Federal Obligations
Terrain that exists because the organization is a federal one
Elements holding personally identifiable information shall be identified on the terrain overlay, with the authority under which the information is held recorded against each.
PurposeTo make privacy exposure positional, so that the elements holding personal information can be defended, minimized and accounted for as terrain.Activities10 · Metrics2Elements processing, storing, or transmitting controlled unclassified information shall be identified on the terrain overlay, and the boundaries across which that information may move shall be declared.
PurposeTo make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.Activities10 · Metrics2For every element hosted in a shared or authorized service, the overlay shall record which controls are inherited from the provider and which remain the organization's responsibility.
PurposeTo ensure that the customer half of a shared responsibility model is owned by someone, so that inherited controls do not become nobody's job.Activities10 · Metrics2Operational technology, industrial control, and physical-effect systems shall be represented on the terrain overlay as a distinct defensive layer, with their connections to enterprise terrain declared.
PurposeTo stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.Activities10 · Metrics2Where statute, regulation, or an authorizing instrument sets a deadline the mission must meet, the affected services shall be identified and their recovery objectives shall be set no weaker than that deadline requires.
PurposeTo identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.Activities10 · Metrics2The organization shall maintain a supply chain risk management program meeting its federal obligations, and shall record which acquisitions fall within its scope.
PurposeTo discharge the statutory supply chain risk obligation, and to make the boundary of its scope explicit rather than assumed.Activities10 · Metrics2The organization shall declare which federal obligations it stands on, with the basis for each inclusion and exclusion, approved by the accountable authority; obligations outside the declared profile shall be scored out of scope rather than as gaps.
PurposeTo make the scope of the `FO` family an approved position, so that coverage figures are comparable and exclusions are decisions rather than silences.Activities10 · Metrics4