The Mission Shape
A land or resource management agency is defined by geography before it is defined by technology. Sites are remote, links are thin and sometimes intermittent, and the people at the far end of them are the agency for practical purposes. Anything that assumes a continuously connected estate — agent check-in intervals, cloud-mediated policy decisions, a same-day response posture — degrades quietly at the edges, and nobody at headquarters can see it degrading.
The larger part of the estate is operational technology: sensors, control systems and site infrastructure whose failure has physical consequences and whose maintenance windows are set by seasons and by contractors rather than by a change board. This is the archetype where the framework’s own added layers are doing the most work, because a model built only on the five maturity pillars would score the majority of this estate as though it were not there.
This is a composite, not an organization. Nothing on this page measures an agency, and the criticality and exposure figures below are the archetype’s own — useful for comparing shapes, useless as a statement about anybody.
What its key terrain typically is — 3 of 11 elements
How to read it. Only three marks, which is itself informative: the control layer, the resource records, and the integrator who maintains the control layer. On a dispersed estate, the small number of things worth calling decisive is a feature — it says the defense has a focus that thin bandwidth can actually support.
Key terrain is ground whose loss is decisive rather than merely expensive. Marking too much of an estate defeats the purpose: this archetype marks 27% of its elements, and an overlay that marks most of itself has not made a choice.
Which Terrain Layers Matter Most, and Why
The order and the shares are derived: each element’s weight is its criticality times its exposure, summed by layer and read against the estate’s total of 163. The explanations are written for the 3 layers that carry the shape.
Ground you cannot maneuver freely on. Field Sensors, SCADA / Control.
This is the only archetype where operational technology is the heaviest layer on the estate. The control element is marked key terrain with a four-hour recovery objective and a recovery point of zero, which is a physical-consequence requirement rather than a data one.
The urban terrain. GIS Platform, Permitting System.
The lines of communication. SCADA Integrator.
The control-system integrator is marked key terrain because remote maintenance is how a dispersed estate is maintained at all. The access is real, standing, and reaches the ground with the highest consequence of loss.
The physical boundary. Remote Field Sites.
Remote field sites carry real weight because they are simultaneously facilities, network termination points and the only place some equipment physically exists. A twenty-four-hour site recovery objective is an honest statement about how long it takes to reach somewhere by road.
The corridors. Remote Site Links.
Terrain that is also the force. Field Staff.
The enablers of movement. Recovery Vault, Managed SOC.
The objective. Resource Records.
The federal-obligations profile — 2 declared, 4 out of scope
An obligation this estate does not incur is scored out of scope, not counted against it. That is the framework’s profile mechanism, and it is what stops an agency being marked down for failing to defend ground it does not hold.
Why this profile. Operational technology and statutory availability, and only those two. Privacy is out of scope — a resource-management estate holds land and permit records rather than personal ones — and so is controlled unclassified information. This is the profile mechanism at its most defensible: an agency of this shape assessed against all six obligations would carry permanent findings on privacy terrain it does not hold, which would crowd out the two obligations it does.
To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
Carried byField Sensors (T6), SCADA / Control (T6)
To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
Carried bySCADA / Control (T6)
To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
The declaration is checked against the ground rather than trusted: every in-scope obligation above is carried by at least one element, and no element carries an obligation the profile omits. Adopting this shape means reviewing that declaration against your own estate — the profile that quietly omits an obligation you do incur is the one failure this mechanism can produce.
Its Typical Campaign Phase
Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
Typical, not permanent. A phase is declared against a scope and can be declared backwards without embarrassment; this is where a well-run estate of this shape sits when it is not in contact. The full entry and exit conditions are on the Shape phase page.
Which maneuvers matter most — 5 of eleven forms evidenced
Ranked by the weight of the ground evidencing each form, not by how many elements name it. The 3 explained below are the ones that decide how this shape is defended; the rest are present and secondary. A form this estate does not evidence at all is not necessarily wrong for it — it is ground the archetype does not yet stand on.
Force the adversary onto ground you own and watch.
Canalization is the dominant form by a wide margin, and it is dominant for a physical reason. When the ground cannot be patched and the response cannot arrive quickly, the defense is decided in advance by what the boundaries permit.
Ensure no single failure is decisive.
Depth compensates for tempo. On an estate where the response may be a day away, standing layered controls are what has to hold in the interval, because nothing faster is going to arrive.
Gain early warning and buy reaction time before the adversary touches key terrain.
Give ground deliberately to preserve the force. Degrade gracefully; never fail open.
Restore the mission on evidence, not on hope — and prove it before you need it.
Reconstitution matters more here than the maneuver count suggests, because recovery at a remote site is a logistics problem before it is a technical one. Rehearsing it is how the twenty-four-hour figure stops being a guess.
Paths This Estate Declares Closed
This archetype draws none. That is a genuine finding rather than an omission: an estate with no declared denials has no tested claim about where an adversary cannot go, and adding the first two or three is usually the cheapest improvement available to a shape like this one.
Recovery Objectives This Shape Declares
Declared at the archetype level because they follow from the mission rather than from the technology. Where a deadline is set outside the agency, the recovery objective is constrained by it rather than negotiated against it.
| Element | Recovery time objective | Recovery point objective | How it is rebuilt |
|---|---|---|---|
| SCADA / ControlT6 · water · dams | 4h | Zero — no acceptable loss | Not declared at archetype level. |
| Remote Field SitesT8 · unstaffed facilities | 24h | Not declared | Not declared at archetype level. |
SCADA / Control
T6 · water · dams
- Recovery time objective
- 4h
- Recovery point objective
- Zero — no acceptable loss
- How it is rebuilt
- Not declared at archetype level.
Remote Field Sites
T8 · unstaffed facilities
- Recovery time objective
- 24h
- Recovery point objective
- Not declared
- How it is rebuilt
- Not declared at archetype level.
The Estate as the Overlay Lays It Out
The tier bands the archetype ships with, top to bottom, with every element in each. 11 elements and 11 drawn paths in total.
Field Sites4 elements · 1 decisive
Systems of Record2 elements · 1 decisive
The Failure Modes Characteristic of This Shape
Not general bad practice. These are the ways a competent program built on this particular shape goes wrong while continuing to report that it is fine.
The estate is scored from headquarters.
- The tell
- Coverage figures are computed from a management console that only remote sites with working links report into, so the sites most at risk are the ones missing from the denominator.
- The correction
- Count the sites that do not report as uncovered rather than as absent. A denominator that excludes the hard cases is the most common way a dispersed estate scores well and defends badly.
Control systems are given an enterprise remediation plan.
- The tell
- The plan calls for agent deployment and monthly patching on equipment whose vendor support terms forbid both.
- The correction
- Re-score the layer with the moves that are actually available: boundary, passive monitoring and engineering-access control. A plan of actions nobody can take reads as a coverage gap forever.