The allocation model: assets occupy cyber terrain, maneuvers are arrayed on that terrain to protect mission services, and coverage and residual risk roll up into the running estimate. The spine is terrain → maneuver → mission, and the allocation driver is Defensive Weight = Criticality × Exposure. It mirrors the Technology Business Management taxonomy one layer at a time, substituting defensive coverage and residual risk for cost.
1. Network topology — the terrain, keyed to towers
The Federal Reference Agency estate expressed as zero-trust zones. Every request is brokered at the identity plane; policy enforcement points sit at each zone boundary. Each asset is owned by exactly one Defense Tower, which is what makes coverage summable.
Internet · external actors
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
X-01 Public / Mission Users | EXT | — | 0 | M3, M6 |
X-02 External Partners | EXT | — | 0 | M3, M4 |
X-03 API / Open-Data Consumers | EXT | — | 0 | M2, M6 |
X-04 Threat Actors | EXT | — | 0 | — |
Visibility & automation
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-24 Threat Intelligence / CISA-JCDC Feed | TX | — | 9 | M1, M9 |
A-22 SIEM / SOC Platform | TX | key | 8 | M1, M7 |
A-23 SOAR Platform | TX | — | 6 | M7, M8 |
A-25 Hunt Team Tooling | TX | — | 6 | M7, M10 |
TIC 3.0 edge · perimeter
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-08 TIC 3.0 Trust-Zone Gateway | T3 | key | 20 | M4, M2, M8 |
A-06 DDoS Mitigation / CDN | T3 | — | 15 | M1, M6 |
A-07 Web Application Firewall | T3 | — | 15 | M2, M4 |
Identity plane
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-01 ICAM / Policy Decision Point | T1 | decisive point | 20 | M3, M2, M8 |
A-02 Phishing-Resistant MFA | T1 | key | 20 | M3 |
A-04 Privileged Access (PAM / JIT) | T1 | decisive point | 15 | M3, M4 |
A-03 PKI / PIV | T1 | key | 12 | M3, M2 |
Public-facing mission tier
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-11 Public Service Portal | T4 | key | 25 | M2, M6, M1 |
A-13 Case Filing Service | T4 | — | 20 | M2, M6 |
A-12 Secondary Portal | T4 | — | 15 | M2, M6 |
A-09 Load Balancer | T3 | — | 10 | M2, M6 |
A-14 Public Data / Open API | T4 | — | 10 | M2, M5 |
Internal · mission-processing tier
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-15 Case Processing System | T4 | key | 15 | M2, M4, M6 |
A-16 CI/CD Pipeline | T4 | decisive point | 15 | M2, M7, M9 |
A-05 Mission-Staff Workstations | T2 | — | 12 | M2, M4, M7 |
A-10 Microsegmentation Fabric | T3 | key | 8 | M4, M8 |
Data tier
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-17 Sensitive Mission Records | T5 | decisive point | 10 | M2, M5, M6 |
A-18 PII Store | T5 | key | 10 | M2, M5 |
A-20 Object Storage (S3 Buckets) | T5 | — | 9 | M2, M5 |
A-19 Financial Data | T5 | key | 8 | M2, M5, M6 |
A-21 Audit Logs | T5 | key | 8 | M2, M8 |
Operational technology
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-27 Physical Access Control System | T6 | key | 12 | M4, M1 |
A-26 Building Management System | T6 | — | 9 | M4, M2 |
A-28 Engineering Workstations | T6 | decisive point | 8 | M4, M7 |
Facilities
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-33 Primary Data Center | T8 | key | 10 | M2, M4 |
A-34 Regional Field Offices | T8 | — | 8 | M2, M4 |
A-35 Alternate Recovery Site | T8 | key | 4 | M11, M2 |
Supply chain
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-37 Managed Service Provider | T9 | decisive point | 16 | M3, M4, M8 |
A-36 Cloud Service Provider | T9 | key | 15 | M2, M8 |
A-38 Software Build Dependencies | T9 | key | 12 | M2, M6, M9 |
A-39 Hardware and Firmware Vendors | T9 | — | 6 | M2, M9 |
Workforce
| Asset | Tower | Key terrain | Weight | Maneuvers |
|---|---|---|---|---|
A-29 Privileged Administrators | T7 | decisive point | 20 | M3, M2, M7 |
A-30 Mission Caseworkers | T7 | key | 16 | M5, M2 |
A-31 Contract Support Staff | T7 | — | 12 | M3, M8 |
A-32 Approval Authorities | T7 | key | 12 | M3, M6 |
2. Tower allocation map — bidirectional traceability
Each Defense Tower with the assets it carries, the controls that assess it and the techniques emplaced on it. Reading a row gives everything defending that ground; reading an asset's tower gives every mission it protects.
