Is This Built for an Agency Shaped like Mine?
It is the first question a federal reader actually asks, and a framework instantiated against a generic reference agency has to answer it or be ignored. Here are 10 federal estate shapes — what distinguishes each, what its key terrain typically is, which ground carries its weight, which forms of maneuver suit it, and which of the 6 federal obligations it declares. That last one is the part that matters most: an obligation outside a declared profile is scored out of scope, not counted against the agency.
These Are Shapes, Not Agencies. None of Them Is Anybody.
Each archetype is a composite drawn from what federal estates of that kind have in common — a claims portal, an instrument floor, a tenant boundary. No real organization was modeled, no real organization was scored, and the criticality and exposure figures underneath the readings are the archetype’s own, which is exactly why they are useful for comparison and useless as a measurement of anyone.
Four Things to Hold Before You Pick One.
The point of an archetype is to move the first conversation from “what is a terrain overlay” to “is this the right one for us”. That is a much shorter conversation, and it is the one that decides whether a framework gets adopted.
A starting position, not a verdict
An archetype is where an adopter begins a terrain overlay instead of beginning at an empty canvas. Nothing here measures an agency, and no figure on any of these pages is a score anybody earned.
The nearest one, not the exact one
Most real agencies are one shape with a piece of another bolted on: a regulator that also runs a laboratory, a benefits administration that is also a shared service. Start from the nearest and add the second shape’s obligations deliberately rather than looking for a perfect match.
Everything countable is counted
The layers each estate holds, where its weight falls, which elements are decisive, which forms of maneuver it evidences and which obligations its ground carries are all computed off the estate itself. Only the explanations are written by hand.
Ten shapes from eleven entries
The Diagram Studio ships eleven loadable estates. The eleventh is a target state that holds every layer and every form of maneuver, and its own description says it is not an agency. It is excluded here, because a destination is not a shape anybody has.
One Sentence Each. the One That Describes Your Worst Week Is Yours.
Not the one whose mission statement sounds closest — the one whose failure sounds closest. Two agencies with unrelated missions and the same failure mode should defend the same way, and two with similar missions and different failure modes should not.
- Public Benefits Administration
Your busiest system is a public intake portal, and a date somebody else set says when money has to move.
- Regulatory & Licensing
External parties file to you against a deadline, and your most sensitive records are the ones you have not decided yet.
- Research Laboratory
Collaboration is the mission, your instruments outlive your operating systems, and some of your data is controlled.
- Law Enforcement
Your case data has a need-to-know boundary inside the agency, and the person who can cross it works for you.
- Federal Health Services
Degradation has physical consequences for a patient, and medical devices share the estate with clinical records.
- Financial Regulator
You hold information that moves markets, and the loss event is the timing of its release rather than its disclosure.
- Land & Resource Management
Your sites are dispersed and thinly connected, and a substantial part of your estate is control systems rather than computers.
- Defense-Adjacent Civilian
You hold controlled unclassified information, your suppliers build your software, and the pipeline is the shortest path to everything.
- Small Independent Agency
You have fewer than five hundred staff, no security operations center of your own, and the same obligations as an agency fifty times your size.
- Shared Service Provider
Other agencies run their missions on your platform, so your blast radius is somebody else’s estate.
10 shapes, 116 elements, 10 terrain layers between them.
Every cell below is computed off the estate it describes. Where the weight falls is criticality times exposure, summed by layer and read as a share of the estate — which is why the busiest layer across all ten is T4 Applications and Workloads rather than the one a reader would guess.
