ASOM-Fedv6.1Open the explorer
Step 03 of 6 · Design the scheme

Array

Purpose

Choose the forms of maneuver, designate the main and supporting efforts, site obstacles at decisive points, and pre-plan branches and sequels.

Output. The scheme of maneuver — one graphic and one narrative.

The Doctrinal Step It Corresponds To

Design the scheme

Array is course-of-action development: the step where the framework stops describing the ground and commits force to it. In maneuver terms it produces the scheme — which forms of maneuver, sited where, in what sequence, with one main effort and pre-planned branches. The forms themselves are durable; the techniques that implement them are not, which is the reason a leader can direct a scheme without being an engineer.

Discussion

A scheme of maneuver names a sequence and one main effort. It is not a checklist of all eleven forms. The most common artifact submitted as a scheme is a matrix in which every form has been assigned somewhere — which is a statement that nothing has priority, produced at considerable effort.

The main effort is the load-bearing designation. It is the answer to "if two things need the same engineer this month, which one gets them", and it has to be decidable from the artifact by someone who was not in the room. Two main efforts is none.

Array is also where the plan for being wrong is written. Branches are the pre-planned responses to the most-dangerous course of action, and each one needs an authority level attached at the same time it is written. A branch with no authority executes at the speed of a phone call, which in practice means it does not execute during the window in which it would have mattered.

Implementation state is not a formality here. A maneuver assignment can be planned, partial or operational, and only operational assignments claim full credit downstream. Programs that skip this find their coverage number rising in cycles during which nothing was deployed.

Entry and Exit Criteria

Authored for this manual. A step you cannot tell you have finished is not a step, and every criterion below is written so that it can be answered no.

Do Not Start Until

  • Map is closed: decisive points designated, avenues enumerated, reachability tested or explicitly gapped.
  • The maneuver catalog has been adopted, with each form’s assumed effectiveness recorded so it can later be validated rather than assumed forever.
  • The campaign phase is declared. Phase determines which forms dominate, and arraying without it produces a garrison scheme regardless of the situation.
  • Decisive-point protection floors are known, so the scheme has a stated minimum rather than an aspiration.
  • Recovery objectives per mission service are current. Arraying the defense without arraying the reconstitution is planning for every outcome except the one that ends the campaign.

The Step Is Finished When

  • Exactly one main effort is designated, with the reason written down in a sentence that cites a decisive point.
  • Every enumerated avenue of approach carries either an assigned maneuver or an explicit, dated risk acceptance. Silence on an avenue is not acceptance; it is an omission that will read as acceptance at the next audit.
  • Every assignment carries an implementation state, and planned and partial work is discounted in every downstream number.
  • At least one branch and one sequel are pre-planned against the most-dangerous course of action.
  • Every branch action has an authority level recorded, and the actions that must execute inside the decision window are pre-authorized rather than escalated.
  • The scheme exists as one graphic and one narrative. If it cannot be drawn on a page it will not be recalled under contact, and the page is the deliverable.

Beyond repair. Array has failed irrecoverably when the scheme is approved and the people who will execute it cannot say which part of it is the main effort.

Who Takes Part

Leads: SOC / Defensive Operations

Defensive operations design the scheme with platform owners, because obstacles are emplaced on somebody’s ground and the owner of that ground has to be the one who sites them. The intelligence cell advises; the Authorizing Official designates the main effort.

Participation below is derived from the RACI of this step’s own governing controls, not authored — a role appears at the strongest assignment it holds on any of them. The manual therefore cannot claim a role is uninvolved in a step whose controls give it work.

  • AccountableAuthorizing Official / CISO SM-1 · SM-2 · SM-3 · SM-4 · SM-5 · KT-2 · KT-5 · CG-3 · TA-4 · RC-1 · RC-3
  • ResponsibleCyber Threat Intelligence cell SM-5
  • ConsultedSOC / Defensive Operations SM-1 · SM-2 · SM-3 · SM-4 · SM-5 · KT-2 · KT-5 · CG-3 · TA-4 · RC-1 · RC-3
  • ConsultedHunt team SM-5
  • ResponsiblePlatform and product owners SM-2 · SM-3 · KT-2 · KT-5 · RC-1 · RC-3
  • ResponsibleGovernance / RMF / ISSO SM-1 · CG-3

Inputs and Outputs

Every artifact links to its entry in the products index, where its owner, its consumers and its refresh cadence are set out.

