01 Frame — the operating loop

Purpose

State the defensive intent, set Priority Cyber Intelligence Requirements, and define what positional advantage means for this cycle.

Output. An intent paragraph and a PCIR list.

The Doctrinal Step It Corresponds To

Screen · Analytic Design step 1

Screen, in ATP 2-33.4, is the step where an analyst decides what is worth looking at before looking at it. Analytic Design step 1 is the statement of the problem — audience, questions, sources, method, product, schedule. Frame is both at once: the commander states what the defense is for this cycle, and the intelligence cell converts that statement into a small number of questions the cycle will actually try to answer.

Discussion

Frame produces two things and refuses to produce more: one paragraph of defensive intent, and a short list of Priority Cyber Intelligence Requirements. Both are deliberately small. An intent paragraph that runs to a page is a strategy document, and nobody recalls a strategy document under contact. A list of twenty intelligence requirements is a wish list, because a cycle can only close a handful and the rest quietly become permanent.

The hard part of Frame is not writing the intent. It is naming the acceptable risk inside it. An intent paragraph that only says what must be protected has not made a decision — everything must be protected, which is the same as nothing being the main effort. The paragraph earns its place when it names something that may be degraded, and the Authorizing Official signs that sentence too.

Frame is also where the cycle acquires a clock. The cadence, the close date, and the temporal-advantage threshold are set here, before anyone knows what the cycle will find. Setting the threshold afterwards is how a program discovers it was always meeting its target.

Entry and Exit Criteria

Authored for this manual. A step you cannot tell you have finished is not a step, and every criterion below is written so that it can be answered no.

Do Not Start Until

The previous cycle’s brief has been distributed and its findings have a disposition. A cycle that opens before the last one closed inherits an unbounded backlog and cannot report trend.
The Authorizing Official is available to sign within the framing window. Intent that is drafted but unsigned is not intent, and every downstream designation that cites it is citing a draft.
The campaign phase is declared, or declaring it is on this Frame’s agenda. Cadence depends on phase, so the order is not optional.
The statutory availability floor is current, and whoever will write the acceptable-risk sentence has read it.

The Step Is Finished When

A defensive intent paragraph exists, is signed, and names both what must be protected and what may be degraded to protect it.
Between three and seven Priority Cyber Intelligence Requirements are recorded. Each names the decision it informs and the collection source expected to answer it. A requirement that informs no decision is a research topic and belongs somewhere else.
Each requirement has a named owner inside the intelligence cell — a person, not a team.
The temporal-advantage threshold for this cycle is stated as a number with units, not as a direction of travel.
The cycle’s cadence and close date are on a calendar that other people can see.

Beyond repair. Frame has failed irrecoverably when the paragraph is signed but nobody outside the room that wrote it could state what the main effort is.

Who Takes Part

Leads: Cyber Threat Intelligence cell

The intelligence cell drafts and runs Frame; the Authorizing Official decides it. The distinction matters — an intent paragraph written by the people who will be measured against it drifts toward the achievable.

Participation below is derived from the RACI of this step’s own governing controls, not authored — a role appears at the strongest assignment it holds on any of them. The manual therefore cannot claim a role is uninvolved in a step whose controls give it work.

AccountableAuthorizing Official / CISO CG-1 · CG-2 · CE-1 · CE-2 · TA-3 · FO-5
ResponsibleCyber Threat Intelligence cell CE-1 · CE-2
ConsultedSOC / Defensive Operations CG-2 · CE-1 · CE-2 · TA-3 · FO-5
ConsultedHunt team CE-2
ConsultedPlatform and product owners FO-5
ResponsibleGovernance / RMF / ISSO TA-3 · FO-5

Inputs and Outputs

Every artifact links to its entry in the products index, where its owner, its consumers and its refresh cadence are set out.

Consumes

Cycle briefThe published product: terrain, reachability, main effort, temporal advantage, coverage, trend, and the top-ranked backlog items — each confidence-tagged. Also the evidence that feeds the next intent.
Findings disposition recordEvery finding with an outcome: remediate with an owner and a date, accept with a named accepter and an expiry, or transfer with the party named. “Under review” is not a disposition.
Statutory availability floorThe mission services whose availability is set by statute or regulation, and the floor below which degradation stops being a defensive choice. Bounds what may be pre-authorized and what may be degraded under contact.
Cycle record and trendThe closed record of the cycle — posture, loop measurement, conclusions and their confidence, backlog state at close — and the trend across cycles that makes a second cycle worth more than a first.

