04 Maneuver — the operating loop

Purpose

Emplace obstacles, reposition sensors, and execute defensive fires — block, isolate, deceive, disrupt — under the standing rules of engagement.

Output. Executed defensive actions and a change record.

The Doctrinal Step It Corresponds To

Execute

Execute. There is deliberately no analytic technique in this step: the analysis was done in the three steps before it, and the reason it was done there was to make this step fast. A defense that is still analyzing at the point of execution has moved the analysis into the window where it costs tempo.

Discussion

Maneuver is where obstacles get emplaced, sensors get repositioned, and defensive fires — block, isolate, deceive, disrupt — are executed inside the standing rules of engagement. Everything in it was decided at Array. The step’s discipline is about recording, not deciding.

Two timestamps make or break the cycle: when the decision was made, and when the action took effect. Without both, the defender’s decision loop cannot be measured, and temporal advantage — the framework’s single honest scoreboard — silently becomes an estimate. The most common way a program loses its headline metric is not by measuring it badly but by executing without recording when.

The second discipline is updating implementation state as work lands. Work that was done and never recorded reads downstream as coverage that was never built, and it is indistinguishable at Assess from work that was never done. This is the framework’s commonest silent failure, and it degrades the numbers in the safe direction, which is why nobody catches it.

Maneuver is also where the ground changes. A material change is a terrain refresh trigger in its own right, not something to be picked up at the next scheduled overlay rebuild. A scheme executed against an overlay that no longer describes the estate is being executed against a memory.

Entry and Exit Criteria

Authored for this manual. A step you cannot tell you have finished is not a step, and every criterion below is written so that it can be answered no.

Do Not Start Until

The scheme is approved and the main effort is known to the people executing.
The pre-authorization set is current and the executing shift can state, without looking it up, which actions they may take without escalation.
The statutory availability floor is understood by whoever might degrade a service. The floor is a pre-agreed statement made when nobody was under pressure; its whole value is being available at the moment pressure arrives.
Rollback is known for each planned change, and the change window is agreed with the terrain owner.
The decision-loop clock is running — the measurement instrumentation exists before the actions it is meant to measure.

The Step Is Finished When

Every executed action is in the change record with both the decision time and the effective time.
Every maneuver assignment touched during the step has had its implementation state updated. Not "in progress" — the state the work is actually in.
Material change has triggered a terrain refresh rather than waiting for the calendar.
Every action taken outside the standing rules of engagement is recorded as an authority exception, naming who approved it. Exceptions are not failures; unrecorded exceptions are.
The terrain owner of every ground that was touched has been told, by name, what changed on it.

Beyond repair. Maneuver has failed irrecoverably when actions were taken, the estate is genuinely better defended, and none of it can be evidenced or timed.

Who Takes Part

Leads: SOC / Defensive Operations

Defensive operations execute fires and emplace obstacles inside the standing rules of engagement; platform owners execute on their own terrain. Nothing here is escalated that was pre-authorized at Array — escalating a pre-authorized action is a measurable defect, not diligence.

Participation below is derived from the RACI of this step’s own governing controls, not authored — a role appears at the strongest assignment it holds on any of them. The manual therefore cannot claim a role is uninvolved in a step whose controls give it work.

AccountableAuthorizing Official / CISO SM-2 · SM-3 · TA-4 · CG-3 · TA-1 · WF-5 · LC-4 · TM-6 · FO-5
ConsultedCyber Threat Intelligence cell TA-1 · LC-4
ResponsibleSOC / Defensive Operations TA-1
ConsultedHunt team TA-1
ResponsiblePlatform and product owners SM-2 · SM-3 · WF-5 · LC-4 · TM-6
ResponsibleGovernance / RMF / ISSO CG-3 · FO-5

Inputs and Outputs

Every artifact links to its entry in the products index, where its owner, its consumers and its refresh cadence are set out.

Consumes

Scheme of maneuverOne graphic and one narrative: which forms of maneuver are sited where, in what sequence. The assignment record behind it carries the element, the avenue and the implementation state for every move.
Main effort designationThe single designated main effort for the cycle, and the sentence citing the decisive point that justifies it. The answer to which work wins when two things need the same engineer.
Branch and sequel planThe branches answer the most-dangerous course of action; the sequels answer success. Every one names the authority it needs, and any expected to run inside the decision window is pre-authorized when it is written.
Pre-authorized response setThe specific containment and response actions the SOC may execute at machine speed, bounded by the statutory availability floor. Directly measurable: it shortens the decision segment of the defender loop.
Rules of engagementWhich defensive actions may be taken by whom without escalation, which need the Authorizing Official, and what is prohibited outright. The cyber analog of engagement authority, and the single largest determinant of tempo.
Statutory availability floorThe mission services whose availability is set by statute or regulation, and the floor below which degradation stops being a defensive choice. Bounds what may be pre-authorized and what may be degraded under contact.

