Control Statement
For every declared incident, the organization shall reconstruct what took place — the entry, the movement, the dwell interval and the scope reached — and shall record the actions taken during the investigation.
Purpose. To establish what actually happened, since every consolidation activity depends on a reconstruction and none of them can be performed without one.
Discussion
M10's stated precondition is a dwell reconstruction, and the framework's own material observes that the reconstruction gets harder every day after the ticket closes. This is the control that makes it a requirement rather than an intention. The reconstruction is also load-bearing far beyond the incident it describes: RC-4 selects a restore point against it, TA-2 corrects the imported dwell estimate against it, M10.02 verifies avenue closure against it, and CE-2 revises intelligence requirements from what it showed could not be seen. An agency that closes incidents without reconstructing them has disabled four controls it believes it operates.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Percentage of declared incidents with a completed reconstruction
- Percentage of reconstructions carrying an explicit confidence level
- Divergence between reconstructed dwell and the TA-2 estimate
- Count of visibility gaps found during reconstruction
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Consulted | SOC / Defensive Operations: Consulted | Hunt team: Responsible | Platform and product owners: Informed | Governance / RMF / ISSO: Informed |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- ConsultedCyber Threat Intelligence cell
- ConsultedSOC / Defensive Operations
- ResponsibleHunt team
- InformedPlatform and product owners
- InformedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- EN-1 Event Declaration and TriageDeclared incidents
- EN-3 Evidence PreservationPreserved evidence, without which reconstruction cannot run
- TM-1 Terrain Inventory and OverlayTerrain overlay the movement is traced across
- TM-5 Connection and Denied-Path RegisterConnection and denied-path register bounding plausible movement
- DV-3 Endpoint Sensor Coverage and LivenessThe record reconstruction is performed from
Produces
- RC-4 Recovery Integrity VerificationReconstruction that determines a safe restore point
- TA-2 Adversary Dwell EstimationObserved dwell, correcting the estimate
- CE-2 Priority Intelligence RequirementsNew intelligence requirements arising from the engagement
- EN-5 Eradication and Transition to RecoveryScope and magnitude eradication is verified against
- EN-6 Engagement CommunicationReconstruction and magnitude, which set what must be reported
Activities
- L2Reconstruct the entry point, the movement path and the scope reached for each declared incident.
- L2Estimate the dwell interval from first access to detection.
- L2Record the actions taken during the investigation, with times and actors.
- L3Estimate incident magnitude — elements affected, data reached, mission impact — and record the confidence level per
CE-3. - L3Record what could *not* be reconstructed and why, since a visibility gap is the most actionable output of an engagement and is otherwise lost.
- L3Reconcile the reconstructed path against the terrain overlay and record every place the map was wrong, feeding
TM-1andM10.03. - L3Complete reconstruction before the incident is closed, with closure withheld until it is recorded.
- L4Measure the proportion of declared incidents carrying a completed reconstruction, distinguishing closed from reconstructed.
- L4Compare reconstructed dwell against the imported estimate under
TA-2, and feed the divergence back into it. - L5Build a local dwell series from accumulated reconstructions, transitioning
TA-2from an imported figure to a measured one.
Measurement
Percentage of declared incidents with a completed reconstruction.
Divergence between reconstructed dwell and the `TA-2` estimate.
Evidence and Assessment
Reconstruction per incident with dwell, scope, magnitude and confidence; investigation action record; visibility gap findings; overlay corrections.
Examine reconstructions for completeness; test that closure was withheld pending reconstruction; examine whether visibility gaps were raised as findings; compare reconstructed dwell against the estimate in use.
Related Guidance
- IR-4(4)
- AU-6
- IR-4
- RS.AN-03
- RS.AN-06
- RS.AN-08
- DE.AE-04
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M10Exploitation & PursuitConvert contact into durable advantage rather than closing the ticket.3 of 7 techniques — M10.02, M10.03, M10.04
- M7CounterattackSeize the initiative and evict before the adversary reaches the objective.1 of 17 techniques — M7.12
Terrain It Is Named On
Applies to all ten layersReconstruction is what establishes how far the adversary actually got across this layer, and it is what corrects the dwell estimate the layer’s tempo figures use.
Artifacts It Stands On
- producesEngagement recordThe record of one engagement end to end: what was declared and on what criteria, the reconstruction with its dwell, scope and confidence, the evidence preserved and its custody, the authority exercised, and the verification that eradication actually happened before recovery began.
- consumesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
- consumesTrust zones and the connection registerThe zone boundaries and the permitted- and denied-path register — the graph reachability is actually walked over, reconciled against observed flow telemetry rather than against intended configuration.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsibleHunt teamCounterattack. Works the hypotheses that Fuse raises.
- ConsultedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- ConsultedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- InformedPlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- InformedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.