The Mission Shape
A federal law-enforcement estate holds information whose sensitivity is not primarily about the outside world. Case data, evidence and source identities carry a need-to-know boundary that runs through the organization, not around it, and the population authorized to cross that boundary is the population most worth compromising. Insider risk here is not a residual category; it is the leading one.
The estate is also mobile. Field devices and remote access are how the work is done, so the entry fords are wide, dispersed and frequently outside any facility. The archetype starts in Deter rather than Shape because a law-enforcement estate is targeted for what it holds regardless of what it does, and a posture that is never visible deters nobody.
This is a composite, not an organization. Nothing on this page measures an agency, and the criticality and exposure figures below are the archetype’s own — useful for comparing shapes, useless as a statement about anybody.
What its key terrain typically is — 6 of 13 elements
How to read it. Six elements, and the set reaches further down the stack than most: the case system and the evidence store, but also the case agents, the identity plane that authorizes them, and the physical evidence facility. Source identities are the smallest element on the estate and among the most consequential.
- T1ICAM · PIVstrong authn
- T4Case Managementinvestigations
- T5Evidence Storechain of custody
- T5Source Identitieshighest sensitivity
- T7Case Agentssource handling
- T8Evidence Facilitychain of custody
Key terrain is ground whose loss is decisive rather than merely expensive. Marking too much of an estate defeats the purpose: this archetype marks 46% of its elements, and an overlay that marks most of itself has not made a choice.
Which Terrain Layers Matter Most, and Why
The order and the shares are derived: each element’s weight is its criticality times its exposure, summed by layer and read against the estate’s total of 146. The explanations are written for the 3 layers that carry the shape.
The urban terrain. Case Management, Tip Intake.
Case management is where authorization actually gets decided, which makes it heavier than the data it fronts. Most unauthorized access to case material is properly authenticated access through this system by someone who should not have asked.
The entry fords. Field Devices.
The corridors. Field VPN.
The enablers of movement. Recovery Vault, SOC, Threat Intel.
The high ground. ICAM · PIV.
Terrain that is also the force. Case Agents.
The workforce is simultaneously the ground and the force. Case agents are marked key terrain not because they are suspect but because their access is the shortest route to everything else, and the framework scores the register of who holds it and how fast it is revoked.
The lines of communication. Forensic Tooling Vendor.
The objective. Evidence Store, Source Identities.
The data layer is low-weight by criticality-times-exposure and holds two of the estate’s key-terrain marks, which is the signature of well-held ground rather than of unimportance. The estate draws an explicit denial around source identities — no path, stated as a path.
The physical boundary. Evidence Facility.
The federal-obligations profile — 2 declared, 4 out of scope
An obligation this estate does not incur is scored out of scope, not counted against it. That is the framework’s profile mechanism, and it is what stops an agency being marked down for failing to defend ground it does not hold.
Why this profile. Privacy terrain and controlled unclassified information, and nothing else. Statutory availability is deliberately absent: this estate’s loss event is disclosure, not downtime, and declaring an availability floor it does not have would put recovery-objective effort where the risk is not. That is the mechanism working in the direction people forget — a profile narrows what is scored so the scarce assessment effort lands on the ground that matters.
To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.
Carried bySource Identities (T5)
To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.
Carried byEvidence Store (T5)
To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
The declaration is checked against the ground rather than trusted: every in-scope obligation above is carried by at least one element, and no element carries an obligation the profile omits. Adopting this shape means reviewing that declaration against your own estate — the profile that quietly omits an obligation you do incur is the one failure this mechanism can produce.
Its Typical Campaign Phase
Visible hardening, a deception grid, and a stated attribution posture.
Typical, not permanent. A phase is declared against a scope and can be declared backwards without embarrassment; this is where a well-run estate of this shape sits when it is not in contact. The full entry and exit conditions are on the Deter phase page.
Which maneuvers matter most — 10 of eleven forms evidenced
Ranked by the weight of the ground evidencing each form, not by how many elements name it. The 3 explained below are the ones that decide how this shape is defended; the rest are present and secondary. A form this estate does not evidence at all is not necessarily wrong for it — it is ground the archetype does not yet stand on.
Ensure no single failure is decisive.
Depth carries the most weight because the estate’s hardest problem is an authenticated user going somewhere they should not, and the only answer to that is more than one independent control between the credential and the record.
Make identity, not network location, the decisive plane — surround the adversary with policy.
Envelopment is the form that makes need-to-know operational. Continuous authorization and just-in-time privilege turn a boundary that is written down into one that is enforced at the moment of access.
Trade space for information and time, and impose cost.
Ambush is unusually well suited to this shape. A deception grid seeded through the case and evidence tiers costs little and produces the one signal insider-risk programs are chronically short of: an access that has no innocent explanation.
Force the adversary onto ground you own and watch.
Give ground deliberately to preserve the force. Degrade gracefully; never fail open.
Buy decision time and prevent the adversary culminating on the objective.
Gain early warning and buy reaction time before the adversary touches key terrain.
Seize the initiative and evict before the adversary reaches the objective.
Restore the mission on evidence, not on hope — and prove it before you need it.
Disrupt adversary staging before the attack is launched.
Paths This Estate Declares Closed
A denial drawn on the overlay is a claim that can be tested. Stating that no path exists, as a path, is what turns an assumption into something an assessor can go and check — and what makes an observed connection a finding rather than a discovery.
ICAM · PIVhas no path toRecovery VaultDrawn as: no production identity path
Forensic Tooling Vendorhas no path toSource IdentitiesDrawn as: no source-identity path
The Estate as the Overlay Lays It Out
The tier bands the archetype ships with, top to bottom, with every element in each. 13 elements and 14 drawn paths in total.
Field / Edge4 elements · 1 decisive
Case Tier3 elements · 1 decisive
Sensitive Records3 elements · 2 decisive
The Failure Modes Characteristic of This Shape
Not general bad practice. These are the ways a competent program built on this particular shape goes wrong while continuing to report that it is fine.
Insider risk is run as a personnel program with no terrain on it.
- The tell
- The insider-risk brief names populations and clearances but cannot say which records those populations can reach, from where.
- The correction
- Put the workforce on the overlay. The measurable question is what the role can reach and how fast the access ends when the role does.
Field mobility is scored as an endpoint problem.
- The tell
- The field devices have an endpoint-detection line item and the field access path has no defensive move assigned to it at all.
- The correction
- Score the path, not just the device. A managed laptop on an unmanaged network reaching a case system is three pieces of terrain, and only one of them has an agent on it.