Public Benefits Administration

The Mission Shape

A benefits administration turns a claim into a decision and then into a payment, at volume, against a deadline it did not choose. The estate follows from that sentence: a wide public intake surface, an adjudication tier that is genuinely internal, and a records-and-ledger tier that is the objective. Volume is the mission, so availability is not a service-level preference — a portal that is down through a filing surge is a mission failure with a statutory character.

What separates this from the other public-facing archetypes is the payment leg. The estate carries a ledger and a standing integration to a payment processor, so an adversary has two prizes rather than one: the personal information in the claim records, and the ability to move a payment. Those are scored as different ground because they have different recovery objectives and, in practice, different attackers.

This is a composite, not an organization. Nothing on this page measures an agency, and the criticality and exposure figures below are the archetype’s own — useful for comparing shapes, useless as a statement about anybody.

What its key terrain typically is — 7 of 14 elements

How to read it. The pairing is the point. The intake portal (the way in) and the payment ledger (the reason to come in) are both marked, and so is the adjudicator role that can approve a benefit. A defense that holds the records and loses the approval role has lost.

• T4Claims Portal
  public intake

  Criticality 5/5Exposure 5/5Key terrainCarries FO-5Recover in 4h

• T1ICAM / PDP
  claimant + staff

  Criticality 5/5Exposure 4/5Key terrain

• T5Claim Records
  PII · benefits

  Criticality 5/5Exposure 2/5Key terrainCarries FO-1Recover in 8h

• T5Payment Ledger
  financial

  Criticality 5/5Exposure 2/5Key terrainCarries FO-5Recover in 4h

• TXRecovery Vault
  isolated · offline

  Criticality 5/5Exposure 1/5Key terrainRecover in 4h

• T7Claims Adjudicators
  privileged · benefit approval

  Criticality 5/5Exposure 4/5Key terrainOwner: Benefits Operations

• T9Payment Processor
  standing integration

  Criticality 5/5Exposure 4/5Key terrain

Key terrain is ground whose loss is decisive rather than merely expensive. Marking too much of an estate defeats the purpose: this archetype marks 50% of its elements, and an overlay that marks most of itself has not made a choice.

Which Terrain Layers Matter Most, and Why

The order and the shares are derived: each element’s weight is its criticality times its exposure, summed by layer and read against the estate’s total of 187. The explanations are written for the 3 layers that carry the shape.

• T4Applications and Workloads21% of the estate’s weight · 2 elements · 1 decisive

  The urban terrain. Claims Portal, Adjudication.

  The portal and the adjudication system outweigh everything else, because the portal is simultaneously the widest avenue of approach and a service with an availability floor set in statute. Those two facts pull opposite ways — the ordinary answer to a contested public surface is to take it away — and reconciling them before the incident is exactly what FO-5 is for.

• TXCross-Cutting14% of the estate’s weight · 4 elements · 1 decisive

  The enablers of movement. SIEM / SOC, Threat Intel, SOAR, Recovery Vault.

• T5Data11% of the estate’s weight · 2 elements · 2 decisive

  The objective. Claim Records, Payment Ledger.

  Two data elements, both key terrain, on different clocks: claim records at a fifteen-minute recovery point, the payment ledger at zero. A model that scored "data" as one layer would average those into a figure that satisfies neither.

• T1Identity11% of the estate’s weight · 1 element · 1 decisive

  The high ground. ICAM / PDP.

• T7Workforce11% of the estate’s weight · 1 element · 1 decisive

  Terrain that is also the force. Claims Adjudicators.

• T9Supply Chain11% of the estate’s weight · 1 element · 1 decisive

  The lines of communication. Payment Processor.

  The payment processor holds a standing integration into the ledger, which makes it terrain whatever the contract calls it. The estate draws the denial explicitly — no direct path from the processor to the claim records — rather than leaving it to be assumed.

• T3Networks11% of the estate’s weight · 1 element

  The corridors. WAF / CDN.

• T2Devices6% of the estate’s weight · 1 element

  The entry fords. Caseworker Laptops.

• T8Facilities4% of the estate’s weight · 1 element

  The physical boundary. Processing Center.

The federal-obligations profile — 2 declared, 4 out of scope

An obligation this estate does not incur is scored out of scope, not counted against it. That is the framework’s profile mechanism, and it is what stops an agency being marked down for failing to defend ground it does not hold.

Why this profile. Two obligations declared: privacy terrain over the claim records, and the statutory availability floor over the portal and the ledger. The four undeclared ones are the more instructive half. This estate runs no controlled unclassified information, no operational technology, and no tenancy it is the provider for, so those obligations are scored out of scope rather than as gaps. Supply-chain terrain is the one worth arguing about — a payment processor with a standing integration is on the overlay, and an adopter starting here should decide deliberately whether to add FO-6 rather than inherit the archetype’s silence on it.

