{
  "_note": "Federal Reference Agency asset register. Assets T1-T5 are transcribed from the published v3.0 Tower Model topology. Assets marked v5.0 are ADDITIONS: the v3.0 register carried no T6-T9 assets at all, which meant the four terrain layers added in v2.0 and v3.0 had control families and no ground to score them on. Criticality and exposure are illustrative reference values on a 1-5 scale; adopters substitute their own. Defensive Weight = Criticality x Exposure.",
  "scales": {
    "criticality": {
      "1": "Loss is tolerable and recoverable within normal operations",
      "2": "Loss degrades a mission service",
      "3": "Loss suspends a mission service",
      "4": "Loss suspends multiple mission services or breaches a statutory deadline",
      "5": "Loss is mission-defeating or unrecoverable"
    },
    "exposure": {
      "1": "Reachable only from within the most restricted zone",
      "2": "Reachable from internal trusted zones",
      "3": "Reachable from the general enterprise",
      "4": "Reachable from partner or contractor positions",
      "5": "Reachable from the unauthenticated internet"
    }
  },
  "missions": [
    {
      "id": "MS-1",
      "name": "Public Service Delivery",
      "note": "Citizen-facing intake and status. Statutory availability floor applies."
    },
    {
      "id": "MS-2",
      "name": "Case Adjudication",
      "note": "Internal processing of mission records. The corpus the campaign exists to protect."
    },
    {
      "id": "MS-3",
      "name": "Open Data Publication",
      "note": "Public data pipelines and open API. Integrity matters more than confidentiality."
    },
    {
      "id": "MS-4",
      "name": "Financial Processing",
      "note": "Fee and payment handling. Fraud-targeted."
    },
    {
      "id": "MS-5",
      "name": "Security Operations",
      "note": "The defense itself, treated as a mission service because its loss blinds everything else."
    }
  ],
  "zones": {
    "EXT": "Internet \u00b7 external actors",
    "VIS": "Visibility & automation",
    "EDGE": "TIC 3.0 edge \u00b7 perimeter",
    "IDP": "Identity plane",
    "PUB": "Public-facing mission tier",
    "INT": "Internal \u00b7 mission-processing tier",
    "DATA": "Data tier",
    "OT": "Operational technology",
    "PHYS": "Facilities",
    "SUP": "Supply chain",
    "WF": "Workforce"
  },
  "assets": [
    {
      "id": "A-01",
      "name": "ICAM / Policy Decision Point",
      "tower": "T1",
      "zone": "IDP",
      "key": true,
      "decisive": true,
      "crit": 5,
      "exp": 4,
      "maneuvers": [
        "M3",
        "M2",
        "M8"
      ],
      "missions": [
        "MS-1",
        "MS-2",
        "MS-3",
        "MS-4",
        "MS-5"
      ],
      "note": "Brokers every request. Compromise confers control of movement everywhere else."
    },
    {
      "id": "A-02",
      "name": "Phishing-Resistant MFA",
      "tower": "T1",
      "zone": "IDP",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 5,
      "maneuvers": [
        "M3"
      ],
      "missions": [
        "MS-1",
        "MS-2",
        "MS-4"
      ],
      "note": "The control M3's indicator is tested against."
    },
    {
      "id": "A-03",
      "name": "PKI / PIV",
      "tower": "T1",
      "zone": "IDP",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 3,
      "maneuvers": [
        "M3",
        "M2"
      ],
      "missions": [
        "MS-2",
        "MS-5"
      ],
      "note": "Credential issuance and binding root."
    },
    {
      "id": "A-04",
      "name": "Privileged Access (PAM / JIT)",
      "tower": "T1",
      "zone": "IDP",
      "key": true,
      "decisive": true,
      "crit": 5,
      "exp": 3,
      "maneuvers": [
        "M3",
        "M4"
      ],
      "missions": [
        "MS-2",
        "MS-5"
      ],
      "note": "Standing privilege elimination depends on it."