Produces or Refreshes

Change recordEvery defensive action carried out, stamped twice — at the decision and at the effect. A thin, unglamorous table, and the one the headline metric is computed from.
Implementation state recordPlanned, partial or operational, per maneuver assignment. The mechanism that stops intended work being counted as deployed protection.
Authority exception logActions taken outside the standing rules of engagement, with who approved them and why. Exceptions are not failures; unrecorded exceptions are.
Defender decision loop measurementDetect to decide to contain, measured per incident from the change record’s timestamps and reported as a distribution rather than as a mean.
Hunt results, including negative resultsWhat was hunted, how, and what was not found. Negative results are the half most often discarded, and they are the half that says what has actually been cleared.
Engagement recordThe record of one engagement end to end: what was declared and on what criteria, the reconstruction with its dwell, scope and confidence, the evidence preserved and its custody, the authority exercised, and the verification that eradication actually happened before recovery began.
Engagement communication recordWho was told what, and when, against the window that bound each obligation — inside the agency, to the federal community, and to those the mission serves. Includes the contribution made back to the community, or the recorded reason there was none.

The Controls That Govern This Step

A control may govern more than one step. Where it does, the note says which job it is doing here — the temporal-advantage control sets a threshold at Frame and reports against it at Assess, and they are not the same activity.

SM-2 Maneuver AssignmentThe assignments being emplaced — this step is where the siting decision becomes a deployed control.
SM-3 Implementation State TrackingRecords the resulting implementation state. The change record and the state record are the same discipline.
TA-4 Pre-authorized ResponseThe pre-authorized set the SOC executes under. Its measurable benefit is a shorter decision segment in the loop.
CG-3 Rules of EngagementThe authority framework, and the place authority exceptions are recorded when the standing set is exceeded.
TA-1 Decision Loop MeasurementMeasures the decision loop from the timestamps this step produces. The measurement is only as good as the recording.
WF-5 Separation and Revocation TempoRevocation as a defensive fire — the separation and suspension path executed at tempo.
LC-4 Update Integrity and StagingUpdate integrity and staging: changes arriving from suppliers are themselves maneuver on the estate.
TM-6 Terrain CurrencyTakes material change as a refresh trigger, so the map does not drift behind the ground during execution.
FO-5 Statutory Availability FloorBounds what may be degraded while executing. Consulted at Maneuver, agreed long before it.

Analytic Method

Deliberately thin. The analysis belongs to the three steps before this one, and the reason it was done there was to make this step fast. What is listed here is procedural discipline, not analytic method.

Change record discipline

Authored

Decision time and effective time, recorded per action, at the point of action. This is not administration; it is the only source of the defender loop measurement.

Pre-authorized execution

Rules of engagement

Execute within the standing set without escalation, and record any exception. The engagement-authority analog is exact: tempo is decided by what may be done without asking.

Terrain owner notification

Authored

Tell the named accountable owner what changed on their ground, at the time it changes. This is what keeps the ownership record honest between cycles rather than only at the annual reconciliation.

Common Failure Modes

Authored, and each one carries the observable tell that separates it from a step that is working. A list of failure modes with no tells is a list of anxieties.

Fires are executed but not timestamped.

The tell: The loop measurement for the period is described as approximate, or is reconstructed after the fact from ticket close times.
The correction: Instrument the decision point, not just the action. Ticket close time is when someone had a moment to close a ticket, which is a measurement of workload.

A pre-authorized action is escalated anyway.

The tell: The median decision segment of the loop is longer than the median execution segment.
The correction: Escalating a pre-authorized action is usually a confidence problem, not a policy problem. Rehearse the pre-authorized set until the shift can recite it.

A statutory service is degraded without reference to the floor.

The tell: The floor is discovered during the incident review rather than during the action.
The correction: Put the floor in the runbook next to the actions capable of breaching it, not in a governance repository.

An obstacle is emplaced on someone else’s terrain without telling them.

The tell: The terrain owner learns about the change from a service failure.
The correction: Ownership is recorded at Map so that this notification is a lookup rather than an investigation. Use it.

The scheme is executed and never updated.

The tell: At the next Array, the scheme and the deployed reality disagree and nobody can say when they diverged.
The correction: Update state at execution, in the same action. A weekly reconciliation catches the divergence one cycle late, which is exactly one cycle too late.