| Archetype | Declared obligations | Typical campaign phase | Where the estate’s weight falls | Ground marked decisive |
|---|---|---|---|---|
| Public Benefits Administration14 elements · 9 terrain layers | Phase 0 — Shape. Set conditions. | T4 Applications and Workloads (21%), TX Cross-Cutting (14%) | 7 of 14 elements | |
| Regulatory & Licensing11 elements · 8 terrain layers | Phase 0 — Shape. Set conditions. | T4 Applications and Workloads (37%), T1 Identity (13%) | 4 of 11 elements | |
| Research Laboratory11 elements · 9 terrain layers | Phase 0 — Shape. Set conditions. | T4 Applications and Workloads (18%), T5 Data (14%) | 4 of 11 elements | |
| Law Enforcement13 elements · 9 terrain layers | Phase I — Deter. Raise adversary cost. | T4 Applications and Workloads (21%), T2 Devices (14%) | 6 of 13 elements | |
| Federal Health Services11 elements · 9 terrain layers | Phase 0 — Shape. Set conditions. | T4 Applications and Workloads (20%), T9 Supply Chain (14%) | 7 of 11 elements | |
| Financial Regulator12 elements · 8 terrain layers | Phase I — Deter. Raise adversary cost. | T4 Applications and Workloads (41%), TX Cross-Cutting (14%) | 6 of 12 elements | |
| Land & Resource Management11 elements · 8 terrain layers | Phase 0 — Shape. Set conditions. | T6 Operational Technology (21%), T4 Applications and Workloads (20%) | 3 of 11 elements | |
| Defense-Adjacent Civilian12 elements · 8 terrain layers | Phase I — Deter. Raise adversary cost. | T4 Applications and Workloads (30%), T9 Supply Chain (14%) | 6 of 12 elements | |
| Small Independent Agency9 elements · 8 terrain layers | Phase 0 — Shape. Set conditions. | T4 Applications and Workloads (25%), T1 Identity (16%) | 4 of 9 elements | |
| Shared Service Provider12 elements · 7 terrain layers | Phase I — Deter. Raise adversary cost. | T4 Applications and Workloads (37%), T1 Identity (21%) | 9 of 12 elements |
Public Benefits Administration
14 elements · 9 terrain layers
- Typical campaign phase
- Phase 0 — Shape. Set conditions.
- Where the estate’s weight falls
- T4 Applications and Workloads (21%), TX Cross-Cutting (14%)
- Ground marked decisive
- 7 of 14 elements
Regulatory & Licensing
11 elements · 8 terrain layers
- Typical campaign phase
- Phase 0 — Shape. Set conditions.
- Where the estate’s weight falls
- T4 Applications and Workloads (37%), T1 Identity (13%)
- Ground marked decisive
- 4 of 11 elements
Research Laboratory
11 elements · 9 terrain layers
- Typical campaign phase
- Phase 0 — Shape. Set conditions.
- Where the estate’s weight falls
- T4 Applications and Workloads (18%), T5 Data (14%)
- Ground marked decisive
- 4 of 11 elements
Law Enforcement
13 elements · 9 terrain layers
- Typical campaign phase
- Phase I — Deter. Raise adversary cost.
- Where the estate’s weight falls
- T4 Applications and Workloads (21%), T2 Devices (14%)
- Ground marked decisive
- 6 of 13 elements
Federal Health Services
11 elements · 9 terrain layers
- Typical campaign phase
- Phase 0 — Shape. Set conditions.
- Where the estate’s weight falls
- T4 Applications and Workloads (20%), T9 Supply Chain (14%)
- Ground marked decisive
- 7 of 11 elements
Financial Regulator
12 elements · 8 terrain layers
- Typical campaign phase
- Phase I — Deter. Raise adversary cost.
- Where the estate’s weight falls
- T4 Applications and Workloads (41%), TX Cross-Cutting (14%)
- Ground marked decisive
- 6 of 12 elements
Land & Resource Management
11 elements · 8 terrain layers
- Typical campaign phase
- Phase 0 — Shape. Set conditions.
- Where the estate’s weight falls
- T6 Operational Technology (21%), T4 Applications and Workloads (20%)
- Ground marked decisive
- 3 of 11 elements
Defense-Adjacent Civilian
12 elements · 8 terrain layers
- Typical campaign phase
- Phase I — Deter. Raise adversary cost.
- Where the estate’s weight falls
- T4 Applications and Workloads (30%), T9 Supply Chain (14%)
- Ground marked decisive
- 6 of 12 elements
Small Independent Agency
9 elements · 8 terrain layers
- Typical campaign phase
- Phase 0 — Shape. Set conditions.