    },
    {
      "id": "A-05",
      "name": "Mission-Staff Workstations",
      "tower": "T2",
      "zone": "INT",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 4,
      "maneuvers": [
        "M2",
        "M4",
        "M7"
      ],
      "missions": [
        "MS-2",
        "MS-4"
      ],
      "note": "EDR-covered fleet. The entry ford for most engagements."
    },
    {
      "id": "A-06",
      "name": "DDoS Mitigation / CDN",
      "tower": "T3",
      "zone": "EDGE",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 5,
      "maneuvers": [
        "M1",
        "M6"
      ],
      "missions": [
        "MS-1",
        "MS-3"
      ],
      "note": "Availability defense at the edge."
    },
    {
      "id": "A-07",
      "name": "Web Application Firewall",
      "tower": "T3",
      "zone": "EDGE",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 5,
      "maneuvers": [
        "M2",
        "M4"
      ],
      "missions": [
        "MS-1",
        "MS-3"
      ],
      "note": "Request-level inspection tuned to the application."
    },
    {
      "id": "A-08",
      "name": "TIC 3.0 Trust-Zone Gateway",
      "tower": "T3",
      "zone": "EDGE",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 5,
      "maneuvers": [
        "M4",
        "M2",
        "M8"
      ],
      "missions": [
        "MS-1",
        "MS-3"
      ],
      "note": "Egress control and inspection. Holds several denied paths."
    },
    {
      "id": "A-09",
      "name": "Load Balancer",
      "tower": "T3",
      "zone": "PUB",
      "key": false,
      "decisive": false,
      "crit": 2,
      "exp": 5,
      "maneuvers": [
        "M2",
        "M6"
      ],
      "missions": [
        "MS-1"
      ],
      "note": ""
    },
    {
      "id": "A-10",
      "name": "Microsegmentation Fabric",
      "tower": "T3",
      "zone": "INT",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 2,
      "maneuvers": [
        "M4",
        "M8"
      ],
      "missions": [
        "MS-2",
        "MS-4"
      ],
      "note": "East-west deny by default. The barrier several reachability results rest on."
    },
    {
      "id": "A-11",
      "name": "Public Service Portal",
      "tower": "T4",
      "zone": "PUB",
      "key": true,
      "decisive": false,
      "crit": 5,
      "exp": 5,
      "maneuvers": [
        "M2",
        "M6",
        "M1"
      ],
      "missions": [
        "MS-1"
      ],
      "note": "Statutory availability floor applies. Cannot be degraded without legal consequence."
    },
    {
      "id": "A-12",
      "name": "Secondary Portal",
      "tower": "T4",
      "zone": "PUB",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 5,
      "maneuvers": [
        "M2",
        "M6"
      ],
      "missions": [
        "MS-1"
      ],
      "note": ""
    },
    {
      "id": "A-13",
      "name": "Case Filing Service",
      "tower": "T4",
      "zone": "PUB",
      "key": false,
      "decisive": false,
      "crit": 4,
      "exp": 5,
      "maneuvers": [
        "M2",
        "M6"
      ],
      "missions": [
        "MS-2"
      ],
      "note": ""
    },
    {
      "id": "A-14",
      "name": "Public Data / Open API",
      "tower": "T4",
      "zone": "PUB",
      "key": false,
      "decisive": false,
      "crit": 2,
      "exp": 5,
      "maneuvers": [
        "M2",
        "M5"
      ],
      "missions": [
        "MS-3"
      ],
      "note": "Integrity-critical rather than confidentiality-critical."
    },
    {
      "id": "A-15",
      "name": "Case Processing System",
      "tower": "T4",
      "zone": "INT",
      "key": true,
      "decisive": false,
      "crit": 5,
      "exp": 3,
      "maneuvers": [
        "M2",
        "M4",
        "M6"
      ],
      "missions": [
        "MS-2",
        "MS-4"
      ],
      "note": "The mission workload."
