The Analytic Scheme of Maneuver for Federal Network Defense
Interactive Playbook · v6.1 · Recommended reference framework for U.S. federal agencies · Unclassified / Illustrative
The reframe: defense as maneuver
Federal networks are still defended like a garrison — static controls, perimeter guards, compliance checklists, reaction. Adversaries maneuver: they seek positional and temporal advantage, mass at a decisive point, and exploit the defender's slowest decision loop. Select any card to read further.
The definition. The Analytic Scheme of Maneuver is an intent-driven, intelligence-led plan that arrays defensive analytic and response capabilities across cyber terrain to seize and hold positional and temporal advantage over an adversary, then continuously re-maneuvers as the situation develops.
The Rosetta Stone — Army doctrine to federal cyber
Every section of the framework rests on this translation. Search it, or select any row to see why the term matters.
⌕
Army / ASOM term
Federal meaning
Reference-agency instantiation
The Cyber Terrain Model — map before you maneuver
The enterprise as nine terrain layers. Select a layer for its key terrain, decisive points, and the controls that govern it. Cross-cutting enablers: visibility is reconnaissance, automation is mobility, governance is command authority.
The ASOM Cycle — the operating loop
Six phases fusing the analytic process with maneuver planning. Select any step to see what it produces and which controls it satisfies. The loop turns continuously — winning means running it faster and at higher confidence than the adversary can adapt.
The Maneuver Catalog — eleven defensive forms
Durable, intent-first forms. A scheme of maneuver names a sequence with one main effort. Filter by terrain layer, search, or select any move for its full detail and risk-reduction weighting.
⌕
Phasing — a main effort for every phase
Cyber defense as a campaign rather than an undifferentiated grind. Select a phase to see its objective and the moves that carry the main effort.
Assessment — measuring positional advantage
Signature metric — temporal advantage
Defender decision tempo (detect → decide → contain) versus adversary dwell time. A cycle wins when temporal advantage is positive at the required confidence.
Work out your own advantage
Measures of effectiveness — are we winning?
Measures of performance — are we maneuvering correctly?
The control set — 60 assessable requirements
The control catalog already exists: NIST SP 800-53 Rev. 5 provides twenty families and roughly 1,196 controls, and this framework neither replaces nor duplicates it. What has never existed is an assessable specification for the maneuver layer. These seventy-eight controls across fourteen families fill that gap and inherit from the existing baseline. Select any control for its full statement, discussion, evidence and assessment procedure.
⌕
Adoption roadmap — eighteen months
The catalog is not adopted wholesale on day one. Each step delivers assessable value on its own. Select a step for detail.
Success at eighteen months. Measurable positive temporal advantage on the main effort, demonstrable as continuous monitoring, and a self-improving doctrine in which each incident updates the terrain, the requirements and the maneuver catalog.
The product suite — how the pieces fit
Seven artifacts, one chain. Doctrine states what to do; the controls state what must be true; the tool does the work and produces the evidence; the brief is the record. Select any artifact for detail.
The chain. Framework (why) → Control Guide (what must be true) → Studio (do it) → Brief (prove it) → Cycle history (prove it over time). Each artifact consumes the one before it, so evidence is a by-product of the work rather than a separate documentation exercise.