Leaders Pick the Intent. Engineers Pick the Technique.
Categories of maneuver are durable — they outlive the perishable techniques that implement them. That is why every form below is written as an intent and an observable rather than as a product or a configuration, and why an Authorizing Official can direct a defense without being an engineer.
A Scheme Names a Sequence, Not a Checklist.
A defense that claims all eleven forms simultaneously has designated no main effort, which means it has not prioritized. A real scheme picks a handful in order — screen, ambush, delay, counterattack, exploit — and says which one everything else is buying time for.
Gain early warning and buy reaction time before the adversary touches key terrain.
MechanismForward reconnaissance: external attack-surface monitoring, threat intelligence, canary tokens at the perimeter.IndicatorThreats are detected before they reach key terrain.Ensure no single failure is decisive.
MechanismLayered controls across every terrain layer; TIC 3.0 trust zones; zero-trust segmentation.IndicatorAn adversary must defeat three or more independent controls to reach data terrain.Make identity, not network location, the decisive plane — surround the adversary with policy.
MechanismPhishing-resistant MFA, continuous authorization, conditional access, just-in-time privilege.IndicatorA stolen credential, on its own, yields no movement.Force the adversary onto ground you own and watch.
MechanismMicrosegmentation, egress control, allow-listing — herding lateral movement into monitored corridors.IndicatorObserved lateral attempts land in instrumented segments.Trade space for information and time, and impose cost.
MechanismHoneypots, decoy credentials and documents, honeytokens seeded through the data terrain.IndicatorThe adversary interacts with a decoy, producing a detection with no false-positive budget.Buy decision time and prevent the adversary culminating on the objective.
MechanismRate limiting, step-up authentication, automated session throttling.IndicatorAdversary tempo drops below defender decision tempo.Seize the initiative and evict before the adversary reaches the objective.
MechanismThreat hunting against hypotheses raised in the FUSE step; automated containment playbooks.IndicatorMean time to evict is inside the adversary’s dwell budget.Give ground deliberately to preserve the force. Degrade gracefully; never fail open.
MechanismAutomated segment severing, credential and session revocation, graceful service degradation that preserves transaction integrity.IndicatorContainment is achieved without losing statutory availability.Disrupt adversary staging before the attack is launched.
MechanismAct on CISA, JCDC, FBI and ISAC intelligence to pre-block staged infrastructure and pre-patch targeted CVEs.IndicatorA named campaign never reaches the avenue of approach.Convert contact into durable advantage rather than closing the ticket.
MechanismHarvest indicators into detections, close the exploited avenue, update the terrain overlay and intelligence requirements, share to the community.IndicatorThe same avenue of approach is never successfully used twice.Restore the mission on evidence, not on hope — and prove it before you need it.
MechanismRecovery objectives declared per mission service; means of recovery held outside the production identity plane; a tested rebuild path that includes the identity plane itself; restored data verified against an independent integrity record.IndicatorEvery recovery objective has been demonstrated within its stated period.Every technique behind these counts is cataloged in the Framework Explorer, cross-referenced against the terrain it operates on and the controls that assess it.
Each Form Has Its Own Reference Entry.
This page states the eleven intents. Each entry below states when to choose the form, what it costs, the precondition it will not work without, how it fails while still being reported as implemented, the techniques that implement it, and the controls that assess it.
Screen / Guard
Gain early warning and buy reaction time before the adversary touches key terrain.
M2 · 18 techniquesDefense in Depth
Ensure no single failure is decisive.
M3 · 20 techniquesEnvelopment
Make identity, not network location, the decisive plane — surround the adversary with policy.
M4 · 17 techniquesObstacle / Canalization
Force the adversary onto ground you own and watch.
M5 · 13 techniquesAmbush
Trade space for information and time, and impose cost.
M6 · 10 techniquesDelay
Buy decision time and prevent the adversary culminating on the objective.
M7 · 17 techniquesCounterattack
Seize the initiative and evict before the adversary reaches the objective.
M8 · 17 techniquesIsolation / Retrograde
Give ground deliberately to preserve the force. Degrade gracefully; never fail open.
M9 · 9 techniquesSpoiling Attack
Disrupt adversary staging before the attack is launched.
M10 · 7 techniquesExploitation & Pursuit
Convert contact into durable advantage rather than closing the ticket.
M11 · 11 techniquesReconstitution
Restore the mission on evidence, not on hope — and prove it before you need it.
All 154 techniques are also indexed on their own, across the forms rather than down one: the technique reference lists every entry with the terrain it is emplaced on, the phases it is employed in, and the controls that test it.
Retrograde and reconstitution are the hardest to sell and the most load-bearing.
Isolation and retrograde — deliberately giving ground to preserve the force — is the maneuver that sounds like failure in a briefing. It is the one that decides whether a bad afternoon becomes a statutory breach: degrade to a read-only queue rather than expose the corpus.
Reconstitution is worse. Almost every program asserts recovery and almost none has demonstrated recovering the identity plane itself, from means that production credentials cannot reach. The control family exists because the assertion and the demonstration are not the same claim.
An Intent You Cannot Assess Is a Slogan.
Seventy-eight controls across fourteen families turn the catalog into something an assessor can test — each with a statement, a discussion, an evidence expectation and an assessment procedure.