Produces or Refreshes

Defensive intent paragraphOne signed paragraph stating what the defense exists to protect, what may be degraded to protect it, and the acceptable risk. The commander’s-intent analog, and the citation every downstream designation rests on.
Priority Cyber Intelligence RequirementsThree to seven questions the cycle will try to answer, each naming the decision it informs, the collection source expected to answer it, and an individual owner.
Phase declarationThe declared campaign phase and the scope it is declared against. Sets cadence, dominant forms of maneuver, and how wide the pre-authorization set runs.
Cycle cadence and calendarThe declared length of a cycle, its close date, and the refresh intervals that inherit from it. Makes “per cycle” a measurable unit rather than a figure of speech.
Temporal advantage thresholdThe number the cycle will be judged against: defender decision loop versus adversary dwell, stated with units before the cycle runs.

The Controls That Govern This Step

A control may govern more than one step. Where it does, the note says which job it is doing here — the temporal-advantage control sets a threshold at Frame and reports against it at Assess, and they are not the same activity.

CG-1 Defensive IntentProduces the intent paragraph itself, including the acceptable-risk statement everything downstream cites.
CG-2 Phase DeclarationDeclares the campaign phase, which sets how fast the rest of the loop is expected to turn.
CE-1 Cycle CadenceFixes the cadence and the cycle boundary, so that “per cycle” means something measurable.
CE-2 Priority Intelligence RequirementsConverts the intent into the cycle’s intelligence requirements — the questions Fuse will be held to.
TA-3 Temporal Advantage ThresholdSets the temporal-advantage threshold in advance. The same control reports against it at Assess.
FO-5 Statutory Availability FloorSupplies the statutory availability floor that bounds what the acceptable-risk sentence may offer up.

Analytic Method

Analytic design

ATP 2-33.4

State the problem, the audience, the questions, the sources, the method, the product and the schedule before collection begins. The discipline is that the product is specified first, so collection is bounded by what will actually be written.

Requirement decomposition

ATP 2-33.4

Break each intelligence requirement into indicators that could be observed and the specific decision each would trigger. A requirement that decomposes into no observable indicator is unanswerable and should be struck at Frame rather than survive to Assess as an open item.

Acceptable-risk articulation

Authored

Name what may be lost, in writing, while nothing is happening. Frame is the only step in which this costs nothing; every later step where it comes up, it is being decided under pressure by whoever is on shift.

Common Failure Modes

Authored, and each one carries the observable tell that separates it from a step that is working. A list of failure modes with no tells is a list of anxieties.

The intent paragraph is written as a mission statement.

The tell: It contains no verb the SOC could act on, and no sentence anyone in the room would have argued with.
The correction: Force the paragraph to name one thing that may be sacrificed. If nobody objects to the draft, it has not said anything.

Intelligence requirements are restated as telemetry questions.

The tell: “Are we seeing more phishing?” — the answer, either way, changes no decision.
The correction: Write the decision first and derive the question from it. If no decision hangs on the answer, the question is not a priority requirement.

Frame is inherited unchanged from the previous cycle.

The tell: The intent paragraph’s revision date is older than the terrain overlay it is meant to govern.
The correction: The brief feeds the intent by design. If the last cycle genuinely moved nothing, record that finding explicitly rather than skipping the step — a deliberate no-change is evidence; a skipped step is a gap.

The cycle is framed around the loudest recent incident.

The tell: The requirement list reads as a recap of last month’s ticket queue.
The correction: Check the list against the designated decisive points, not against the queue. The queue reports what was noisy; the decisive points report what matters.

Requirements are owned by a team rather than a person.

The tell: At Assess, an unanswered requirement has no one to explain the collection gap.
The correction: Name an individual per requirement at Frame. Diffusion of ownership is how a requirement survives four cycles unanswered.