Every Control, in Full.
The catalog states what each control requires. This is the reference treatment: who is accountable, what the control consumes and produces, the activities that implement it, the metrics that show whether it is working, and the procedure an assessor follows. 78 controls, 14 families, no entry left as a heading.
Six Questions, Answered the Same Way Every Time.
A reference manual earns its name by being predictable. Every entry answers the same questions in the same order, so the manual can be used by someone looking for one fact rather than read cover to cover.
What is required
The normative statement, and the one-sentence purpose it serves.
Why it exists
The discussion — the failure mode the control prevents.
How it is measured
Goals, each with metrics capable of reporting failure.
Who is accountable
Exactly one accountable role, and who else is responsible, consulted or informed.
What it consumes and produces
The controls upstream and downstream, so the chain is visible.
What you actually do
Numbered activities, then the evidence and assessment procedure.
24 ways in.
The controls are what an assessor tests. Everything else is what the people being assessed actually work from — the ground, the moves, the loop, who is accountable, and the vocabulary holding it together.
Orientation
What the framework’s nouns are, and which of them this site owns. One group, one section, first — because every other section below assumes the reader can tell a tower from a terrain layer.
The ground
What you are defending and where it sits. Terrain first — almost everything else consumes the overlay it produces.
Terrain
Ten layers, thirty-nine sub-towers with their maturity levels made concrete, and the tower rollup.
Missions
The mission services defense exists to protect, each with a worked Bill of Defense.
Agency archetypes
Ten federal agency shapes, and which obligations each declares — so a small agency is not marked down for a surface it does not operate.
The moves
What you do on that ground. Eleven durable forms of maneuver, and the cataloged techniques that implement them.
The loop
The cycle that turns, the campaign it sits inside, the questions that drive it, and the artifacts it emits.
The cycle
Six steps, each with entry and exit criteria, participants, products and failure modes.
Campaign phases
Six phases, their main effort, and the conditions for moving between them.
Intelligence requirements
A worked library. If no decision changes on the answer, it is not a requirement.
Products
The artifacts the framework emits, and for each: what produces it, who owns it, who consumes it.
Command
Who decides, what they may decide without asking, and the order in which a program builds the authority to act.
Roles
Six roles, each with every control they are accountable, responsible, consulted or informed on.
Rules of engagement
A worked schedule of defensive actions and the authority each needs. Tempo dies in an escalation queue.
Adoption roadmap
Eighteen months at phase depth, the first ninety days at week granularity, and the five ways adoption fails.
Judgment
What an assessor tests, what the obligations require, and what the framework’s own output looks like when scored.
Controls
Seventy-eight controls across fourteen families — statement, purpose, metrics, accountability, activities, assessment.
Assessment
How an assessment is run, what evidence is expected, and how capability is scored.
Coverage baseline
What the output looks like when the reference agency is scored — including where it comes out thin.
Obligations
The crosswalk to CSF 2.0, SP 800-53, the RMF and the zero-trust model — including what is not covered.
MITRE D3FEND
The technique-level join to D3FEND — what it reaches, what it does not, and the reason recorded for each miss.
Threat courses of action
Most likely and most dangerous, modeled against the reference agency’s own terrain.
Tempo
How defender loop time and adversary dwell are measured, and what a deficit obliges you to do.
Apparatus
The vocabulary, the translation it rests on, and the sources it is built from.
Glossary
The doctrinal vocabulary — origin, federal-cyber meaning, and what each term is commonly confused with.
Doctrinal crosswalk
The Army-to-federal translation the framework rests on, including where the analogy strains.
Sources
What the framework takes from each source, what it deliberately does not, and what is original.
Manual map
The whole manual in one derived index, including where its coverage is uneven.
Where to Start Depends on What You Are Missing.
Terrain Management first, always — almost every other family consumes the overlay it produces, and a program that skips it starves four others at once.