| Tower | Terrain character | Assets | Weight | Controls | Techniques |
|---|---|---|---|---|---|
T1 Identity | The high ground | 4 | 67 (14%) | 5 | 28 |
T2 Devices | The entry fords | 1 | 12 (2%) | 5 | 13 |
T3 Networks | The corridors | 5 | 68 (14%) | 5 | 22 |
T4 Applications and Workloads | The urban terrain | 6 | 100 (21%) | 2 | 18 |
T5 Data | The objective | 5 | 45 (9%) | 6 | 12 |
T6 Operational Technology | Ground you cannot maneuver freely on | 3 | 29 (6%) | 1 | 7 |
T7 Workforce | The people who operate the estate | 4 | 60 (12%) | 5 | 8 |
T8 Facilities | The ground you stand on | 3 | 22 (5%) | 4 | 7 |
T9 Supply Chain | The lines of communication | 4 | 49 (10%) | 6 | 10 |
TX Cross-Cutting | The enablers of movement | 4 | 29 (6%) | 39 | 29 |
3. Tower coverage — terrain readiness
| Tower | ZTMM stage | Coverage | Weight carried | Residual | Controls assessing it |
|---|---|---|---|---|---|
T1 Identity | Advanced | 72% | 67 | 18.8 | ID-1, ID-2, ID-3, ID-4, ID-5 |
T2 Devices | Initial | 41% | 12 | 7.1 | DV-1, DV-2, DV-3, DV-4, DV-5 |
T3 Networks | Advanced | 68% | 68 | 21.8 | KT-3, KT-4, KT-5, TM-4, TM-5 |
T4 Applications and Workloads | Initial | 47% | 100 | 53.0 | FO-3, RC-3 |
T5 Data | Initial | 44% | 45 | 25.2 | EN-3, FO-1, FO-2, RC-2, RC-4, SM-7 |
T6 Operational Technology | Traditional | 18% | 29 | 23.8 | FO-4 |
T7 Workforce | Traditional | 22% | 60 | 46.8 | WF-1, WF-2, WF-3, WF-4, WF-5 |
T8 Facilities | Traditional | 25% | 22 | 16.5 | FC-1, FC-2, FC-3, FC-4 |
T9 Supply Chain | Traditional | 20% | 49 | 39.2 | FO-6, LC-1, LC-2, LC-3, LC-4, LC-5 |
TX Cross-Cutting | Initial | 52% | 29 | 13.9 | CE-1, CE-2, CE-3, CE-4, CE-5, CE-6, CE-7, CG-1, CG-2, CG-3, CG-4, CG-5, EN-1, EN-2, EN-4, EN-5, EN-6, FO-5, FO-7, KT-1, KT-2, RC-1, RC-5, SM-1, SM-2, SM-3, SM-4, SM-5, SM-6, TA-1, TA-2, TA-3, TA-4, TA-5, TM-1, TM-2, TM-3, TM-6, TM-7 |
4. Mission bill of defense
For each mission service: the assets and towers defending it, weighted coverage and residual risk. This is the running estimate at mission altitude and the input to the temporal advantage scoreboard.
| Mission | Assets | Weight | Weighted coverage | Residual | Towers engaged |
|---|---|---|---|---|---|
MS-1 Public Service Delivery | 20 | 269 | 45% | 147.4 | T1, T3, T4, T5, T6, T7, T8, T9 |
MS-2 Case Adjudication | 23 | 298 | 41% | 175.5 | T1, T2, T3, T4, T5, T6, T7, T8, T9 |
MS-3 Open Data Publication | 10 | 141 | 51% | 69.0 | T1, T3, T4, T5, T8, T9 |
MS-4 Financial Processing | 12 | 171 | 43% | 98.2 | T1, T2, T3, T4, T5, T7, T8, T9 |
MS-5 Security Operations | 13 | 154 | 44% | 86.7 | T1, T5, T6, T7, T8, T9, TX |
5. How to read this model
- Weight says how much ground. Criticality comes from the mission owner under TM-3, not from the security function; exposure comes from reachability on permitted paths, not from network location.
- Coverage says how well it is held. Rolled up from the ZTMM maturity stage per tower.
- Residual says what remains. Weight multiplied by uncovered share, which is why a tower can rank high through low maturity or through the sheer weight of ground it holds.
- Posture says whether it holds unattended. Coverage rolled up by tower says how much; the posture model says whether it survives a federal holiday.
Values in this document are illustrative reference figures for the Federal Reference Agency archetype, not measurements of any agency. Substituting real values is the first act of adoption.