The Mission Shape
A federal health service is the archetype where availability stops being an economic property and becomes a safety one. A clinical system that is unavailable is not an inconvenience deferred to tomorrow; care is delivered now or it is not delivered, and the consequence lands on a person rather than on a budget. That single fact reorders the whole defensive scheme: containment actions that are routine elsewhere have to be weighed against clinical harm here.
Underneath sits the combination that makes this shape genuinely hard — protected health information and connected medical devices on one estate. The devices are regulated, long-lived, frequently unpatchable within the vendor’s support terms, and physically attached to patients. They are not endpoints, and treating them as endpoints produces a remediation plan that clinical leadership will refuse, correctly.
This is a composite, not an organization. Nothing on this page measures an agency, and the criticality and exposure figures below are the archetype’s own — useful for comparing shapes, useless as a statement about anybody.
What its key terrain typically is — 7 of 11 elements
How to read it. Seven marks, spread across every part of the shape: clinician identity, the record system, the health information itself, the recovery vault, the clinicians, the medical center and the device manufacturers. The breadth is the finding — on this estate almost everything is decisive because almost everything is on the path to care.
- T1Clinician IdentityICAM
- T4EHR Systemclinical record
- T5PHI Storeprotected health
- TXRecovery Vaultisolated · offline
- T7Clinicianspatient-record access
- T8Medical Centerfacility · life safety
- T9Device Manufacturersremote maintenance
Key terrain is ground whose loss is decisive rather than merely expensive. Marking too much of an estate defeats the purpose: this archetype marks 64% of its elements, and an overlay that marks most of itself has not made a choice.
Which Terrain Layers Matter Most, and Why
The order and the shares are derived: each element’s weight is its criticality times its exposure, summed by layer and read against the estate’s total of 178. The explanations are written for the 3 layers that carry the shape.
The urban terrain. Patient Portal, EHR System.
The record system is where clinical availability is actually won or lost, and it carries the estate’s tightest recovery objectives: two hours to recover, five minutes of acceptable data loss. Those numbers are clinical requirements wearing technical clothes.
The lines of communication. Device Manufacturers.
Device manufacturers are marked key terrain because the update path into a medical device is the one route that reaches the device floor legitimately, at scale, and on somebody else’s release schedule.
Ground you cannot maneuver freely on. Medical Devices.
Medical devices carry as much weight as any layer on this estate bar the record system, and they are the layer with the fewest available moves. Passive monitoring and boundary control are most of the catalog here, because the device cannot be restarted on the defender’s schedule and in some cases cannot be touched at all.
Terrain that is also the force. Clinicians.
The corridors. Health Exchange.
The high ground. Clinician Identity.
The physical boundary. Medical Center.
The enablers of movement. Recovery Vault, SOC.
The objective. PHI Store.
The federal-obligations profile — 3 declared, 3 out of scope
An obligation this estate does not incur is scored out of scope, not counted against it. That is the framework’s profile mechanism, and it is what stops an agency being marked down for failing to defend ground it does not hold.
Why this profile. Three declared, and this is the archetype where the profile most obviously earns its keep: privacy terrain over the health information, operational technology over the device floor, and a statutory availability floor over the clinical services. Controlled unclassified information, tenancy and supply-chain terrain are out of scope — not because a health service has no suppliers, but because the framework’s six obligations are declared against the ground the estate actually holds, and adding an obligation you cannot evidence produces a permanent open finding instead of a defense.
To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.
Carried byPHI Store (T5)
To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
Carried byMedical Devices (T6)
To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
Carried byEHR System (T4)
To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
The declaration is checked against the ground rather than trusted: every in-scope obligation above is carried by at least one element, and no element carries an obligation the profile omits. Adopting this shape means reviewing that declaration against your own estate — the profile that quietly omits an obligation you do incur is the one failure this mechanism can produce.
Its Typical Campaign Phase
Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
Typical, not permanent. A phase is declared against a scope and can be declared backwards without embarrassment; this is where a well-run estate of this shape sits when it is not in contact. The full entry and exit conditions are on the Shape phase page.
Which maneuvers matter most — 9 of eleven forms evidenced
Ranked by the weight of the ground evidencing each form, not by how many elements name it. The 3 explained below are the ones that decide how this shape is defended; the rest are present and secondary. A form this estate does not evidence at all is not necessarily wrong for it — it is ground the archetype does not yet stand on.
