Assessment

The First Question Is Whether There Is Anything to Assess Against.

A framework that ships a diagram and a vocabulary cannot be audited, and a federal program cannot adopt what it cannot evidence. ASOM-Fed ships 78 controls across 14 families — as machine-readable data, inheriting the baseline the agency is already authorized against.

The catalog as JSON →The control guide

Lineage

It Inherits. It Does Not Replace.

Every control carries its 800-53 inheritance and its CSF 2.0 subcategory mapping in the shipped data, so an assessor can trace an ASOM-Fed finding back to the baseline the agency is already authorized against.

Inherits

NIST SP 800-53 Rev. 5

Where an obligation is already expressed in the federal baseline, ASOM-Fed points at it rather than restating it in new words. The additions are confined to what maneuver actually requires and the baseline does not express: sequencing, main effort, and tempo.

Maps to

Five Federal Reference Points

NIST CSF 2.0
NIST RMF (SP 800-37)
CISA Zero Trust Maturity Model
TIC 3.0
FISMA

Compliance is earned as exhaust from defending rather than as a separate exercise in the spring — which is the only version of that claim that survives an inspector general.

The Families

78 controls, 14 families.

Four families — Workforce Terrain, Facilities Terrain, Lines of Communication, and Reconstitution and Recovery — exist because the corresponding ground was being asserted rather than assessed.

Exhibit 1

Control Families and Their Purpose

Family	Controls	What it establishes
TM — Terrain Management	7	Know the ground before you defend it: an authoritative picture of what exists, what it is worth, and how it connects. A register in a spreadsheet is not terrain — terrain is positional.
KT — Key Terrain and Decisive Points	5	Declare what actually matters and where control of it is decided, so that prioritization is a recorded decision rather than a running argument.
ID — Identity Terrain	5	Hold the identity plane as ground rather than as a service: planes and trust edges mapped, credential strength matched to the access behind it, and authorization decisions that cannot be altered without trace.
DV — Devices Terrain	5	Defend the entry fords. Devices discovered from the identity plane outward rather than from the console inward, posture enforced as a precondition of access, and sensor visibility measured rather than assumed.
SM — Scheme of Maneuver	7	Require that the defense be planned as a sequence with a designated main effort, with branches pre-planned rather than improvised under contact.
TA — Tempo and Temporal Advantage	5	Make the defender’s decision loop measurable against adversary dwell — the framework’s signature metric, and the one that can be honestly lost.
EN — Engagement and Pursuit	6	Fight the intrusion you are actually in: declare it, reconstruct what happened before closing it, preserve the evidence against your own dwell estimate, and verify eradication rather than hoping for it.
CE — Cycle Execution and Assurance	7	Ensure the loop actually turns at its stated cadence and that its products carry explicit confidence rather than implied certainty.
CG — Command and Governance	5	Establish intent, engagement authority, and which defensive fires are pre-authorized — the controls that let a SOC act at tempo without exceeding its mandate.
RC — Reconstitution and Recovery	5	Demonstrate recovery rather than assert it, including recovery of the identity plane itself, from means the production estate cannot reach.
FO — Federal Obligations	7	Carry the FISMA, RMF, TIC 3.0 and zero-trust obligations that a federal estate owes, scored against a declared agency profile rather than against everything.
WF — Workforce Terrain	5	Treat the privileged human as terrain: who holds privilege, how ready they are, and how quickly authority is withdrawn when they leave.
FC — Facilities Terrain	4	Bring physical boundaries and maintenance access into the same scoring model as logical ground, instead of leaving them to a separate assessment.
LC — Lines of Communication	5	Defend the supply chain as the lines of communication it doctrinally is — suppliers, provenance, and the staging gate an update must pass.

TM — Terrain Management

Controls: 7
What it establishes: Know the ground before you defend it: an authoritative picture of what exists, what it is worth, and how it connects. A register in a spreadsheet is not terrain — terrain is positional.

