ASOM-Fedv6.1Open the explorer
CE-7 · Cycle Execution and Assurance

Brief Generation and Distribution

Control Statement

Each cycle shall produce a brief recording terrain, decisive points, scheme of maneuver, posture, findings, and trend, distributed to the accountable authority.

Purpose. To produce one document per cycle that an Authorizing Official can decide from, rather than a dashboard nobody decides from.

Discussion

Generation and distribution are the easy halves; use is the control's actual object. A Brief that is produced, distributed and never decided from satisfies every literal reading of the requirement and delivers nothing, which is why the assessment interviews recipients rather than examining distribution lists. The Brief is also the framework's compliance exhaust: because each section cites the controls it evidences, a retained series of Briefs is the FISMA continuous-monitoring record, produced as a by-product of defending.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

A brief is produced and reaches the accountable authority every cycle.
  • Number of cycles producing a brief, and the interval from cycle close to distribution
  • Number of decisions recorded as arising from the brief

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

AOCTISOCHUNTPLATISSO
Authorizing Official / CISO: AccountableCyber Threat Intelligence cell: ResponsibleSOC / Defensive Operations: ConsultedHunt team: InformedPlatform and product owners: InformedGovernance / RMF / ISSO: Consulted

AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO

  • AccountableAuthorizing Official / CISO
  • ResponsibleCyber Threat Intelligence cell
  • ConsultedSOC / Defensive Operations
  • InformedHunt team
  • InformedPlatform and product owners
  • ConsultedGovernance / RMF / ISSO

Inputs and Outputs

Consumes

Produces

Activities

  1. L2Generate a Brief each cycle covering terrain, decisive points, scheme of maneuver, posture, findings and trend.
  2. L2Distribute it to the accountable authority.
  3. L2Retain it as the cycle record.
  4. L3Cite in each section the controls it evidences, so the Brief serves as assessment evidence without separate authoring.
  5. L3Head the Brief with the defensive intent (CG-1) and the declared phase (CG-2), so posture is read against stated purpose.
  6. L3State confidence on assessments carried into the Brief, consistent with CE-3.
  7. L3Record the decisions taken from each Brief, so use is evidenced rather than assumed.
  8. L4Measure the proportion of Briefs from which a recorded decision followed.
  9. L4Measure elapsed time from cycle completion to distribution, since a Brief arriving after the situation has moved is a historical document.
  10. L5Revise Brief content from what recipients actually decided from, removing sections that have never informed a decision.

Measurement

Outcome

Percentage of Briefs from which a recorded decision followed.

Performance

Elapsed time from cycle completion to distribution.

Evidence and Assessment

Evidence expected

Generated Briefs, dated and retained, with control citations; decision records.

Assessment procedure

Examine retained briefs; interview recipients on receipt and use; test whether a decision is recorded against a sample of Briefs.

Related Guidance

Inherits
  • CA-7
  • PM-31
  • PL-2
Satisfies
  • GV.OV-01
  • ID.IM-03

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.

Forms of Maneuver It Assesses

  • M9Spoiling AttackDisrupt adversary staging before the attack is launched.1 of 9 techniques — M9.04
  • M10Exploitation & PursuitConvert contact into durable advantage rather than closing the ticket.1 of 7 techniques — M10.05

Terrain It Is Named On

  • TXCross-CuttingBrief generation and distribution is how the running estimate reaches the authority that can act on it.

Artifacts It Stands On

  • producesCycle briefThe published product: terrain, reachability, main effort, temporal advantage, coverage, trend, and the top-ranked backlog items — each confidence-tagged. Also the evidence that feeds the next intent.
  • consumesTemporal advantage thresholdThe number the cycle will be judged against: defender decision loop versus adversary dwell, stated with units before the cycle runs.
  • consumesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
  • consumesAdversary reachability assessmentThe formal result: from each entry point, which decisive points are reachable over the permitted-path graph. The framework’s hardest single finding, and the headline of the brief when it changes.
  • consumesMain effort designationThe single designated main effort for the cycle, and the sentence citing the decisive point that justifies it. The answer to which work wins when two things need the same engineer.
  • consumesCyber Running EstimateThe living situational picture the SOC, hunt and intelligence cell share: current posture, current assessments and their confidence, open requirements, and what has moved since the last look.
  • consumesHunt results, including negative resultsWhat was hunted, how, and what was not found. Negative results are the half most often discarded, and they are the half that says what has actually been cleared.
  • consumesCoverage and residual risk resultCoverage and residual risk computed over the whole overlay population, weighted by consequence, discounted by implementation state and corrected by validated effectiveness — with the denominator stated.
  • consumesBill of DefensePer mission service: the maneuvers and assets protecting it, its rolled-up coverage, and its residual risk. The view that lets a mission owner see their own defense rather than the enterprise average.
  • consumesTemporal advantage resultDefender decision loop against adversary dwell, reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met. The framework’s single honest scoreboard.
  • consumesCycle record and trendThe closed record of the cycle — posture, loop measurement, conclusions and their confidence, backlog state at close — and the trend across cycles that makes a second cycle worth more than a first.

Roles It Puts to Work