Control Statement
Adverse events shall be declared as incidents against defined criteria, and every declared incident shall be triaged, validated, categorized and prioritized within a stated period.
Purpose. To convert raw events into a decided position quickly, since this is the segment of the decision loop that most often binds.
Discussion
TA-1 measures the decide segment; this control is what the decide segment consists of. Declaration criteria matter more than they appear: an estate without them declares incidents by judgment, which means the threshold moves with analyst experience, workload and the hour of day, and the resulting tempo measurement compares populations that were selected differently in each cycle. Validation is the second half — a triage process that categorizes without validating produces confident categorizations of events that never happened, and the cost lands on the eviction path.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Triage elapsed time against the stated period
- Percentage of declarations carrying a recorded ranking basis
- False-declaration rate
- Missed-declaration rate
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Consulted | SOC / Defensive Operations: Responsible | Hunt team: Consulted | Platform and product owners: Informed | Governance / RMF / ISSO: Informed |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- ConsultedCyber Threat Intelligence cell
- ResponsibleSOC / Defensive Operations
- ConsultedHunt team
- InformedPlatform and product owners
- InformedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- DV-3 Endpoint Sensor Coverage and LivenessEndpoint detection telemetry
- SM-7 Deception EmplacementDeception interaction alerts, which carry no false-positive budget
- TM-3 Asset WeightingAsset weighting used to rank what was declared
- TA-1 Decision Loop MeasurementDecide-segment target the triage period is set against
- DV-4 Execution ControlUnauthorized execution events as declaration triggers
Produces
- EN-2 Engagement ReconstructionDeclared incidents requiring reconstruction
- EN-4 Escalation and Engagement AuthorityPrioritized incidents requiring an authority decision
- TA-1 Decision Loop MeasurementMeasured decide segment of the decision loop
- EN-3 Evidence PreservationDeclared incidents that trigger preservation
- EN-6 Engagement CommunicationDeclared incidents and their category
Activities
- L2Declare incidents when adverse events meet defined criteria.
- L2Triage and validate each declared incident.
- L2Categorize and prioritize each validated incident.
- L3Define declaration criteria in terms an analyst can apply without escalating, so the threshold does not move with judgment or workload.
- L3Prioritize against terrain: an incident touching a designated decisive point (
KT-1) or high-weight element (TM-3) outranks one that does not, and the ranking basis is recorded. - L3State the period within which triage must complete, derived from the decide segment target under
TA-1, with provenance perGA4. - L3Route declaration to
CG-2where the incident meets the entry condition for a campaign phase transition, since phase is how the estate changes posture. - L3Record events considered and *not* declared, so the declaration boundary is examinable rather than invisible.
- L4Measure triage elapsed time against the stated period, and measure the false-declaration and missed-declaration rates as a two-sided check on the criteria.
- L4Correlate declaration rate against degraded tempo conditions (
TA-5), since a falling declaration rate during a holiday weekend is a detection finding rather than a quiet period. - L5Re-derive declaration criteria from engagements that were declared late or not at all, rather than from the criteria's original authoring assumptions.
Measurement
Triage elapsed time against the stated period.
False-declaration and missed-declaration rates.
Evidence and Assessment
Declaration criteria; declared incidents with category, priority and ranking basis; non-declaration record; triage timing.
Examine the criteria for applicability without escalation; test a sample of declarations against them; examine the non-declaration record for events that met criteria; test triage times against the stated period.
Related Guidance
- IR-4
- IR-5
- SI-4
- DE.AE-08
- RS.MA-02
- RS.MA-03
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M1Screen / GuardGain early warning and buy reaction time before the adversary touches key terrain.1 of 15 techniques — M1.08
- M5AmbushTrade space for information and time, and impose cost.1 of 13 techniques — M5.09
- M7CounterattackSeize the initiative and evict before the adversary reaches the objective.1 of 17 techniques — M7.02
Terrain It Is Named On
Applies to all ten layersAn engagement on this layer starts by being declared. Until it is, nothing below this line is running.
Artifacts It Stands On
- producesEngagement recordThe record of one engagement end to end: what was declared and on what criteria, the reconstruction with its dwell, scope and confidence, the evidence preserved and its custody, the authority exercised, and the verification that eradication actually happened before recovery began.
- consumesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
- consumesDefender decision loop measurementDetect to decide to contain, measured per incident from the change record’s timestamps and reported as a distribution rather than as a mean.
- consumesBill of DefensePer mission service: the maneuvers and assets protecting it, its rolled-up coverage, and its residual risk. The view that lets a mission owner see their own defense rather than the enterprise average.
- consumesTemporal advantage resultDefender decision loop against adversary dwell, reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met. The framework’s single honest scoreboard.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsibleSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- ConsultedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- ConsultedHunt teamCounterattack. Works the hypotheses that Fuse raises.
- InformedPlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- InformedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.