- Where the estate’s weight falls
- T4 Applications and Workloads (25%), T1 Identity (16%)
- Ground marked decisive
- 4 of 9 elements
Shared Service Provider
12 elements · 7 terrain layers
- Typical campaign phase
- Phase I — Deter. Raise adversary cost.
- Where the estate’s weight falls
- T4 Applications and Workloads (37%), T1 Identity (21%)
- Ground marked decisive
- 9 of 12 elements
An Obligation You Do Not Incur Is Out of Scope, Not a Gap.
This is the part of the framework that is under-explained everywhere else on the site, and it is the part that decides whether a small agency can use it at all.
The Profile Is Declared, Then Tested
An agency states which of the 6 federal obligations its estate actually incurs. That declaration is checked against the ground: every declared obligation has to be carried by at least one element on the overlay, and no element may carry an obligation the profile omits. A declaration with nothing under it is paperwork; ground carrying an undeclared obligation is undefended.
What Is Not Declared Is Not Scored
Across the ten shapes, 24 of the 60 obligation slots are declared and 36 are out of scope. Those 36 are not findings, not gaps and not deferred work. They are the framework saying that an agency with no industrial control network should not be assessed on how well it defends one.
Why That Changes Who Can Adopt This
Assessment effort is the scarcest thing a small agency has. A framework that scores every agency against every obligation spends that effort proving absences, and produces permanent open findings that crowd out the two or three obligations the agency genuinely holds. The profile is what stops that.
It Is a Choice, and It Is Yours
These ten profiles are the archetypes’ own. They are a defensible default and not a determination: adopting a shape means reviewing its declaration against your estate and adding what you actually hold. The profile that quietly omits an obligation you incur is the one failure this mechanism can produce.
No obligation below is declared by all ten shapes or by none — an obligation that were either would be decoration rather than a profile. The most common declaration is FO-1 + FO-5, shared by 3 shapes with otherwise unrelated missions.
| Obligation | What it puts on the map | Declared by | Out of scope for |
|---|---|---|---|
| FO-1Privacy Terrain Identification | To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain. | 7 of 10 shapes · 7 elements carry it | |
| FO-2Controlled Unclassified Information Handling | To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems. | 3 of 10 shapes · 3 elements carry it | |
| FO-3Tenancy and Inheritance Boundary | To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job. | 2 of 10 shapes · 5 elements carry it | |
| FO-4Operational Technology Terrain | To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable. | 3 of 10 shapes · 4 elements carry it | |
| FO-5Statutory Availability Floor | To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed. | 6 of 10 shapes · 7 elements carry it | |
| FO-6Supply Chain Obligation | To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed. | 3 of 10 shapes · 5 elements carry it |
FO-1
Privacy Terrain Identification
- What it puts on the map
- To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.
- Declared by
7 of 10 shapes · 7 elements carry it
FO-2
Controlled Unclassified Information Handling
- What it puts on the map
- To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.
- Declared by
3 of 10 shapes · 3 elements carry it
FO-3
Tenancy and Inheritance Boundary
- What it puts on the map
- To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.
- Declared by
2 of 10 shapes · 5 elements carry it
FO-4
Operational Technology Terrain
- What it puts on the map
- To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
- Declared by
3 of 10 shapes · 4 elements carry it
FO-5
Statutory Availability Floor
- What it puts on the map
- To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
- Declared by
6 of 10 shapes · 7 elements carry it
FO-6
Supply Chain Obligation
- What it puts on the map
- To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.
- Declared by
3 of 10 shapes · 5 elements carry it
Transcribed, Not Retyped.
The ten estates are the ones the Diagram Studio loads onto its canvas. They were extracted from it rather than written a second time, so a shape here and a shape there cannot disagree.
Each archetype is a real, loadable template: an adopter can open the studio, load the nearest shape, and start editing a scored estate instead of an empty canvas. The terrain layers are the ten defended in this framework, the forms are the eleven forms of maneuver, the phases are the six campaign phases, and the obligations are the Federal Obligations control family. The eighteen-month path from one of these to a running campaign is set out in adoption.