The Mission Shape
A small independent agency has real federal obligations and almost no capacity to discharge them directly. There is no security operations center, frequently no dedicated security staff at all, and the estate is largely operated by somebody else: a managed service provider running the edge and the endpoints, a software-as-a-service suite carrying email and documents, and one mission application that is the reason the agency exists.
The scarce resource is governance rather than technology. Almost everything on this estate could be well defended by the provider who runs it; whether it is depends entirely on whether the split of responsibility has been written down and taken up. That is why this archetype declares tenancy and inheritance as an obligation, and why the provider itself is marked key terrain.
This is a composite, not an organization. Nothing on this page measures an agency, and the criticality and exposure figures below are the archetype’s own — useful for comparing shapes, useless as a statement about anybody.
What its key terrain typically is — 4 of 9 elements
How to read it. Four marks on a nine-element estate — cloud identity, the mission application, the agency records, and the managed service provider. The provider being on that list is the archetype’s central claim: the organization with the most access to this estate does not work for the agency.
- T1Cloud IdentitySaaS IdP
- T4Mission Applicationsingle system
- T5Agency RecordsFOIA · mission
- T9Managed Service Provideroperates the estate
Key terrain is ground whose loss is decisive rather than merely expensive. Marking too much of an estate defeats the purpose: this archetype marks 44% of its elements, and an overlay that marks most of itself has not made a choice.
Which Terrain Layers Matter Most, and Why
The order and the shares are derived: each element’s weight is its criticality times its exposure, summed by layer and read against the estate’s total of 161. The explanations are written for the 3 layers that carry the shape.
The urban terrain. SaaS Suite, Mission Application.
The software-as-a-service suite and the single mission application carry the estate. Both are operated by somebody else, which means most of the defensive decisions available here are configuration and inheritance decisions rather than engineering ones.
The high ground. Cloud Identity.
The lines of communication. Managed Service Provider.
The managed service provider is key terrain because it operates the edge, the identity plane and the endpoints. The studio’s own label for it is “operates the estate” — no other supplier in the set is described that way — and no control this agency writes matters more than the one recording what that access reaches.
The corridors. Managed Edge.
Terrain that is also the force. All Staff.
The whole staff is one element, and it carries no forms of maneuver at all. That is not an omission — it is the archetype stating plainly that an agency of this size has no security function to assign work to, which is the fact the rest of the plan has to be built around.
The entry fords. Staff Laptops.
The objective. Agency Records.
The physical boundary. Single Office.
The federal-obligations profile — 3 declared, 3 out of scope
An obligation this estate does not incur is scored out of scope, not counted against it. That is the framework’s profile mechanism, and it is what stops an agency being marked down for failing to defend ground it does not hold.
Why this profile. Three declared: privacy terrain, tenancy and inheritance, and supply-chain terrain. This is the archetype the profile mechanism exists for. Operational technology, controlled unclassified information and a statutory availability floor are all scored out of scope, and if they were not, an agency with no security team of its own would carry three permanent findings for failing to defend ground it does not hold — while the obligation that actually matters to it, the inheritance boundary with its provider, competed for attention with them.
To make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.
Carried byAgency Records (T5)
To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.
Carried byManaged Edge (T3), SaaS Suite (T4), Managed Service Provider (T9)
To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
Not assessedNo element of this estate carries it, so it is not a finding, not a gap and not deferred work.
To discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.
Carried byManaged Edge (T3), Managed Service Provider (T9)
The declaration is checked against the ground rather than trusted: every in-scope obligation above is carried by at least one element, and no element carries an obligation the profile omits. Adopting this shape means reviewing that declaration against your own estate — the profile that quietly omits an obligation you do incur is the one failure this mechanism can produce.
Its Typical Campaign Phase
Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
Typical, not permanent. A phase is declared against a scope and can be declared backwards without embarrassment; this is where a well-run estate of this shape sits when it is not in contact. The full entry and exit conditions are on the Shape phase page.
Which maneuvers matter most — 2 of eleven forms evidenced
Ranked by the weight of the ground evidencing each form, not by how many elements name it. The 2 explained below are the ones that decide how this shape is defended; the rest are present and secondary. A form this estate does not evidence at all is not necessarily wrong for it — it is ground the archetype does not yet stand on.
Ensure no single failure is decisive.
Depth is the heavier of the only two forms this estate evidences, and most of it is inherited. The realistic version of depth here is checking which layers the provider already operates and taking up the ones nobody has.
Make identity, not network location, the decisive plane — surround the adversary with policy.
Envelopment on cloud identity is the single highest-value move available to this shape. It is configuration rather than construction, it does not need a security operations center, and it makes a stolen credential worth substantially less.
Paths This Estate Declares Closed
This archetype draws none. That is a genuine finding rather than an omission: an estate with no declared denials has no tested claim about where an adversary cannot go, and adding the first two or three is usually the cheapest improvement available to a shape like this one.
The Estate as the Overlay Lays It Out
The tier bands the archetype ships with, top to bottom, with every element in each. 9 elements and 9 drawn paths in total.
Managed Perimeter3 elements · 1 decisive
Records1 element · 1 decisive
- T5Agency RecordsFOIA · mission
The Failure Modes Characteristic of This Shape
Not general bad practice. These are the ways a competent program built on this particular shape goes wrong while continuing to report that it is fine.
The inheritance boundary is assumed rather than recorded.
- The tell
- Both the agency and the provider believe the other holds a control, and neither has written down which one.
- The correction
- FO-3 asks for the split recorded per element. The customer responsibilities nobody has taken up are the finding, and they are invisible until the split is on paper.
The framework is adopted at full weight and abandoned.
- The tell
- Seventy-eight controls are opened as a program, nothing closes, and the effort stops within two quarters.
- The correction
- Work the declared profile only, and inside it work the identity plane first. An estate evidencing two forms of maneuver well is in better shape than one with eleven partially attempted.