector
- ZTMM movement Traditional → Optimal, per pillar
- Supporting measures of effectiveness
COMPLIANCE AS EXHAUST
- Real maneuver produces the audit evidence
- NIST CSF 2.0
- FRAME→Govern · CPE→Identify · M2–M4/M8→Protect · M1/M5→Detect · M6–M8→Respond · M11→Recover
- NIST RMF (800-37)
- Terrain overlay → Categorize/Select · maneuvers → Implement · FUSE/ASSESS → continuous Monitor
- OMB M-22-09 / ZTMM
- The maturity vector is the federal zero-trust progress report
- FISMA / agency OIG
- Cyber Running Estimate + cycle products = evidence of continuous monitoring
- You defend first; the compliance trail follows.
FEDERAL REFERENCE ARCHITECTURE
- 18-month roadmap: doctrine → maneuvers → tempo
- A
- 0–90 days
- Establish doctrine
- Defensive intent; stand up CTI/FRAME cell; first Cyber Terrain Overlay (public service portal + sensitive records + ICAM); initial PCIRs; ROE.
- B
- 3–9 months
- Emplace maneuvers
- Envelopment (M3) on identity; obstacles (M4) between tiers; deception grid (M5) in data terrain; wire automation; cycle monthly → weekly.
- C
- 9–18 months
- Achieve tempo
- Hunt team live (M7); pre-authorized containment; spoiling-attack integration with CISA/JCDC; MOE dashboard; ZTMM → Advanced/Optimal.
- Success at 18 months:
- positive temporal advantage on the main effort (sensitive mission records + identity), provable to agency OIG as continuous monitoring.
MAKING IT ASSESSABLE
- 78 controls that inherit, not compete
- The control catalog already exists — NIST SP 800-53 Rev. 5 has 20 families and ~1,196 controls. We do not replace it. What has never existed is an assessable specification for the maneuver layer.
- TM
- Terrain Management
- 7
- Know the ground: inventory, weighting, zones, connections, ownership
- KT
- Key Terrain
- 5
- What must not be lost — and whether an adversary can reach it
- ID
- Identity Terrain
- 5
- The identity plane as ground: credentials, assurance, assertions
- DV
- Devices Terrain
- 5
- The entry fords: device posture, sensor liveness, execution control
- SM
- Scheme of Maneuver
- 7
- Moves assigned to ground, honest states, deception emplaced
- TA
- Tempo
- 5
- Speed of decision, measured, governed and pre-authorized
- EN
- Engagement & Pursuit
- 6
- Declaration, reconstruction, evidence, eradication, communication
- CE
- Cycle Execution
- 7
- Cadence, posture computation, the evidentiary record
- CG
- Command & Governance
- 5
- Intent, phase, rules of engagement, disposition
- RC
- Reconstitution
- 5
- Held outside the blast radius, and exercised
- FO
- Federal Obligations
- 7
- Terrain that exists because the organization is a federal one
- WF
- Workforce Terrain
- 5
- The people who operate the estate, as ground
- FC
- Facilities Terrain
- 4
- Buildings, zones, and the maintenance paths through them
- LC
- Lines of Communication
- 5
- Suppliers, components, and the routes they reach on
- Only 12 of the 78 are genuinely net new. Everything else inherits or extends — assessed once, not twice.
ONE PRODUCT, NOT SEVEN FILES
- The suite — and how it chains together
- 1
- Framework
- Word
- The doctrine — why defense is a maneuver problem
- 2
- Control Guide
- Word + CSV/JSON
- 78 assessable controls inheriting from 800-53
- 3
- Playbook
- Interactive
- The browsable reference for practitioners
- 4
- Tower Model
- Interactive
- Assets → layers → maneuvers → missions
- 5
- Diagram Studio
- The tool
- Draw it, run the cycle, controls evaluate live
- 6
- The Brief
- Generated
- The cycle record, citing controls per section
- The chain:
- Framework (why) → Control Guide (what must be true) → Studio (do it) → Brief (prove it) → Cycle history (prove it over time)
- Evidence is a by-product of the work — nothing is authored twice.
From a wall that reacts
- to a maneuvering, thinking force.
- Intent over tools — survives tool churn
- Intelligence-led — every maneuver has explicit confidence
- Terrain-anchored — prioritizes sensitive mission records, identity, availability
- Measurable — a single honest scoreboard: temporal advantage
- ASOM-Fed v6.1 · Unclassified / Illustrative · Sources: Allen (CDR 2020); ATP 2-33.4; CISA ZTMM; NIST 800-207 / CSF 2.0 / RMF; OMB M-22-09; public federal sources.