    },
    {
      "id": "A-16",
      "name": "CI/CD Pipeline",
      "tower": "T4",
      "zone": "INT",
      "key": true,
      "decisive": true,
      "crit": 5,
      "exp": 3,
      "maneuvers": [
        "M2",
        "M7",
        "M9"
      ],
      "missions": [
        "MS-1",
        "MS-2",
        "MS-3",
        "MS-4"
      ],
      "note": "Decisive point. Poisoning it envelops everything downstream."
    },
    {
      "id": "A-17",
      "name": "Sensitive Mission Records",
      "tower": "T5",
      "zone": "DATA",
      "key": true,
      "decisive": true,
      "crit": 5,
      "exp": 2,
      "maneuvers": [
        "M2",
        "M5",
        "M6"
      ],
      "missions": [
        "MS-2"
      ],
      "note": "The crown jewel. The objective the campaign exists to protect."
    },
    {
      "id": "A-18",
      "name": "PII Store",
      "tower": "T5",
      "zone": "DATA",
      "key": true,
      "decisive": false,
      "crit": 5,
      "exp": 2,
      "maneuvers": [
        "M2",
        "M5"
      ],
      "missions": [
        "MS-1",
        "MS-2"
      ],
      "note": "Privacy terrain. Holding more of it is itself the risk."
    },
    {
      "id": "A-19",
      "name": "Financial Data",
      "tower": "T5",
      "zone": "DATA",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 2,
      "maneuvers": [
        "M2",
        "M5",
        "M6"
      ],
      "missions": [
        "MS-4"
      ],
      "note": "Fraud-targeted."
    },
    {
      "id": "A-20",
      "name": "Object Storage (S3 Buckets)",
      "tower": "T5",
      "zone": "DATA",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 3,
      "maneuvers": [
        "M2",
        "M5"
      ],
      "missions": [
        "MS-2",
        "MS-3"
      ],
      "note": "Frequent source of incidental and derived holdings."
    },
    {
      "id": "A-21",
      "name": "Audit Logs",
      "tower": "T5",
      "zone": "DATA",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 2,
      "maneuvers": [
        "M2",
        "M8"
      ],
      "missions": [
        "MS-5"
      ],
      "note": "Retention must exceed plausible dwell or reconstruction cannot reach the entry point."
    },
    {
      "id": "A-22",
      "name": "SIEM / SOC Platform",
      "tower": "TX",
      "zone": "VIS",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 2,
      "maneuvers": [
        "M1",
        "M7"
      ],
      "missions": [
        "MS-5"
      ],
      "note": "Visibility & analytics \u2014 reconnaissance."
    },
    {
      "id": "A-23",
      "name": "SOAR Platform",
      "tower": "TX",
      "zone": "VIS",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 2,
      "maneuvers": [
        "M7",
        "M8"
      ],
      "missions": [
        "MS-5"
      ],
      "note": "Automation & orchestration \u2014 mobility."
    },
    {
      "id": "A-24",
      "name": "Threat Intelligence / CISA-JCDC Feed",
      "tower": "TX",
      "zone": "VIS",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 3,
      "maneuvers": [
        "M1",
        "M9"
      ],
      "missions": [
        "MS-5"
      ],
      "note": "Feeds M1 and M9. The spoiling attack window depends on it."
    },
    {
      "id": "A-25",
      "name": "Hunt Team Tooling",
      "tower": "TX",
      "zone": "VIS",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 2,
      "maneuvers": [
        "M7",
        "M10"
      ],
      "missions": [
        "MS-5"
      ],
      "note": "The counterattack force's instrument."
    },
    {
      "id": "A-26",
      "name": "Building Management System",
      "tower": "T6",
      "zone": "OT",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 3,
      "maneuvers": [
        "M4",
        "M2"
      ],
      "missions": [
        "MS-1",
        "MS-2"
      ],
      "new": "v5.0",
      "note": "Physical-effect system. Cannot be patched or restarted on the defender's schedule."
