ASOM-Fedv6.1Open the explorer
CE-5 · Cycle Execution and Assurance

Remediation Backlog Prioritization

Control Statement

Identified gaps shall be ranked by the residual risk they retire per unit of effort, and shall be assigned owners and target dates.

Purpose. To make the backlog answer where the next hour of work goes, rather than enumerate everything wrong.

Discussion

Ranking by risk alone produces a backlog headed by items nobody can afford; ranking by effort alone produces a quarter of completed busywork with the risk position unchanged. The ratio is the whole point, and it is also the part most often dropped in implementation, because effort estimates are uncomfortable to produce and easy to omit. A backlog with risk scores and no effort estimates has not implemented this control.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

The backlog is ranked and owned.
  • Percentage of backlog items with a named owner and a target date
  • Residual risk retired per cycle
Ranking drives sequence.
  • Correlation between item rank and the order in which items were actually completed

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

AOCTISOCHUNTPLATISSO
Authorizing Official / CISO: AccountableCyber Threat Intelligence cell: InformedSOC / Defensive Operations: ConsultedHunt team: InformedPlatform and product owners: ConsultedGovernance / RMF / ISSO: Responsible

AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO

  • AccountableAuthorizing Official / CISO
  • InformedCyber Threat Intelligence cell
  • ConsultedSOC / Defensive Operations
  • InformedHunt team
  • ConsultedPlatform and product owners
  • ResponsibleGovernance / RMF / ISSO

Inputs and Outputs

Consumes

Produces

Activities

  1. L2Record identified gaps as a backlog.
  2. L2Estimate the residual risk each gap retires if closed.
  3. L2Assign an owner and a target date to each item.
  4. L3Estimate the effort each item requires, on a defined scale, so the ratio can be computed rather than intuited.
  5. L3Rank by risk retired per unit of effort and publish the ranking basis.
  6. L3Reconcile ownership against terrain ownership (TM-7), so backlog items land on people who already hold the ground.
  7. L3Re-rank each cycle from current figures rather than preserving a stale order.
  8. L4Measure realized risk retirement against estimate for completed items, and correct the estimation method where it is systematically optimistic.
  9. L4Trend backlog age by rank band; high-ranked items ageing indicates the ranking is not driving allocation.
  10. L5Feed completion data back into effort estimation, so the ratio improves in accuracy as the program accumulates history.

Measurement

Outcome

Residual risk retired per cycle.

Performance

Median age of items in the top rank band.

Evidence and Assessment

Evidence expected

Ranked backlog with owners, target dates, effort estimates and ranking basis.

Assessment procedure

Examine the ranking basis; test progress against target dates; examine whether effort estimates exist at all for the top-ranked items.

Related Guidance

Inherits
  • CA-5
  • RA-7
  • PM-4
Satisfies
  • ID.RA-06
  • ID.IM-02
  • GV.RM-06

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.

Forms of Maneuver It Assesses

  • M7CounterattackSeize the initiative and evict before the adversary reaches the objective.2 of 17 techniques — M7.02, M7.09
  • M9Spoiling AttackDisrupt adversary staging before the attack is launched.2 of 9 techniques — M9.02, M9.07
  • M10Exploitation & PursuitConvert contact into durable advantage rather than closing the ticket.1 of 7 techniques — M10.01

Terrain It Is Named On

Applies to all ten layersTurns weight multiplied by coverage gap into a ranked backlog, which is what the layer’s numbers are for.

Artifacts It Stands On

  • producesRemediation backlogThe ranked list of what to fix, ordered by residual risk, main-effort weighting, and decisive-point floor breaches — which sit above higher-volume, lower-weight work regardless of count.
  • consumesDecisive point registerThe elements whose control confers decisive advantage — each carrying the evidence that raised it above merely important, and the protection floor it owes as a result.
  • consumesScheme of maneuverOne graphic and one narrative: which forms of maneuver are sited where, in what sequence. The assignment record behind it carries the element, the avenue and the implementation state for every move.
  • consumesMain effort designationThe single designated main effort for the cycle, and the sentence citing the decisive point that justifies it. The answer to which work wins when two things need the same engineer.
  • consumesChange recordEvery defensive action carried out, stamped twice — at the decision and at the effect. A thin, unglamorous table, and the one the headline metric is computed from.
  • consumesImplementation state recordPlanned, partial or operational, per maneuver assignment. The mechanism that stops intended work being counted as deployed protection.
  • consumesCyber Running EstimateThe living situational picture the SOC, hunt and intelligence cell share: current posture, current assessments and their confidence, open requirements, and what has moved since the last look.
  • consumesCoverage and residual risk resultCoverage and residual risk computed over the whole overlay population, weighted by consequence, discounted by implementation state and corrected by validated effectiveness — with the denominator stated.
  • consumesBill of DefensePer mission service: the maneuvers and assets protecting it, its rolled-up coverage, and its residual risk. The view that lets a mission owner see their own defense rather than the enterprise average.

Roles It Puts to Work