The Mission Shape
A defense-adjacent civilian agency runs program work at the boundary of the classified world without being inside it. The estate carries controlled unclassified information, a cleared or suitability-screened workforce, and a contractor population that is not a vendor relationship so much as part of the organization. The interface with those contractors is a permanent, standing, high-volume path into the estate.
The decisive point is the build pipeline. On this shape more than any other, an adversary who reaches the pipeline has enveloped everything downstream of it in a single move — no lateral movement, no credential theft, just a signed artifact carrying their code into every place the organization trusts. The estate reflects that: the pipeline is marked key terrain and the path from it to the controlled data is drawn as an explicit denial.
This is a composite, not an organization. Nothing on this page measures an agency, and the criticality and exposure figures below are the archetype’s own — useful for comparing shapes, useless as a statement about anybody.
What its key terrain typically is — 6 of 12 elements
How to read it. Six marks, and they trace the supply route rather than the asset list: the identity plane, the pipeline, the controlled data, the cleared staff, the facility, and the software suppliers who feed components in. Read in order, they are the route an adversary would take.
- T1ICAM · PIV-Icontractor identity
- T4CI/CD Pipelinebuild · sign
- T5CUI / Program Datacontrolled
- T7Cleared Program Staffsuitability · CUI
- T8Program Facilitycontrolled area
- T9Software Supplierscomponents · SBOM
Key terrain is ground whose loss is decisive rather than merely expensive. Marking too much of an estate defeats the purpose: this archetype marks 50% of its elements, and an overlay that marks most of itself has not made a choice.
Which Terrain Layers Matter Most, and Why
The order and the shares are derived: each element’s weight is its criticality times its exposure, summed by layer and read against the estate’s total of 173. The explanations are written for the 3 layers that carry the shape.
The urban terrain. Supplier Portal, CI/CD Pipeline, Program Systems.
The heaviest layer, carrying the supplier portal, the pipeline and the program systems. The pipeline’s weight is not about how exposed it is but about what it can reach: it writes to everything, which is what makes it the decisive point rather than merely an important system.
The lines of communication. Software Suppliers.
Software suppliers are key terrain and evidence nearly every form of maneuver in the catalog — the widest maneuver spread of any single element across all ten archetypes. That is what a genuinely contested line of communication looks like when it is being defended rather than merely procured.
The enablers of movement. Recovery Vault, SOC, Threat Intel.
The high ground. ICAM · PIV-I.
The entry fords. Contractor Devices.
Terrain that is also the force. Cleared Program Staff.
The objective. CUI / Program Data.
The controlled data element is small and well held, and the estate declares that the pipeline has no direct path to it. On this shape the denial is more valuable than another control on the store itself.
The physical boundary. Program Facility.
The federal-obligations profile — 2 declared, 4 out of scope
An obligation this estate does not incur is scored out of scope, not counted against it. That is the framework’s profile mechanism, and it is what stops an agency being marked down for failing to defend ground it does not hold.
Why this profile. Controlled unclassified information and supply-chain terrain. Privacy is not declared, which is a real profile choice rather than an oversight — the sensitive material here is program data rather than personal data, and an assessment that spent its effort on privacy terrain would be assessing the wrong ground. Statutory availability is also absent: program work has schedules, and schedules are not the same thing as an instrument that sets a deadline in law.
To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.
Carried byCUI / Program Data (T5)
To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.
Carried bySupplier Portal (T4), CI/CD Pipeline (T4)
The declaration is checked against the ground rather than trusted: every in-scope obligation above is carried by at least one element, and no element carries an obligation the profile omits. Adopting this shape means reviewing that declaration against your own estate — the profile that quietly omits an obligation you do incur is the one failure this mechanism can produce.
Its Typical Campaign Phase
Visible hardening, a deception grid, and a stated attribution posture.
Typical, not permanent. A phase is declared against a scope and can be declared backwards without embarrassment; this is where a well-run estate of this shape sits when it is not in contact. The full entry and exit conditions are on the Deter phase page.
Which maneuvers matter most — 11 of eleven forms evidenced
Ranked by the weight of the ground evidencing each form, not by how many elements name it. The 3 explained below are the ones that decide how this shape is defended; the rest are present and secondary. A form this estate does not evidence at all is not necessarily wrong for it — it is ground the archetype does not yet stand on.
Ensure no single failure is decisive.
The heaviest form on the estate, and the reason is the contractor interface: a standing external path into the organization has to be layered, because it cannot be closed and cannot be fully trusted.
Disrupt adversary staging before the attack is launched.
Spoiling attack is unusually prominent here — second only to depth — because this shape has both the intelligence relationships and the supplier visibility to act on a component advisory before the component reaches the pipeline. Very few archetypes can genuinely do this.
Seize the initiative and evict before the adversary reaches the objective.
Counterattack ranks high because the estate is instrumented for it: a SOC, threat intelligence and a pipeline whose artifacts are signed and escrowed. Hunting against a supplier-origin hypothesis is a realistic activity here rather than an aspirational one.
Give ground deliberately to preserve the force. Degrade gracefully; never fail open.
Restore the mission on evidence, not on hope — and prove it before you need it.
Trade space for information and time, and impose cost.
Make identity, not network location, the decisive plane — surround the adversary with policy.
Force the adversary onto ground you own and watch.
Convert contact into durable advantage rather than closing the ticket.
Gain early warning and buy reaction time before the adversary touches key terrain.
Buy decision time and prevent the adversary culminating on the objective.
Paths This Estate Declares Closed
A denial drawn on the overlay is a claim that can be tested. Stating that no path exists, as a path, is what turns an assumption into something an assessor can go and check — and what makes an observed connection a finding rather than a discovery.
CI/CD Pipelinehas no path toCUI / Program DataDrawn as: no direct path
ICAM · PIV-Ihas no path toRecovery VaultDrawn as: no production identity path
The Estate as the Overlay Lays It Out
The tier bands the archetype ships with, top to bottom, with every element in each. 12 elements and 14 drawn paths in total.
Contractor Interface4 elements · 1 decisive
Program Tier3 elements · 1 decisive
Controlled Data2 elements · 1 decisive
The Failure Modes Characteristic of This Shape
Not general bad practice. These are the ways a competent program built on this particular shape goes wrong while continuing to report that it is fine.
The pipeline is governed as an engineering tool.
- The tell
- Pipeline access is administered by the platform team under change control, and it appears in no terrain overlay as a decisive point.
- The correction
- Put it on the overlay and treat reaching it as the adversary’s objective. Everything the pipeline can write to is downstream of one credential until it is.
Supplier assurance is documentary rather than positional.
- The tell
- The supplier file is complete — attestations, questionnaires, flow-downs — and nothing records what access each supplier actually holds.
- The correction
- FO-6 asks for the access, not the relationship. Draw the path each supplier holds into the estate and check it against what was actually provisioned.