Ensure no single failure is decisive.
Depth is doing more work here than anywhere else, because the containment options available in other archetypes — isolate, take offline, force reauthentication — carry clinical risk. When the fast moves are constrained, the standing ones have to be better.
Force the adversary onto ground you own and watch.
Canalization is the primary defense for ground you cannot patch. If the device cannot be hardened, the reachable set around it can be, and that is a boundary decision rather than a device decision.
Restore the mission on evidence, not on hope — and prove it before you need it.
Reconstitution is a clinical requirement here. Five elements ship recovery objectives, and the vault they restore from is explicitly denied a path from the identity plane, because a restore that depends on the compromised directory is not a restore.
Trade space for information and time, and impose cost.
Make identity, not network location, the decisive plane — surround the adversary with policy.
Gain early warning and buy reaction time before the adversary touches key terrain.
Give ground deliberately to preserve the force. Degrade gracefully; never fail open.
Buy decision time and prevent the adversary culminating on the objective.
Seize the initiative and evict before the adversary reaches the objective.
Paths This Estate Declares Closed
A denial drawn on the overlay is a claim that can be tested. Stating that no path exists, as a path, is what turns an assumption into something an assessor can go and check — and what makes an observed connection a finding rather than a discovery.
Clinician Identityhas no path toRecovery VaultDrawn as: no production identity path
Recovery Objectives This Shape Declares
Declared at the archetype level because they follow from the mission rather than from the technology. Where a deadline is set outside the agency, the recovery objective is constrained by it rather than negotiated against it.
| Element | Recovery time objective | Recovery point objective | How it is rebuilt |
|---|---|---|---|
| Clinician IdentityT1 · ICAM | 1h | Zero — no acceptable loss | Break-glass directory rebuilt from offline media; the one rebuild nothing else can assume |
| EHR SystemT4 · clinical record | 2h | 5m | Golden image plus the tested downtime procedure; clinical availability is a safety floor |
| PHI StoreT5 · protected health | 2h | 5m | Restore from the isolated vault; integrity verified before clinical use |
| Recovery VaultTX · isolated · offline | 2h | 5m | Offline copies plus the tested downtime procedure; clinical care continues while systems rebuild |
| Medical CenterT8 · facility · life safety | 2h | Not declared | Not declared at archetype level. |
Clinician Identity
T1 · ICAM
- Recovery time objective
- 1h
- Recovery point objective
- Zero — no acceptable loss
- How it is rebuilt
- Break-glass directory rebuilt from offline media; the one rebuild nothing else can assume
EHR System
T4 · clinical record
- Recovery time objective
- 2h
- Recovery point objective
- 5m
- How it is rebuilt
- Golden image plus the tested downtime procedure; clinical availability is a safety floor
PHI Store
T5 · protected health
- Recovery time objective
- 2h
- Recovery point objective
- 5m
- How it is rebuilt
- Restore from the isolated vault; integrity verified before clinical use
Recovery Vault
TX · isolated · offline
- Recovery time objective
- 2h
- Recovery point objective
- 5m
- How it is rebuilt
- Offline copies plus the tested downtime procedure; clinical care continues while systems rebuild
Medical Center
T8 · facility · life safety
- Recovery time objective
- 2h
- Recovery point objective
- Not declared
- How it is rebuilt
- Not declared at archetype level.
The Estate as the Overlay Lays It Out
The tier bands the archetype ships with, top to bottom, with every element in each. 11 elements and 11 drawn paths in total.
Patient Access4 elements · 1 decisive
The Failure Modes Characteristic of This Shape
Not general bad practice. These are the ways a competent program built on this particular shape goes wrong while continuing to report that it is fine.
Containment is planned without clinical authority in the room.
- The tell
- The pre-authorized action set includes isolating clinical systems, and no clinician signed it.
- The correction
- Split the pre-authorization by clinical consequence. Some actions are pre-authorized, some are pre-authorized with clinical concurrence, and writing that distinction down beforehand is the whole exercise.
Medical devices are counted rather than positioned.
- The tell
- The device inventory is complete and the overlay shows no connections between the device floor and enterprise ground.
- The correction
- Declare the connections. FO-4 asks for the paths, including the engineering and vendor-support routes, because an isolated device floor is a claim until the overlay tests it.