• FO-1Privacy Terrain IdentificationIn scope

  To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.

  Carried byClaim Records (T5)

• FO-2Controlled Unclassified Information HandlingOut of scope

  To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.

  Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.

• FO-3Tenancy and Inheritance BoundaryOut of scope

  To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.

  Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.

• FO-4Operational Technology TerrainOut of scope

  To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.

  Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.

• FO-5Statutory Availability FloorIn scope

  To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.

  Carried byClaims Portal (T4), Payment Ledger (T5)

• FO-6Supply Chain ObligationOut of scope

  To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.

  Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.

The declaration is checked against the ground rather than trusted: every in-scope obligation above is carried by at least one element, and no element carries an obligation the profile omits. Adopting this shape means reviewing that declaration against your own estate — the profile that quietly omits an obligation you do incur is the one failure this mechanism can produce.

Its Typical Campaign Phase

Typical, not permanent. A phase is declared against a scope and can be declared backwards without embarrassment; this is where a well-run estate of this shape sits when it is not in contact. The full entry and exit conditions are on the Shape phase page.

• M1 Screen / Guard
• M2 Defense in Depth
• M3 Envelopment
• M9 Spoiling Attack

Which maneuvers matter most — 11 of eleven forms evidenced

Ranked by the weight of the ground evidencing each form, not by how many elements name it. The 3 explained below are the ones that decide how this shape is defended; the rest are present and secondary. A form this estate does not evidence at all is not necessarily wrong for it — it is ground the archetype does not yet stand on.

• M2Defense in Depth8 elements · weight 120

  Ensure no single failure is decisive.

  The estate is close to a straight line — portal, edge, identity, adjudication, records — and every hop on that line is a place to make the adversary defeat one more independent control. Depth is what turns a single portal defect into something short of a breach.

• M6Delay3 elements · weight 60

  Buy decision time and prevent the adversary culminating on the objective.

  Delay is worth more here than in most shapes because the availability floor is a date rather than a duration. Buying hours has a specific value: it is the difference between meeting a statutory payment date and missing it.

• M11Reconstitution5 elements · weight 58

  Restore the mission on evidence, not on hope — and prove it before you need it.

  Five elements ship declared recovery objectives, and the vault they restore from is explicitly denied a path from the identity plane. Rehearsing the restore is the only thing that turns those numbers from an aspiration into a commitment anybody can defend.

• M1Screen / Guard3 elements · weight 53

  Gain early warning and buy reaction time before the adversary touches key terrain.

• M8Isolation / Retrograde3 elements · weight 45

  Give ground deliberately to preserve the force. Degrade gracefully; never fail open.

• M3Envelopment2 elements · weight 40

  Make identity, not network location, the decisive plane — surround the adversary with policy.

• M5Ambush3 elements · weight 38

  Trade space for information and time, and impose cost.

• M4Obstacle / Canalization2 elements · weight 28

  Force the adversary onto ground you own and watch.

• M7Counterattack2 elements · weight 16

  Seize the initiative and evict before the adversary reaches the objective.

• M10Exploitation & Pursuit1 element · weight 8

  Convert contact into durable advantage rather than closing the ticket.

• M9Spoiling Attack1 element · weight 6

  Disrupt adversary staging before the attack is launched.

Paths This Estate Declares Closed

A denial drawn on the overlay is a claim that can be tested. Stating that no path exists, as a path, is what turns an assumption into something an assessor can go and check — and what makes an observed connection a finding rather than a discovery.

• ICAM / PDPhas no path toRecovery VaultDrawn as: no production identity path

• Payment Processorhas no path toClaim RecordsDrawn as: no direct records path

Recovery Objectives This Shape Declares

Declared at the archetype level because they follow from the mission rather than from the technology. Where a deadline is set outside the agency, the recovery objective is constrained by it rather than negotiated against it.

The Estate as the Overlay Lays It Out

The tier bands the archetype ships with, top to bottom, with every element in each. 14 elements and 17 drawn paths in total.

The Failure Modes Characteristic of This Shape

Not general bad practice. These are the ways a competent program built on this particular shape goes wrong while continuing to report that it is fine.

• The portal is treated as the whole problem.

  The tell

  Every hardening item in the plan sits on the public tier, and the ledger’s zero recovery point has never actually been exercised.

  The correction

  Exercise the two data elements separately. The ledger is the harder claim and the one nobody checks, because the portal is the one everybody can see.

• The availability floor is negotiated downward mid-incident.

  The tell

  Containment options are discussed as though taking the portal offline is free, and nobody in the room can name the instrument that sets the deadline.

  The correction

  FO-5 requires the instrument recorded against the service. Put the citation in the incident pack so that the trade being made is visible to the person making it.