ASOM-Fedv6.1Open the explorer
CE-1 · Cycle Execution and Assurance

Cycle Cadence

Control Statement

The organization shall execute the full analytic cycle at a defined cadence and shall not allow the interval to lapse without recorded justification.

Purpose. To keep the loop turning, so that defensive posture is a maintained position rather than a periodic assessment.

Discussion

The cycle is the first thing sacrificed when the SOC is busy, and the SOC is busy precisely when the cycle would be most valuable. That inversion is the failure mode this control exists to catch. A lapse is also invisible by default — nothing alerts when a cadence quietly stretches from monthly to quarterly, and a program can discover it only by looking at dates it has no reason to look at. Requiring a recorded justification makes the lapse an event rather than an absence.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

The cycle runs at its declared cadence.
  • Number of cycles executed against number scheduled
  • Longest interval between consecutive cycles in the period

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

AOCTISOCHUNTPLATISSO
Authorizing Official / CISO: AccountableCyber Threat Intelligence cell: ResponsibleSOC / Defensive Operations: ConsultedHunt team: InformedPlatform and product owners: InformedGovernance / RMF / ISSO: Consulted

AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO

  • AccountableAuthorizing Official / CISO
  • ResponsibleCyber Threat Intelligence cell
  • ConsultedSOC / Defensive Operations
  • InformedHunt team
  • InformedPlatform and product owners
  • ConsultedGovernance / RMF / ISSO

Inputs and Outputs

Consumes

Produces

Activities

  1. L2Execute the full analytic cycle and record its date and phase.
  2. L2Define the cadence at which the cycle is expected to run.
  3. L2Maintain a cycle history from which the interval can be read.
  4. L3State the rationale for the interval, so it can be challenged rather than inherited.
  5. L3Record a justification for any interval that exceeds the cadence, naming who accepted the lapse.
  6. L3Define which steps of the cycle may be abbreviated under load and which may not, so pressure produces a known degradation rather than an ad hoc one.
  7. L3Separate cycle execution ownership from incident response ownership where staffing permits, so the two do not compete for the same people.
  8. L4Trend the actual interval against the defined cadence and escalate a sustained overrun rather than a single one.
  9. L4Correlate lapses against incident load, since a cadence that holds only in quiet periods is not a cadence.
  10. L5Adjust the cadence from measured estimate drift — if the terrain and threat picture move faster than the interval assumes, the interval is wrong.

Measurement

Outcome

Percentage of intervals meeting the defined cadence.

Performance

Median interval between completed cycles.

Evidence and Assessment

Evidence expected

Cycle history with dates and phase; lapse justifications with named acceptor.

Assessment procedure

Examine cycle records against the defined cadence; examine whether lapses cluster against periods of high incident load.

Related Guidance

Inherits
  • CA-7
  • PM-31
Satisfies
  • ID.IM-03
  • GV.OV-01

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.

Forms of Maneuver It Assesses

  • M8Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open.1 of 17 techniques — M8.12
  • M11ReconstitutionRestore the mission on evidence, not on hope — and prove it before you need it.1 of 11 techniques — M11.07

Terrain It Is Named On

  • TXCross-CuttingCycle cadence is the clock all three enablers are measured against.

Artifacts It Stands On

  • producesCycle cadence and calendarThe declared length of a cycle, its close date, and the refresh intervals that inherit from it. Makes “per cycle” a measurable unit rather than a figure of speech.
  • consumesDefensive intent paragraphOne signed paragraph stating what the defense exists to protect, what may be degraded to protect it, and the acceptable risk. The commander’s-intent analog, and the citation every downstream designation rests on.
  • consumesPhase declarationThe declared campaign phase and the scope it is declared against. Sets cadence, dominant forms of maneuver, and how wide the pre-authorization set runs.

Roles It Puts to Work