06 Assess — the operating loop

Purpose

Measure positional and temporal advantage, then decide: continue, exploit, or transition to a branch. Publish the product and turn the loop.

Output. A confidence-tagged product, and the next cycle’s framing.

The Doctrinal Step It Corresponds To

Produce · re-frame

Produce, and re-frame. The product is the point of the step; the re-frame is what makes the whole thing a loop rather than a reporting exercise. Doctrinally this is also where measures of performance and measures of effectiveness are separated and both are reported — a program that reports only performance can be extremely busy and losing.

Discussion

Assess computes the posture, ranks the backlog, decides what happens to each finding, closes the cycle record, publishes the brief, and hands the next cycle its framing. It is the longest step in the loop and the one most likely to be truncated when the cycle is late.

The distinction between measures of performance and measures of effectiveness is the whole reason the step exists in this form. Performance measures ask whether the maneuvers were executed correctly: how much key terrain sits behind a policy enforcement point, how fresh the overlay is, how many intelligence requirements were closed. Effectiveness measures ask whether executing them changed the outcome. Temporal advantage is the signature effectiveness measure, and it is the one capable of being lost.

Every finding leaves this step with a disposition — remediate, accept, or transfer — and an accepted risk carries a named accepter and an expiry. Acceptance without an expiry is not a decision; it is an amnesty, and it will be discovered in three years by someone who was not there.

The loop closes here or it does not close at all. The brief’s evidence feeds the defensive intent, surviving intelligence requirements are marked as carried forward, and the indicators produced at Fuse become next cycle’s collection. A brief that is distributed and never returns to the intent has produced a document rather than a cycle.

Entry and Exit Criteria

Authored for this manual. A step you cannot tell you have finished is not a step, and every criterion below is written so that it can be answered no.

Do Not Start Until

Fusion is closed and every conclusion carries a confidence level.
Coverage inputs are current: layer assignment, weighting, implementation state, validated effectiveness and reachability. A posture computed over stale inputs is precise and wrong.
The decision-loop measurement covers the whole period, not the portion for which timestamps happened to exist.
The dwell estimate has been restated for this cycle rather than carried forward silently.

The Step Is Finished When

Coverage and residual risk are computed over the whole overlay population, with planned and partial work discounted, and the denominator is stated.
Temporal advantage is reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met.
The remediation backlog is re-ranked, with decisive-point floor breaches above higher-volume lower-weight work.
Every finding has a disposition. Remediate with an owner and a date; accept with a named accepter and an expiry; transfer with the party named. "Under review" is not a disposition.
The cycle record is closed and the brief is distributed to the accountable authority and to whoever consumes it as continuous-monitoring evidence.
The next cycle’s framing exists: the brief’s evidence has been fed back to the intent, and surviving intelligence requirements are marked as carried forward with the reason.

Beyond repair. Assess has failed irrecoverably when the brief is accurate, well-received, and nothing in the next cycle is different because of it.

Who Takes Part

Leads: Governance / RMF / ISSO

Governance runs the cycle record and produces the brief, because the brief is also the continuous-monitoring evidence. The intelligence cell remains accountable for what the brief asserts; governance is accountable for the record being complete.

Participation below is derived from the RACI of this step’s own governing controls, not authored — a role appears at the strongest assignment it holds on any of them. The manual therefore cannot claim a role is uninvolved in a step whose controls give it work.

AccountableAuthorizing Official / CISO CE-4 · CE-5 · CE-6 · CE-7 · TA-1 · TA-3 · TA-5 · CG-4 · CG-5 · SM-6 · RC-5
ResponsibleCyber Threat Intelligence cell CE-7
ResponsibleSOC / Defensive Operations TA-1 · TA-5 · RC-5
ResponsibleHunt team SM-6
ConsultedPlatform and product owners CE-4 · CE-5 · TA-5 · CG-4 · CG-5 · RC-5
ResponsibleGovernance / RMF / ISSO CE-4 · CE-5 · CE-6 · TA-3 · CG-4 · CG-5

Inputs and Outputs

Every artifact links to its entry in the products index, where its owner, its consumers and its refresh cadence are set out.

Consumes

Fused assessmentWhat the cycle’s intelligence requirements returned: each answer graded for confidence and showing its working, and each requirement left unanswered recorded against the collection gap responsible.
Adversary dwell estimateThe estimated time an adversary could operate undetected in this estate, with its basis stated — measured dwell, sector reporting, or partner intelligence — and its bias acknowledged.
Defender decision loop measurementDetect to decide to contain, measured per incident from the change record’s timestamps and reported as a distribution rather than as a mean.
Implementation state recordPlanned, partial or operational, per maneuver assignment. The mechanism that stops intended work being counted as deployed protection.
Adversary reachability assessmentThe formal result: from each entry point, which decisive points are reachable over the permitted-path graph. The framework’s hardest single finding, and the headline of the brief when it changes.
Cyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
Maneuver effectiveness validation recordWhether the moves claiming operational status produced the effect the catalog assumed — from exercise results, control testing, and observed incident performance.
Reconstitution exercise reportWhat was rebuilt, from what media, in what time, verified how — and which recovery objectives were missed. Includes supplier severance scenarios.