KT — Key Terrain and Decisive Points

Controls: 5
What it establishes: Declare what actually matters and where control of it is decided, so that prioritization is a recorded decision rather than a running argument.

ID — Identity Terrain

Controls: 5
What it establishes: Hold the identity plane as ground rather than as a service: planes and trust edges mapped, credential strength matched to the access behind it, and authorization decisions that cannot be altered without trace.

DV — Devices Terrain

Controls: 5
What it establishes: Defend the entry fords. Devices discovered from the identity plane outward rather than from the console inward, posture enforced as a precondition of access, and sensor visibility measured rather than assumed.

SM — Scheme of Maneuver

Controls: 7
What it establishes: Require that the defense be planned as a sequence with a designated main effort, with branches pre-planned rather than improvised under contact.

TA — Tempo and Temporal Advantage

Controls: 5
What it establishes: Make the defender’s decision loop measurable against adversary dwell — the framework’s signature metric, and the one that can be honestly lost.

EN — Engagement and Pursuit

Controls: 6
What it establishes: Fight the intrusion you are actually in: declare it, reconstruct what happened before closing it, preserve the evidence against your own dwell estimate, and verify eradication rather than hoping for it.

CE — Cycle Execution and Assurance

Controls: 7
What it establishes: Ensure the loop actually turns at its stated cadence and that its products carry explicit confidence rather than implied certainty.

CG — Command and Governance

Controls: 5
What it establishes: Establish intent, engagement authority, and which defensive fires are pre-authorized — the controls that let a SOC act at tempo without exceeding its mandate.

RC — Reconstitution and Recovery

Controls: 5
What it establishes: Demonstrate recovery rather than assert it, including recovery of the identity plane itself, from means the production estate cannot reach.

FO — Federal Obligations

Controls: 7
What it establishes: Carry the FISMA, RMF, TIC 3.0 and zero-trust obligations that a federal estate owes, scored against a declared agency profile rather than against everything.

WF — Workforce Terrain

Controls: 5
What it establishes: Treat the privileged human as terrain: who holds privilege, how ready they are, and how quickly authority is withdrawn when they leave.

FC — Facilities Terrain

Controls: 4
What it establishes: Bring physical boundaries and maintenance access into the same scoring model as logical ground, instead of leaving them to a separate assessment.

LC — Lines of Communication

Controls: 5
What it establishes: Defend the supply chain as the lines of communication it doctrinally is — suppliers, provenance, and the staging gate an update must pass.

Anatomy

Every Control Carries the Same Seven Fields.

Including the two that most framework catalogs omit: what the assessor should be handed, and how they should test it. A control without an evidence expectation is a preference.

Statement

What the organization shall do. One sentence, testable, no adjectives.

Discussion

Why the control exists and the failure mode it prevents — the part that survives being read by someone who was not in the room.

Apply

What doing it looks like in practice, expressed against the framework’s own tooling.

Evidence

The specific artifact an assessor should expect to be handed.

Assessment

The examine, interview and test procedure — written in the idiom of SP 800-53A.

Inherits

The NIST SP 800-53 Rev. 5 controls this derives from, so nothing is invented that already exists.

CSF

The CSF 2.0 subcategories it satisfies, so a finding maps to the agency’s existing reporting.

Federal obligations are scored against a declared agency profile rather than against everything. An agency that does not operate a bulk-data surface is not marked down for failing to defend one — obligations outside the declared profile are scored out of scope, so the denominator reflects what the agency actually owes. Each regime is treated separately in the obligations reference.

The Full Text

Every Family Has an Index. Every Control Has an Entry.

Exhibit 1 links each family to its index. These three read the same 78 entries across the families instead of down one, which is how an assessor and an ISSO actually arrive at the catalog.

All 78 entries

Seventy-Eight Controls Is a Destination. Ninety Days Is a Start.

The adoption path begins with three things that require no procurement: a signed intent paragraph, a first terrain overlay, and a decision about which defensive fires are pre-authorized.

The adoption path →How this compares