Consumes

  • Cyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
  • Decisive point registerThe elements whose control confers decisive advantage — each carrying the evidence that raised it above merely important, and the protection floor it owes as a result.
  • Avenue-of-approach analysisThe enumerated routes an adversary could take toward each decisive point, including physical, supplier and maintenance routes, with unassessed routes recorded as intelligence gaps rather than as absence of risk.
  • Adversary reachability assessmentThe formal result: from each entry point, which decisive points are reachable over the permitted-path graph. The framework’s hardest single finding, and the headline of the brief when it changes.
  • Threat course-of-action sketchTwo courses of action, most likely and most dangerous, drawn against the decisive points already designated. Each is a route across ground the estate really has, not a category of threat.
  • Adopted maneuver catalogThe forms of defensive maneuver the organization has adopted, each with the effectiveness it is assumed to deliver — recorded so the assumption can later be validated rather than believed indefinitely.
  • Defensive intent paragraphOne signed paragraph stating what the defense exists to protect, what may be degraded to protect it, and the acceptable risk. The commander’s-intent analog, and the citation every downstream designation rests on.
  • Phase declarationThe declared campaign phase and the scope it is declared against. Sets cadence, dominant forms of maneuver, and how wide the pre-authorization set runs.
  • Recovery objectives registerA declared recovery time and recovery point objective per mission service, agreed with the service owner and constrained by statutory deadlines rather than by what is currently achievable.

Produces or Refreshes

  • Adopted maneuver catalogThe forms of defensive maneuver the organization has adopted, each with the effectiveness it is assumed to deliver — recorded so the assumption can later be validated rather than believed indefinitely.
  • Scheme of maneuverOne graphic and one narrative: which forms of maneuver are sited where, in what sequence. The assignment record behind it carries the element, the avenue and the implementation state for every move.
  • Main effort designationThe single designated main effort for the cycle, and the sentence citing the decisive point that justifies it. The answer to which work wins when two things need the same engineer.
  • Branch and sequel planThe branches answer the most-dangerous course of action; the sequels answer success. Every one names the authority it needs, and any expected to run inside the decision window is pre-authorized when it is written.
  • Rules of engagementWhich defensive actions may be taken by whom without escalation, which need the Authorizing Official, and what is prohibited outright. The cyber analog of engagement authority, and the single largest determinant of tempo.
  • Pre-authorized response setThe specific containment and response actions the SOC may execute at machine speed, bounded by the statutory availability floor. Directly measurable: it shortens the decision segment of the defender loop.
  • Trusted rebuild pathA documented, walked path to rebuild each decisive point inside its recovery time budget, from media held outside the production identity plane — including a path for the identity plane itself.

The Controls That Govern This Step

A control may govern more than one step. Where it does, the note says which job it is doing here — the temporal-advantage control sets a threshold at Frame and reports against it at Assess, and they are not the same activity.

Analytic Method

Wargaming — action, reaction, counteraction

Army planning

Play the scheme against both courses of action, one bound at a time: defender action, adversary reaction, defender counteraction. The output is the branch list. Most branches worth having are discovered in the second bound.

Premortem

ATP 2-33.4 · contrarian technique

Assert that the main effort failed six months from now and work backwards to why. It surfaces the dependency nobody wanted to raise while the scheme still had momentum.

Devil’s advocacy on the load-bearing barrier

ATP 2-33.4 · contrarian technique

Take the single barrier the reachability result depends on most and argue that it does not hold. In federal estates this is usually a segmentation boundary or a conditional-access policy, and it is usually assumed rather than tested.

Common Failure Modes

Authored, and each one carries the observable tell that separates it from a step that is working. A list of failure modes with no tells is a list of anxieties.

Every form of maneuver is assigned somewhere.

The tell
The scheme has no sequence and no main effort — it is the catalog with checkmarks.
The correction
Require the scheme to be stated as an ordered sequence of forms with one main effort. A form that does not appear in the sequence is not in the scheme this cycle, and saying so is the point.

The main effort follows the budget rather than the decisive point.

The tell
The designated main effort is whichever program already had funding.
The correction
Designate from the decisive-point register and then argue about resourcing separately. Reversing the order makes the framework a justification layer.

Branches are written without authority.

The tell
Branches exist in the scheme with no matching entry in the rules of engagement.
The correction
No branch leaves Array without an authority level. If the level is “Authorizing Official”, state the expected approval latency next to it so the plan is honest about its own tempo.

Planned work is counted as coverage.

The tell
Coverage rose in a cycle in which nothing reached production.
The correction
Discount by implementation state at the point of computation, not by convention. The control exists precisely because the convention erodes.

Reconstitution is arrayed last or not at all.

The tell
A designated decisive point has no trusted rebuild path, or has one that has never been walked.
The correction
Treat a decisive point without a rebuild path as a floor breach. Recovery capability that is first exercised during an incident is a plan, not a capability.