    },
    {
      "id": "A-27",
      "name": "Physical Access Control System",
      "tower": "T6",
      "zone": "OT",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 3,
      "maneuvers": [
        "M4",
        "M1"
      ],
      "missions": [
        "MS-1",
        "MS-2",
        "MS-5"
      ],
      "new": "v5.0",
      "note": "Bridges T6 and T8. Its telemetry is an intelligence source, not an audit artifact."
    },
    {
      "id": "A-28",
      "name": "Engineering Workstations",
      "tower": "T6",
      "zone": "OT",
      "key": true,
      "decisive": true,
      "crit": 4,
      "exp": 2,
      "maneuvers": [
        "M4",
        "M7"
      ],
      "missions": [
        "MS-1"
      ],
      "new": "v5.0",
      "note": "The path by which enterprise compromise becomes physical consequence."
    },
    {
      "id": "A-29",
      "name": "Privileged Administrators",
      "tower": "T7",
      "zone": "WF",
      "key": true,
      "decisive": true,
      "crit": 5,
      "exp": 4,
      "maneuvers": [
        "M3",
        "M2",
        "M7"
      ],
      "missions": [
        "MS-1",
        "MS-2",
        "MS-4",
        "MS-5"
      ],
      "new": "v5.0",
      "note": "Role, not person. Population size is part of the terrain picture."
    },
    {
      "id": "A-30",
      "name": "Mission Caseworkers",
      "tower": "T7",
      "zone": "WF",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 4,
      "maneuvers": [
        "M5",
        "M2"
      ],
      "missions": [
        "MS-2",
        "MS-4"
      ],
      "new": "v5.0",
      "note": "Large population with direct access to the record corpus."
    },
    {
      "id": "A-31",
      "name": "Contract Support Staff",
      "tower": "T7",
      "zone": "WF",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 4,
      "maneuvers": [
        "M3",
        "M8"
      ],
      "missions": [
        "MS-2",
        "MS-5"
      ],
      "new": "v5.0",
      "note": "Equivalent reach to staff, different lifecycle and vetting."
    },
    {
      "id": "A-32",
      "name": "Approval Authorities",
      "tower": "T7",
      "zone": "WF",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 3,
      "maneuvers": [
        "M3",
        "M6"
      ],
      "missions": [
        "MS-4"
      ],
      "new": "v5.0",
      "note": "Indirect access role \u2014 compromise yields authorization rather than data."
    },
    {
      "id": "A-33",
      "name": "Primary Data Center",
      "tower": "T8",
      "zone": "PHYS",
      "key": true,
      "decisive": false,
      "crit": 5,
      "exp": 2,
      "maneuvers": [
        "M2",
        "M4"
      ],
      "missions": [
        "MS-1",
        "MS-2",
        "MS-3",
        "MS-4",
        "MS-5"
      ],
      "new": "v5.0",
      "note": "Environmental sustain period must satisfy the recovery objectives of everything housed here."
    },
    {
      "id": "A-34",
      "name": "Regional Field Offices",
      "tower": "T8",
      "zone": "PHYS",
      "key": false,
      "decisive": false,
      "crit": 2,
      "exp": 4,
      "maneuvers": [
        "M2",
        "M4"
      ],
      "missions": [
        "MS-1"
      ],
      "new": "v5.0",
      "note": "Widest physical attack surface, thinnest supervision."
    },
    {
      "id": "A-35",
      "name": "Alternate Recovery Site",
      "tower": "T8",
      "zone": "PHYS",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 1,
      "maneuvers": [
        "M11",
        "M2"
      ],
      "missions": [
        "MS-1",
        "MS-2"
      ],
      "new": "v5.0",
      "note": "Must have carried the mission, not merely be documented as able to."
    },
    {
      "id": "A-36",
      "name": "Cloud Service Provider",
      "tower": "T9",
      "zone": "SUP",
      "key": true,
      "decisive": false,
      "crit": 5,
      "exp": 3,
      "maneuvers": [
        "M2",
        "M8"
      ],
      "missions": [
        "MS-1",
        "MS-2",
        "MS-3",
        "MS-4"
      ],
      "new": "v5.0",
      "note": "Inheritance boundary. Customer responsibilities need owners and operational moves."
