The Mission Shape
A financial regulator or statistical agency holds non-public information that has a precise value and a precise expiry: the moment of publication. Before that moment the information is worth acting on; after it, it is worth nothing to an adversary. This is the archetype where the loss event is a timing leak — an adversary who learns the number four minutes early has taken everything there was to take, and nothing has been encrypted, deleted or disrupted.
The consequence for the estate is that the dissemination path is as sensitive as the analysis path. The estate declares its release channel as a timed-release-only path, which is the sort of statement that looks like plumbing and is actually the mission. The archetype starts in Deter because a visible posture around embargoed material is part of what deters attempting it.
This is a composite, not an organization. Nothing on this page measures an agency, and the criticality and exposure figures below are the archetype’s own — useful for comparing shapes, useless as a statement about anybody.
What its key terrain typically is — 6 of 12 elements
How to read it. Six marks, and the pairing is unusual: the public dissemination surface is key terrain alongside the embargoed statistics it will eventually publish. Both matter for the same reason — one holds the number, the other controls when it exists in public.
- T4Public Disseminationtimed release
- T1Analyst IdentityPIV · JIT
- T5Embargoed Statisticspre-release
- TXRecovery Vaultisolated · offline
- T7Market Analystspre-release access
- T8Analysis Facilitycontrolled floor
Key terrain is ground whose loss is decisive rather than merely expensive. Marking too much of an estate defeats the purpose: this archetype marks 50% of its elements, and an overlay that marks most of itself has not made a choice.
Which Terrain Layers Matter Most, and Why
The order and the shares are derived: each element’s weight is its criticality times its exposure, summed by layer and read against the estate’s total of 151. The explanations are written for the 3 layers that carry the shape.
The urban terrain. Filer Submission, Public Dissemination, Analytics Platform.
Three application surfaces carry the heaviest weight on the estate: filer submission, the analytics platform where the number is made, and the dissemination channel that releases it. The last of those is the only element in any of the ten archetypes whose defense is fundamentally about a clock.
The enablers of movement. Recovery Vault, SOC, Detection Engineering.
The lines of communication. Market Data Feeds.
The high ground. Analyst Identity.
Terrain that is also the force. Market Analysts.
The analyst population is marked key terrain because they legitimately hold the number before anybody else does. Every control on this estate has to survive the fact that the people who can leak it are the people who must have it.
The entry fords. Analyst Workstations.
The objective. Embargoed Statistics.
The embargoed statistics element scores as some of the lightest ground on the estate and is the most consequential thing on it — small, well held, low exposure, and worth a nation-state’s attention for a few hours at a time. A recovery point of zero on a data element that small tells you exactly what it is.
The physical boundary. Analysis Facility.
The federal-obligations profile — 2 declared, 4 out of scope
An obligation this estate does not incur is scored out of scope, not counted against it. That is the framework’s profile mechanism, and it is what stops an agency being marked down for failing to defend ground it does not hold.
Why this profile. Privacy terrain and statutory availability. The availability declaration is worth reading carefully, because it is not the usual one: the floor is a publication schedule, which is a deadline that must be met neither early nor late. It is the clearest illustration that FO-5 is about an externally fixed date rather than about uptime, and it is why the dissemination element carries a thirty-minute recovery objective and a recovery point of zero.
To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.
Carried byEmbargoed Statistics (T5)
To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
Carried byPublic Dissemination (T4)
To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
The declaration is checked against the ground rather than trusted: every in-scope obligation above is carried by at least one element, and no element carries an obligation the profile omits. Adopting this shape means reviewing that declaration against your own estate — the profile that quietly omits an obligation you do incur is the one failure this mechanism can produce.
Its Typical Campaign Phase
Visible hardening, a deception grid, and a stated attribution posture.
Typical, not permanent. A phase is declared against a scope and can be declared backwards without embarrassment; this is where a well-run estate of this shape sits when it is not in contact. The full entry and exit conditions are on the Deter phase page.
Which maneuvers matter most — 11 of eleven forms evidenced
Ranked by the weight of the ground evidencing each form, not by how many elements name it. The 3 explained below are the ones that decide how this shape is defended; the rest are present and secondary. A form this estate does not evidence at all is not necessarily wrong for it — it is ground the archetype does not yet stand on.