Produces or Refreshes

Coverage and residual risk resultCoverage and residual risk computed over the whole overlay population, weighted by consequence, discounted by implementation state and corrected by validated effectiveness — with the denominator stated.
Bill of DefensePer mission service: the maneuvers and assets protecting it, its rolled-up coverage, and its residual risk. The view that lets a mission owner see their own defense rather than the enterprise average.
Temporal advantage resultDefender decision loop against adversary dwell, reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met. The framework’s single honest scoreboard.
Remediation backlogThe ranked list of what to fix, ordered by residual risk, main-effort weighting, and decisive-point floor breaches — which sit above higher-volume, lower-weight work regardless of count.
Findings disposition recordEvery finding with an outcome: remediate with an owner and a date, accept with a named accepter and an expiry, or transfer with the party named. “Under review” is not a disposition.
Cycle record and trendThe closed record of the cycle — posture, loop measurement, conclusions and their confidence, backlog state at close — and the trend across cycles that makes a second cycle worth more than a first.
Cycle briefThe published product: terrain, reachability, main effort, temporal advantage, coverage, trend, and the top-ranked backlog items — each confidence-tagged. Also the evidence that feeds the next intent.
Control inheritance mappingHow the cycle’s output maps onto the organization’s existing control baseline and assessment results, so that federal obligations are satisfied as a by-product of defending rather than as a parallel program.

The Controls That Govern This Step

A control may govern more than one step. Where it does, the note says which job it is doing here — the temporal-advantage control sets a threshold at Frame and reports against it at Assess, and they are not the same activity.

CE-4 Coverage and Residual Risk ComputationComputes coverage and residual risk over the whole overlay, discounting by implementation state and validated effectiveness.
CE-5 Remediation Backlog PrioritizationRanks the remediation backlog, with floor breaches and main-effort weighting applied.
CE-6 Cycle Record and TrendCloses the cycle record and carries the trend, which is what makes a second cycle worth more than a first.
CE-7 Brief Generation and DistributionGenerates and distributes the brief, and feeds its evidence back into the defensive intent.
TA-1 Decision Loop MeasurementReports the measured defender decision loop for the period.
TA-3 Temporal Advantage ThresholdReports temporal advantage against the threshold this cycle set at Frame. Same control, second job.
TA-5 Tempo Degradation TriggerReports whether tempo degraded, and against which trigger.
CG-4 Findings DispositionGives every finding a disposition, routed by the ownership recorded at Map.
CG-5 Control Inheritance MappingMaps the cycle’s output onto the existing control baseline, so compliance is produced as a by-product rather than as separate work.
SM-6 Maneuver Effectiveness ValidationFeeds corrected effectiveness values into the computation, so the posture reflects what the maneuvers do rather than what the catalog assumed.
RC-5 Reconstitution ExerciseReports reconstitution exercise results, including objectives that were missed.

Analytic Method

Measures of performance and effectiveness, reported separately

Joint assessment doctrine

Performance measures ask whether the maneuvers were done right; effectiveness measures ask whether doing them changed the outcome. Reporting them in one list lets a rising performance number conceal a falling effectiveness one, which is the failure mode most security dashboards are optimized to produce.

Trend on a stated denominator

Authored

Report every rate alongside the population it was computed over. Coverage that improved because the overlay shrank is the single easiest false positive in the whole framework, and stating the denominator is the entire defense against it.

Signpost review

ATP 2-33.4

Revisit the indicators set at Fuse: which fired, which did not, and what that says about the hypothesis they were attached to. Indicators that fire and change nothing are noise and should be retired explicitly.

Disposition with expiry

Authored

Every accepted risk carries a named accepter and a date on which the acceptance lapses and returns to the backlog. This is the only mechanism that stops the backlog being managed by attrition.

Common Failure Modes

Authored, and each one carries the observable tell that separates it from a step that is working. A list of failure modes with no tells is a list of anxieties.

The brief reports performance measures only.

The tell: Every number in it went up, and nothing in it could have gone down.
The correction: Lead the brief with temporal advantage against threshold. It is the measure capable of reporting that the program is busy and losing.

Residual risk is computed only over terrain that had data.

The tell: The population is not stated, and it is smaller than the overlay.
The correction: Compute over the full overlay and report unmeasured elements as unmeasured. An unmeasured element is a worse finding than a poorly-covered one and should not be quietly excluded.

Risks are accepted without expiry.

The tell: The backlog contains accepted items whose accepter has left the organization.
The correction: Expire acceptances by default. The item returns to the backlog and is re-accepted deliberately, or it is not.

Trend is reported on a moving denominator.

The tell: Coverage improved in a cycle where the overlay lost elements.
The correction: Report the denominator with every rate, and report overlay population as its own line.

The loop does not close.

The tell: The brief is distributed, the intent’s revision date does not move, and the next Frame reproduces the last one.
The correction: Make the feed from brief to intent an explicit step with an owner. A deliberate "no change to intent" is a valid outcome; an absent one is a broken loop.