The Mission Shape
A federal research laboratory is collaborative by design and cannot stop being so without failing at its job. Visiting scientists, joint appointments, external co-authors and unmanaged academic devices are not policy failures to be closed out; they are the operating model. A perimeter posture applied honestly to this estate would end the science.
Under that collaboration sits high-value intellectual property and, frequently, controlled unclassified information, plus a floor of laboratory instrumentation that is neither an endpoint nor a server. Instruments run vendor-supplied stacks on decade-long lifecycles and cannot be patched or restarted to a defender’s schedule, which is why they are scored on their own layer rather than as an unusually stubborn part of the fleet.
This is a composite, not an organization. Nothing on this page measures an agency, and the criticality and exposure figures below are the archetype’s own — useful for comparing shapes, useless as a statement about anybody.
What its key terrain typically is — 4 of 11 elements
How to read it. The marked set spans the whole shape: the federated identity that admits collaborators, both data stores, and the instrument vendors who reach in to maintain equipment. The absence of a marked application element is deliberate — on this estate the science is not the software.
- T1Federated Identityuniversity partners
- T5Research Datapre-publication
- T5CUI Storecontrolled
- T9Instrument Vendorsmaintenance access
Key terrain is ground whose loss is decisive rather than merely expensive. Marking too much of an estate defeats the purpose: this archetype marks 36% of its elements, and an overlay that marks most of itself has not made a choice.
Which Terrain Layers Matter Most, and Why
The order and the shares are derived: each element’s weight is its criticality times its exposure, summed by layer and read against the estate’s total of 179. The explanations are written for the 3 layers that carry the shape.
The urban terrain. Collaboration Suite, HPC Cluster.
The collaboration suite and the high-performance cluster carry the weight, and both are shared with people the agency does not employ. That is the archetype’s central tension in one layer: the systems that most need to be open are the ones with the most valuable things behind them.
The objective. Research Data, CUI Store.
The high ground. Federated Identity.
The lines of communication. Instrument Vendors.
Instrument vendors hold maintenance access into the instrument floor, and they are marked key terrain. The relevant question is not whether the vendor is trusted but what the maintenance path can reach once it is open.
Ground you cannot maneuver freely on. Lab Instruments.
Laboratory instrumentation is on the map as its own ground because the moves available on it are narrower. Scoring an instrument network as if it were a server estate overstates the defender’s options and produces a plan full of actions nobody can take.
Terrain that is also the force. Principal Investigators.
The physical boundary. Laboratory Building.
The entry fords. Researcher BYOD.
The enablers of movement. SIEM.
The federal-obligations profile — 3 declared, 3 out of scope
An obligation this estate does not incur is scored out of scope, not counted against it. That is the framework’s profile mechanism, and it is what stops an agency being marked down for failing to defend ground it does not hold.
Why this profile. Three declared: controlled unclassified information, operational technology, and supply-chain terrain. Privacy is not among them, and that is the profile choice most worth examining on adoption — a laboratory with human-subjects data has a privacy obligation the archetype does not carry. Statutory availability is genuinely absent: research output rarely has a date in law attached, which is precisely why an availability score computed against this shape should not be compared with one computed against a benefits agency.
To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.
Carried byCUI Store (T5)
To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
Carried byLab Instruments (T6)
To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.
Carried byCollaboration Suite (T4)
The declaration is checked against the ground rather than trusted: every in-scope obligation above is carried by at least one element, and no element carries an obligation the profile omits. Adopting this shape means reviewing that declaration against your own estate — the profile that quietly omits an obligation you do incur is the one failure this mechanism can produce.
Its Typical Campaign Phase
Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
Typical, not permanent. A phase is declared against a scope and can be declared backwards without embarrassment; this is where a well-run estate of this shape sits when it is not in contact. The full entry and exit conditions are on the Shape phase page.
Which maneuvers matter most — 5 of eleven forms evidenced
Ranked by the weight of the ground evidencing each form, not by how many elements name it. The 3 explained below are the ones that decide how this shape is defended; the rest are present and secondary. A form this estate does not evidence at all is not necessarily wrong for it — it is ground the archetype does not yet stand on.
Ensure no single failure is decisive.
Depth is the only form that survives an estate this open. If the perimeter cannot be the control, then every layer behind it has to be one.
Force the adversary onto ground you own and watch.
Canalization is the archetype’s signature move and the second-heaviest in the estate. You cannot deny collaboration, so you shape where it can go — instruments on their own segment, controlled data behind a boundary a collaborator’s session simply does not cross.
Make identity, not network location, the decisive plane — surround the adversary with policy.
Envelopment is what makes federated identity survivable. Admitting external collaborators is safe only to the degree that a collaborator’s credential, on its own, buys nothing but the thing they came for.
Trade space for information and time, and impose cost.
Gain early warning and buy reaction time before the adversary touches key terrain.
Paths This Estate Declares Closed
This archetype draws none. That is a genuine finding rather than an omission: an estate with no declared denials has no tested claim about where an adversary cannot go, and adding the first two or three is usually the cheapest improvement available to a shape like this one.
The Estate as the Overlay Lays It Out
The tier bands the archetype ships with, top to bottom, with every element in each. 11 elements and 10 drawn paths in total.
Collaboration4 elements · 1 decisive
The Failure Modes Characteristic of This Shape
Not general bad practice. These are the ways a competent program built on this particular shape goes wrong while continuing to report that it is fine.
Openness is treated as a finding rather than as terrain.
- The tell
- The remediation plan proposes closing collaboration paths that the mission depends on, and has been rejected twice without being redrafted.
- The correction
- Re-score the collaboration surface as ground you hold rather than a gap you close. The measurable question is what a collaborator’s session can reach, not how many of them there are.
The instrument floor is left off the overlay because nobody owns it.
- The tell
- Instrument counts come from the facilities inventory rather than the terrain overlay, and no path connects them to enterprise ground.
- The correction
- FO-4 requires the connections declared, and the connections are the point. An air-gapped instrument network is a claim; the overlay is where the claim is tested against the engineering workstation that bridges it.