Ensure no single failure is decisive.
Depth around a small, well-defined objective is efficient in a way it is not on a sprawling estate. Everything can be arranged around one question: who can see the number before the clock.
Make identity, not network location, the decisive plane — surround the adversary with policy.
Envelopment is how a population that must hold the number is kept from being the leak. Continuous authorization on the analysis tier means access is a fact about a moment rather than a fact about a person.
Buy decision time and prevent the adversary culminating on the objective.
Delay is the form that maps directly onto the loss event. If the adversary’s objective is measured in minutes of advantage, then buying minutes is not a mitigation — it is a defeat of the objective.
Restore the mission on evidence, not on hope — and prove it before you need it.
Trade space for information and time, and impose cost.
Gain early warning and buy reaction time before the adversary touches key terrain.
Give ground deliberately to preserve the force. Degrade gracefully; never fail open.
Seize the initiative and evict before the adversary reaches the objective.
Force the adversary onto ground you own and watch.
Disrupt adversary staging before the attack is launched.
Convert contact into durable advantage rather than closing the ticket.
Paths This Estate Declares Closed
A denial drawn on the overlay is a claim that can be tested. Stating that no path exists, as a path, is what turns an assumption into something an assessor can go and check — and what makes an observed connection a finding rather than a discovery.
Embargoed Statisticshas no path toPublic DisseminationDrawn as: timed release only
Analyst Identityhas no path toRecovery VaultDrawn as: no production identity path
Recovery Objectives This Shape Declares
Declared at the archetype level because they follow from the mission rather than from the technology. Where a deadline is set outside the agency, the recovery objective is constrained by it rather than negotiated against it.
| Element | Recovery time objective | Recovery point objective | How it is rebuilt |
|---|---|---|---|
| Public DisseminationT4 · timed release | 30m | Zero — no acceptable loss | Standby release path; the publication time is fixed by rule and cannot slip |
| Analyst IdentityT1 · PIV · JIT | 2h | Zero — no acceptable loss | Directory rebuilt from offline media held outside the production tenant |
| Embargoed StatisticsT5 · pre-release | 1h | Zero — no acceptable loss | Restore from the isolated vault; integrity verified against the sealed hash before release |
| Recovery VaultTX · isolated · offline | 1h | Zero — no acceptable loss | Sealed copies with independent hashes; release path rebuilt without touching production identity |
Public Dissemination
T4 · timed release
- Recovery time objective
- 30m
- Recovery point objective
- Zero — no acceptable loss
- How it is rebuilt
- Standby release path; the publication time is fixed by rule and cannot slip
Analyst Identity
T1 · PIV · JIT
- Recovery time objective
- 2h
- Recovery point objective
- Zero — no acceptable loss
- How it is rebuilt
- Directory rebuilt from offline media held outside the production tenant
Embargoed Statistics
T5 · pre-release
- Recovery time objective
- 1h
- Recovery point objective
- Zero — no acceptable loss
- How it is rebuilt
- Restore from the isolated vault; integrity verified against the sealed hash before release
Recovery Vault
TX · isolated · offline
- Recovery time objective
- 1h
- Recovery point objective
- Zero — no acceptable loss
- How it is rebuilt
- Sealed copies with independent hashes; release path rebuilt without touching production identity
The Estate as the Overlay Lays It Out
The tier bands the archetype ships with, top to bottom, with every element in each. 12 elements and 12 drawn paths in total.
Market Interface4 elements · 2 decisive
Analysis Tier3 elements
Embargoed Data2 elements · 2 decisive
The Failure Modes Characteristic of This Shape
Not general bad practice. These are the ways a competent program built on this particular shape goes wrong while continuing to report that it is fine.
Confidentiality is defended and timing is not.
- The tell
- The embargoed store has strong access control and no monitoring of who queried it in the hour before release.
- The correction
- Instrument the clock. The measurable question on this estate is not who can read the number but who read it, and when relative to publication.
The dissemination channel is treated as a publishing system.
- The tell
- The release path sits in the same availability tier as the public website, with the same recovery objective.
- The correction
- Score it as key terrain with its own floor. Early release and late release are both failures, and no ordinary web-availability target expresses that.