ASOM-Fedv6.1Open the explorer
DV-3 · Devices Terrain

Endpoint Sensor Coverage and Liveness

Control Statement

Sensor coverage across the device estate shall be reconciled to the device inventory rather than to the sensor console, and a sensor that stops reporting shall be treated as a security event.

Purpose. To know what the estate can actually see, and to detect the loss of that visibility as an event rather than at the next assessment.

Discussion

Two failures hide behind a healthy coverage figure. The first is the console denominator: a platform reporting 100% coverage is reporting 100% *of the devices it knows about*, which is a tautology, and reconciling to DV-1's inventory is the only way to get a real number. The second is silence. A sensor removed, disabled or crashed produces no telemetry, and an absence of alerts is indistinguishable from an absence of adversary — which is precisely the condition an adversary works to create. Liveness is therefore a control in its own right, not a platform health metric.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

The estate knows what it can actually see.
  • Sensor coverage reconciled to the device inventory
  • Number of device classes with no sensor available at all
Loss of visibility is an event, not an assessment finding.
  • Measured time to detect a silent sensor
  • Count of silent-sensor events per cycle, trended

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

AOCTISOCHUNTPLATISSO
Authorizing Official / CISO: AccountableCyber Threat Intelligence cell: InformedSOC / Defensive Operations: ResponsibleHunt team: ConsultedPlatform and product owners: ConsultedGovernance / RMF / ISSO: Informed

AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO

  • AccountableAuthorizing Official / CISO
  • InformedCyber Threat Intelligence cell
  • ResponsibleSOC / Defensive Operations
  • ConsultedHunt team
  • ConsultedPlatform and product owners
  • InformedGovernance / RMF / ISSO

Inputs and Outputs

Consumes

Produces

Activities

  1. L2Deploy sensor coverage across the managed device estate.
  2. L2Report coverage as a proportion of the device inventory.
  3. L2Detect sensors that have stopped reporting.
  4. L3Reconcile coverage against the DV-1 inventory rather than the sensor console, and report the reconciled figure as the coverage number.
  5. L3Treat a silent sensor as a security event with a response path, consistent with M2.14 Control Failure Detection, rather than as a platform ticket.
  6. L3Ensure telemetry generation and retention on device terrain meet the retention EN-3 requires against the dwell estimate, since reconstruction cannot reach further back than the endpoint retained.
  7. L3Record device classes that cannot carry a sensor, with the compensating measure and an owner.
  8. L4Measure time to detect a silent sensor, tested rather than assumed.
  9. L4Trend the gap between console-reported and inventory-reconciled coverage; a widening gap is an inventory finding, not a sensor one.
  10. L5Extend or replace sensing for device classes carrying persistent compensating measures, rather than accepting the compensation indefinitely.

Measurement

Outcome

Sensor coverage reconciled to the device inventory.

Performance

Measured time to detect a silent sensor.

Evidence and Assessment

Evidence expected

Reconciled coverage figure with its denominator stated; silent-sensor event records; uncovered device class register with compensations.

Assessment procedure

Examine which denominator the reported coverage uses; test detection of a deliberately silenced sensor; compare endpoint retention against the current dwell estimate.

Related Guidance

Inherits
  • SI-4
  • AU-2
  • AU-12
Satisfies
  • DE.CM-09
  • PR.PS-04
  • ID.AM-08

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.

Forms of Maneuver It Assesses

  • M2Defense in DepthEnsure no single failure is decisive.2 of 18 techniques — M2.05, M2.14
  • M7CounterattackSeize the initiative and evict before the adversary reaches the objective.1 of 17 techniques — M7.17

Terrain It Is Named On

  • T2DevicesEstablishes what this layer can actually see, and turns the loss of that visibility into an event rather than an assessment finding.

Artifacts It Stands On

  • consumesAdversary dwell estimateThe estimated time an adversary could operate undetected in this estate, with its basis stated — measured dwell, sector reporting, or partner intelligence — and its bias acknowledged.
  • consumesTemporal advantage resultDefender decision loop against adversary dwell, reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met. The framework’s single honest scoreboard.
  • consumesEngagement recordThe record of one engagement end to end: what was declared and on what criteria, the reconstruction with its dwell, scope and confidence, the evidence preserved and its custody, the authority exercised, and the verification that eradication actually happened before recovery began.

Roles It Puts to Work