    },
    {
      "id": "A-37",
      "name": "Managed Service Provider",
      "tower": "T9",
      "zone": "SUP",
      "key": true,
      "decisive": true,
      "crit": 4,
      "exp": 4,
      "maneuvers": [
        "M3",
        "M4",
        "M8"
      ],
      "missions": [
        "MS-2",
        "MS-5"
      ],
      "new": "v5.0",
      "note": "Reaches production. Severance must be within the agency's own control."
    },
    {
      "id": "A-38",
      "name": "Software Build Dependencies",
      "tower": "T9",
      "zone": "SUP",
      "key": true,
      "decisive": false,
      "crit": 4,
      "exp": 3,
      "maneuvers": [
        "M2",
        "M6",
        "M9"
      ],
      "missions": [
        "MS-1",
        "MS-2",
        "MS-3"
      ],
      "new": "v5.0",
      "note": "Provenance and contents are different questions and both are required."
    },
    {
      "id": "A-39",
      "name": "Hardware and Firmware Vendors",
      "tower": "T9",
      "zone": "SUP",
      "key": false,
      "decisive": false,
      "crit": 3,
      "exp": 2,
      "maneuvers": [
        "M2",
        "M9"
      ],
      "missions": [
        "MS-1",
        "MS-2"
      ],
      "new": "v5.0",
      "note": "Where provenance verification is hardest and substitution least visible."
    },
    {
      "id": "X-01",
      "name": "Public / Mission Users",
      "tower": "EXT",
      "zone": "EXT",
      "key": false,
      "decisive": false,
      "crit": 0,
      "exp": 5,
      "maneuvers": [
        "M3",
        "M6"
      ],
      "missions": [
        "MS-1",
        "MS-3"
      ],
      "note": "External actor. Citizens and businesses."
    },
    {
      "id": "X-02",
      "name": "External Partners",
      "tower": "EXT",
      "zone": "EXT",
      "key": false,
      "decisive": false,
      "crit": 0,
      "exp": 5,
      "maneuvers": [
        "M3",
        "M4"
      ],
      "missions": [
        "MS-2"
      ],
      "note": "External actor. Contractors and other agencies."
    },
    {
      "id": "X-03",
      "name": "API / Open-Data Consumers",
      "tower": "EXT",
      "zone": "EXT",
      "key": false,
      "decisive": false,
      "crit": 0,
      "exp": 5,
      "maneuvers": [
        "M2",
        "M6"
      ],
      "missions": [
        "MS-3"
      ],
      "note": "External actor. Public data pipelines."
    },
    {
      "id": "X-04",
      "name": "Threat Actors",
      "tower": "EXT",
      "zone": "EXT",
      "key": false,
      "decisive": false,
      "crit": 0,
      "exp": 5,
      "maneuvers": [],
      "missions": [],
      "note": "Adversary positions: nation-state collection, fraud rings, ransomware crews. Modeled as terrain occupants, not as assets."
    }
  ],
  "tower_maturity": {
    "T1": {
      "ztmm": "Advanced",
      "coverage": 72
    },
    "T2": {
      "ztmm": "Initial",
      "coverage": 41
    },
    "T3": {
      "ztmm": "Advanced",
      "coverage": 68
    },
    "T4": {
      "ztmm": "Initial",
      "coverage": 47
    },
    "T5": {
      "ztmm": "Initial",
      "coverage": 44
    },
    "T6": {
      "ztmm": "Traditional",
      "coverage": 18
    },
    "T7": {
      "ztmm": "Traditional",
      "coverage": 22
    },
    "T8": {
      "ztmm": "Traditional",
      "coverage": 25
    },
    "T9": {
      "ztmm": "Traditional",
      "coverage": 20
    },
    "TX": {
      "ztmm": "Initial",
      "coverage": 52
    }
  }
}