Cycle Execution and Assurance
Cadence, intelligence requirements, posture computation, the evidentiary record
The organization shall execute the full analytic cycle at a defined cadence and shall not allow the interval to lapse without recorded justification.
PurposeTo keep the loop turning, so that defensive posture is a maintained position rather than a periodic assessment.Activities10 · Metrics2Each cycle shall begin with a defined set of priority intelligence requirements that drive collection and hunting.
PurposeTo direct analytic effort at named questions, so that collection and hunting answer what the accountable authority needs rather than processing what arrives.Activities10 · Metrics2Analytic conclusions shall be recorded with an explicit confidence level and the basis for that confidence.
PurposeTo distinguish assessment from assertion, so that decisions taken on analytic conclusions carry the uncertainty of those conclusions with them.Activities10 · Metrics3Defensive coverage and residual risk shall be computed from asset weighting, layer maturity, and operational move mitigation, using a documented method.
PurposeTo produce a posture figure that can be reproduced and challenged rather than asserted, so that the number carries authority beyond the tool that generated it.Activities10 · Metrics3Identified gaps shall be ranked by the residual risk they retire per unit of effort, and shall be assigned owners and target dates.
PurposeTo make the backlog answer where the next hour of work goes, rather than enumerate everything wrong.Activities10 · Metrics3Each cycle shall be recorded with its posture result, and the trend across cycles shall be reported.
PurposeTo answer whether the program is improving — a question no point-in-time assessment can address.Activities10 · Metrics2Each cycle shall produce a brief recording terrain, decisive points, scheme of maneuver, posture, findings, and trend, distributed to the accountable authority.
PurposeTo produce one document per cycle that an Authorizing Official can decide from, rather than a dashboard nobody decides from.Activities10 · Metrics2