Six Steps, and the Criteria That Say When Each One Is Finished.
The framework page describes the loop. This is the part you run it from. Each step carries what it needs to begin, what has to be true before it can end, who leads it and who takes part, the artifacts it consumes and produces, the controls that govern it, the analytic techniques it uses, and the ways it fails — written honestly, each with the observable tell that distinguishes a failing step from a working one.
Frame, Map, Array, Maneuver, Fuse, Assess — And Back to Frame.
The loop is drawn as a sequence that returns rather than as a ring, because Frame genuinely is where a cycle begins and Assess genuinely is what re-enters it. The return arc is the whole claim: the loop is meant to close faster than the adversary can adapt.
The ASOM Cycle
Frame
Screen · Analytic Design step 1
Map
Cyber Preparation of the Environment — the IPB analog
Array
Design the scheme
Maneuver
Execute
Fuse
Analyze · Integrate
Assess
Produce · re-frame
↺ Re-frame — the loop turns faster than the adversary adapts
Each Step, and What It Is Held To.
Entry and exit criteria are authored rather than inherited from doctrine. They are written to be capable of failing — “the overlay is refreshed” is not an exit criterion; “every element carries a layer, a weight and a named owner” is.
Refresh the terrain overlay, enumerate avenues of approach, and build threat courses of action: most likely and most dangerous.
OutputA terrain overlay and a threat COA sketch.LeadsCTI · 4 entry criteria, 6 exit criteria, 5 named failure modesChoose the forms of maneuver, designate the main and supporting efforts, site obstacles at decisive points, and pre-plan branches and sequels.
OutputThe scheme of maneuver — one graphic and one narrative.LeadsSOC · 5 entry criteria, 6 exit criteria, 5 named failure modesApply structured analytic techniques to what came back: competing hypotheses on adversary intent, a key-assumptions check, indicators and signposts. Assign explicit confidence.
OutputA fused assessment feeding the Cyber Running Estimate.LeadsCTI · 4 entry criteria, 6 exit criteria, 5 named failure modesMeasure positional and temporal advantage, then decide: continue, exploit, or transition to a branch. Publish the product and turn the loop.
OutputA confidence-tagged product, and the next cycle’s framing.LeadsISSO · 4 entry criteria, 6 exit criteria, 5 named failure modesThe Loop Is Not the Campaign.
Frameworks that collapse the two end up describing an annual process, which is precisely the failure this framework exists to correct.
The Operating Loop
Six steps that turn continuously, and are meant to turn faster than the adversary can adapt. Cadence is measured in weeks in garrison and in hours under contact. Every turn produces a brief and re-frames the next turn.
The Campaign
Six phases that move over months, each with its own main effort, its own cadence and its own width of authority. The phase declaration is what changes how fast the loop is expected to turn. The phases, at depth →
Every Step Consumes Artifacts and Emits Artifacts.
The products index enumerates all 61 of them, with what produces each one, who is accountable for it, which controls consume it and how often it has to be refreshed — derived from the controls’ own declared inputs and outputs wherever the chain states them.