The Mission Shape
A regulatory or licensing body receives from the outside world and decides. Its population is not staff and not quite the public: it is filers, agents and applicants, who hold accounts, who file against deadlines they cannot move, and whose submissions arrive in bursts. Availability therefore becomes an attack surface in a way it is not elsewhere — a filing window that closes is a legal event, not a service outage.
The objective is pre-decisional. What an examiner has provisionally concluded, before it is published, is worth more to an adversary than the published decision will ever be, and it is worth most in the window before it is announced. The estate also carries a bulk public data surface, which is the one place where the mission requires giving information away at speed.
This is a composite, not an organization. Nothing on this page measures an agency, and the criticality and exposure figures below are the archetype’s own — useful for comparing shapes, useless as a statement about anybody.
What its key terrain typically is — 4 of 11 elements
How to read it. Four elements are marked, and three of them sit on the path a filing takes: the portal it arrives at, the examination system that works it, and the pre-decisional record it becomes. The examiner population is the fourth, because the fastest route to a pre-decisional record is the person already authorized to read it.
- T4Filing Portaldeadline-driven
- T4Examination Systemcase processing
- T5Pre-decisional Recordssensitive
- T7Examinerspre-decisional access
Key terrain is ground whose loss is decisive rather than merely expensive. Marking too much of an estate defeats the purpose: this archetype marks 36% of its elements, and an overlay that marks most of itself has not made a choice.
Which Terrain Layers Matter Most, and Why
The order and the shares are derived: each element’s weight is its criticality times its exposure, summed by layer and read against the estate’s total of 149. The explanations are written for the 3 layers that carry the shape.
The urban terrain. Filing Portal, Public Bulk API, Examination System.
Three separate application surfaces sit on this one layer — the filing portal, the bulk public API, and the examination system behind them — each with its own population and its own availability argument. No other layer on the estate comes close, and the three cannot share a hardening plan without one of them getting the wrong one.
The high ground. External Identity.
The lines of communication. Filing Platform Vendor.
The filing platform is vendor-operated. That is a tenancy and inheritance question as much as a supplier question, and an adopter whose platform is run by someone else should look hard at the shared-service and small-agency profiles before settling here.
The objective. Pre-decisional Records, Fee Database.
The pre-decisional record set is small, low-exposure and marked key terrain, which is the correct combination and an unusual one. Its defense is almost entirely about who may read it and when, not about where it sits.
Terrain that is also the force. Examiners.
The entry fords. Examiner Devices.
The physical boundary. Headquarters.
The enablers of movement. Managed SIEM.
The federal-obligations profile — 2 declared, 4 out of scope
An obligation this estate does not incur is scored out of scope, not counted against it. That is the framework’s profile mechanism, and it is what stops an agency being marked down for failing to defend ground it does not hold.
Why this profile. Privacy terrain and the statutory availability floor, and nothing else. The estate is unusual in how thin its cross-cutting tier is — a single managed SIEM — which is honest rather than an omission: many regulators buy monitoring rather than run it. That thinness is also why the profile is worth revisiting on adoption. If your filing platform is operated by a provider, tenancy and inheritance is a live obligation for you even though the archetype does not declare it.
To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.
Carried byPre-decisional Records (T5)
To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
Carried byFiling Portal (T4)
To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
The declaration is checked against the ground rather than trusted: every in-scope obligation above is carried by at least one element, and no element carries an obligation the profile omits. Adopting this shape means reviewing that declaration against your own estate — the profile that quietly omits an obligation you do incur is the one failure this mechanism can produce.
Its Typical Campaign Phase
Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
Typical, not permanent. A phase is declared against a scope and can be declared backwards without embarrassment; this is where a well-run estate of this shape sits when it is not in contact. The full entry and exit conditions are on the Shape phase page.
Which maneuvers matter most — 5 of eleven forms evidenced
Ranked by the weight of the ground evidencing each form, not by how many elements name it. The 3 explained below are the ones that decide how this shape is defended; the rest are present and secondary. A form this estate does not evidence at all is not necessarily wrong for it — it is ground the archetype does not yet stand on.
Ensure no single failure is decisive.
With three outward-facing surfaces and one internal decision tier, layered independent controls are what keep a defect in the public filing path from being a defect in the examination path.
Buy decision time and prevent the adversary culminating on the objective.
Delay is the form that fits a deadline-shaped mission. When the loss event is a filing window closing, buying time is not a consolation prize — it is the objective.
Gain early warning and buy reaction time before the adversary touches key terrain.
Screening the external filer population early is the only cheap move available on an estate with a thin cross-cutting tier: warning bought at the perimeter costs less than detection engineering this shape usually cannot staff.
Make identity, not network location, the decisive plane — surround the adversary with policy.
Trade space for information and time, and impose cost.
Paths This Estate Declares Closed
This archetype draws none. That is a genuine finding rather than an omission: an estate with no declared denials has no tested claim about where an adversary cannot go, and adding the first two or three is usually the cheapest improvement available to a shape like this one.
The Estate as the Overlay Lays It Out
The tier bands the archetype ships with, top to bottom, with every element in each. 11 elements and 10 drawn paths in total.
Public Filing4 elements · 1 decisive
The Failure Modes Characteristic of This Shape
Not general bad practice. These are the ways a competent program built on this particular shape goes wrong while continuing to report that it is fine.
The bulk data surface is defended as though it were the portal.
- The tell
- The open API and the filing portal share one hardening plan, and the API’s real risk — inference across a public dataset — appears nowhere in it.
- The correction
- Score them as separate ground. The portal’s risk is intrusion; the bulk surface’s risk is that everything it publishes is working exactly as designed.
Pre-decisional sensitivity is asserted but never modeled.
- The tell
- The record set is described as sensitive in the system security plan, and no path on the overlay is drawn as a denial.
- The correction
- Draw the denials. A record set nobody may reach from the public tier should have that stated as a path on the overlay, where an unpermitted flow becomes a finding rather than a discovery.