ASOM-Fedv6.1Open the explorer
CG-2 · Command and Governance

Phase Declaration

Control Statement

The organization shall declare its current campaign phase, and shall align main effort and resourcing to it.

Purpose. To make "we are in Phase III" a sentence that changes behavior, rather than a label applied to a state of affairs.

Discussion

Phase declaration shares a failure mode with main effort designation: both are trivially satisfiable as labels and both are meaningless unless something downstream is keyed to them. The framework's design keys real consequences to phase — pre-authorized response sets widen (TA-4), session lifetimes shorten, dominant forms change, and resourcing shifts. If none of those change on transition, the declaration is a status field. The assessment therefore tests what changed, not what was declared.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

The current phase is declared and resourcing aligns to it.
  • Whether a current phase is declared and the date of declaration
  • Consistency between the declared phase and the designated main effort

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

AOCTISOCHUNTPLATISSO
Authorizing Official / CISO: AccountableCyber Threat Intelligence cell: ConsultedSOC / Defensive Operations: ConsultedHunt team: InformedPlatform and product owners: InformedGovernance / RMF / ISSO: Consulted

AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO

  • AccountableAuthorizing Official / CISO
  • ConsultedCyber Threat Intelligence cell
  • ConsultedSOC / Defensive Operations
  • InformedHunt team
  • InformedPlatform and product owners
  • ConsultedGovernance / RMF / ISSO

Inputs and Outputs

Consumes

Produces

Activities

  1. L2Declare the current campaign phase.
  2. L2Record the declaration with its date and the condition that triggered it.
  3. L2Score readiness against the phase's dominant forms.
  4. L3Define the entry and exit conditions for each phase, so transition is a recognizable event rather than a judgment call, and bind them to the declaration criteria under EN-1 so a declared incident meeting a phase entry condition routes to the transition decision rather than being handled locally.
  5. L3Key at least one consequential control to phase — pre-authorized response, session lifetime, or cadence — so declaration changes behavior.
  6. L3Align main effort (SM-4) and resourcing to the declared phase on transition.
  7. L3Communicate transition to everyone whose authority or task changes as a result.
  8. L4Measure what actually changed on the last transition — authorizations, allocations, configurations — and treat an empty answer as a finding.
  9. L4Trend time spent in each phase; a program permanently in Phase 0 has not implemented phasing.
  10. L5Revise phase entry conditions where transitions were repeatedly declared late relative to when contact began.

Measurement

Outcome

Number of consequential controls whose state changed on last transition.

Performance

Elapsed time from transition condition to declaration.

Evidence and Assessment

Evidence expected

Declared phase with trigger and date; phase readiness score; record of what changed on transition.

Assessment procedure

Examine the declaration and readiness score; interview on resourcing alignment; test what materially changed at the last transition.

Related Guidance

Inherits
  • PM-11
  • IR-4
  • CP-2
Satisfies
  • GV.RM-01
  • ID.IM-01

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Fed By

Nothing upstream — this control starts a chain.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.

Forms of Maneuver It Assesses

  • M6DelayBuy decision time and prevent the adversary culminating on the objective.2 of 10 techniques — M6.04, M6.08

Terrain It Is Named On

  • TXCross-CuttingPhase declaration, which changes what the rules of engagement permit without renegotiating them under contact.

Artifacts It Stands On

  • producesPhase declarationThe declared campaign phase and the scope it is declared against. Sets cadence, dominant forms of maneuver, and how wide the pre-authorization set runs.
  • consumesDefensive intent paragraphOne signed paragraph stating what the defense exists to protect, what may be degraded to protect it, and the acceptable risk. The commander’s-intent analog, and the citation every downstream designation rests on.
  • consumesAdversary reachability assessmentThe formal result: from each entry point, which decisive points are reachable over the permitted-path graph. The framework’s hardest single finding, and the headline of the brief when it changes.
  • consumesFused assessmentWhat the cycle’s intelligence requirements returned: each answer graded for confidence and showing its working, and each requirement left unanswered recorded against the collection gap responsible.
  • consumesCyber Running EstimateThe living situational picture the SOC, hunt and intelligence cell share: current posture, current assessments and their confidence, open requirements, and what has moved since the last look.
  • consumesIndicators and signpostsFor each surviving hypothesis, the observable events that would confirm or kill it, handed to collection. The mechanism that makes this cycle’s analysis into next cycle’s requirements.
  • consumesHunt results, including negative resultsWhat was hunted, how, and what was not found. Negative results are the half most often discarded, and they are the half that says what has actually been cleared.

Roles It Puts to Work