ASOM-Fedv6.1Open the explorer
CG-4 · Command and Governance

Findings Disposition

Control Statement

Findings raised by architectural review shall be dispositioned as remediated, accepted with justification, or transferred, within a defined period.

Purpose. To ensure every finding reaches a decision, so that the open set reflects work in progress rather than accumulated neglect.

Discussion

Acceptance is where this control is defeated. A finding accepted permanently, by someone without the authority to accept it, disappears from view while the risk remains — and a program with a large accepted set can report a small open set indefinitely. Two requirements close that: acceptance must be by a person whose risk authority covers the exposure, and it must expire, forcing periodic re-decision rather than one-time disposal.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Findings are dispositioned within the defined period.
  • Percentage of findings dispositioned within the defined period
  • Age of the oldest undispositioned finding
Acceptance is deliberate.
  • Number of accepted findings carrying a written justification and a named accepting authority

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

AOCTISOCHUNTPLATISSO
Authorizing Official / CISO: AccountableCyber Threat Intelligence cell: InformedSOC / Defensive Operations: InformedHunt team: InformedPlatform and product owners: ConsultedGovernance / RMF / ISSO: Responsible

AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO

  • AccountableAuthorizing Official / CISO
  • InformedCyber Threat Intelligence cell
  • InformedSOC / Defensive Operations
  • InformedHunt team
  • ConsultedPlatform and product owners
  • ResponsibleGovernance / RMF / ISSO

Inputs and Outputs

Consumes

Produces

Activities

  1. L2Record every finding with its source and date.
  2. L2Disposition each as remediated, accepted with justification, or transferred.
  3. L2Define the period within which disposition must occur.
  4. L3Require acceptance to be made by a person whose risk authority covers the exposure, recorded by name.
  5. L3Give every acceptance an expiry, after which it returns for re-decision rather than persisting.
  6. L3Record for transferred findings who received them and their acknowledgment.
  7. L3Escalate findings exceeding the disposition period rather than ageing them.
  8. L4Trend the accepted set alongside the open set, since a shrinking open set and a growing accepted set is not improvement.
  9. L4Measure re-decision outcomes on expiry — acceptances renewed without change indicate risk being deferred rather than managed.
  10. L5Feed recurring finding types back into the control that generates them, since a finding class that keeps recurring is a design problem rather than a remediation backlog.

Measurement

Outcome

Percentage of findings dispositioned within the defined period.

Performance

Ratio of accepted to remediated dispositions, trended.

Evidence and Assessment

Evidence expected

Findings register with disposition, dates, named acceptors and expiries; transfer acknowledgments.

Assessment procedure

Examine open findings against the defined period; test the justification recorded for accepted risks; test whether acceptors held authority covering the exposure.

Related Guidance

Inherits
  • CA-5
  • CA-7
  • RA-7
Satisfies
  • ID.IM-02
  • GV.RM-03

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.

Forms of Maneuver It Assesses

  • M7CounterattackSeize the initiative and evict before the adversary reaches the objective.2 of 17 techniques — M7.07, M7.15
  • M9Spoiling AttackDisrupt adversary staging before the attack is launched.2 of 9 techniques — M9.02, M9.07
  • M1Screen / GuardGain early warning and buy reaction time before the adversary touches key terrain.1 of 15 techniques — M1.07
  • M2Defense in DepthEnsure no single failure is decisive.1 of 18 techniques — M2.11
  • M3EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy.1 of 20 techniques — M3.14
  • M8Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open.1 of 17 techniques — M8.11

Terrain It Is Named On

  • TXCross-CuttingFindings disposition, which is what stops governance maturity from being a documentation exercise.

Artifacts It Stands On

  • producesFindings disposition recordEvery finding with an outcome: remediate with an owner and a date, accept with a named accepter and an expiry, or transfer with the party named. “Under review” is not a disposition.
  • consumesTemporal advantage thresholdThe number the cycle will be judged against: defender decision loop versus adversary dwell, stated with units before the cycle runs.
  • consumesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
  • consumesDecisive point registerThe elements whose control confers decisive advantage — each carrying the evidence that raised it above merely important, and the protection floor it owes as a result.
  • consumesTemporal advantage resultDefender decision loop against adversary dwell, reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met. The framework’s single honest scoreboard.
  • consumesRemediation backlogThe ranked list of what to fix, ordered by residual risk, main-effort weighting, and decisive-point floor breaches — which sit above higher-volume, lower-weight work regardless of count.

Roles It Puts to Work