Control Statement
The organization shall declare which federal obligations it stands on, with the basis for each inclusion and exclusion, approved by the accountable authority; obligations outside the declared profile shall be scored out of scope rather than as gaps.
Purpose. To make the scope of the FO family an approved position, so that coverage figures are comparable and exclusions are decisions rather than silences.
Discussion
This control exists because a denominator that is never written down cannot be compared or challenged. Two agencies reporting FO coverage of sixty percent may have scored against entirely different obligation sets, and neither figure means anything without the profile behind it. The exclusion basis carries more weight than the inclusion basis: including an obligation that does not apply is merely wasteful, while excluding one that does is a compliance failure concealed inside a scoping decision that nobody recorded.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Percentage of FO obligations with a recorded, approved inclusion or exclusion basis
- Number of obligations in neither state
- Currency of the profile against the most recent change of governing instrument
- Elapsed time from a governing change to an approved profile revision
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Informed | SOC / Defensive Operations: Informed | Hunt team: Informed | Platform and product owners: Consulted | Governance / RMF / ISSO: Responsible |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- InformedCyber Threat Intelligence cell
- InformedSOC / Defensive Operations
- InformedHunt team
- ConsultedPlatform and product owners
- ResponsibleGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- Outside the frameworkGoverning instruments, authorizing legislation and legal determinations
- FO-5 Statutory Availability FloorStatutory availability floors that must appear in the profile
Produces
- CE-4 Coverage and Residual Risk ComputationThe scoped FO denominator posture is computed against
- CG-5 Control Inheritance MappingObligation scope the inheritance mapping is verified within
- EN-6 Engagement CommunicationWhich statutory reporting windows bind an engagement
Activities
- L2Declare which federal obligations the organization stands on.
- L2Record the basis for each inclusion.
- L2Record the basis for each exclusion.
- L3Obtain the accountable authority's approval of the profile as a whole, recorded with date, rather than obligation by obligation.
- L3Obtain legal confirmation for exclusions, since an exclusion is a determination that a governing instrument does not apply.
- L3Publish the profile alongside any
FOcoverage figure, so the denominator travels with the number. - L3Score obligations outside the profile as out of scope rather than as gaps, and ensure the posture computation under
CE-4reflects the profile denominator. - L4Review the profile on change of mission, authority or governing instrument, and measure the interval between such a change and the profile's revision.
- L4Measure the proportion of exclusions carrying legal confirmation rather than operational judgment.
- L5Reconcile the profile against obligations that arose in practice — an obligation encountered operationally but absent from the profile indicates the derivation method is incomplete rather than the instance exceptional.
Measurement
Percentage of `FO` obligations with a recorded, approved inclusion or exclusion basis.
Currency of the profile against the most recent change of governing instrument.
Evidence and Assessment
Approved obligation profile with inclusion and exclusion bases and approval date; legal confirmations for exclusions; published denominator.
Examine the profile and its approval; test that exclusions carry legal confirmation; test that FO coverage figures are computed against the declared profile rather than the full family.
Related Guidance
- PM-1
- PM-9
- PL-1
- GV.OC-03
- GV.OV-02
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Fed By
Nothing upstream — this control starts a chain.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M11ReconstitutionRestore the mission on evidence, not on hope — and prove it before you need it.2 of 11 techniques — M11.01, M11.06
Terrain It Is Named On
Applies to all ten layersDeclares which federal obligations bind the estate, which is what makes any FO coverage figure on this layer comparable to another agency’s.
Artifacts It Stands On
- consumesStatutory availability floorThe mission services whose availability is set by statute or regulation, and the floor below which degradation stops being a defensive choice. Bounds what may be pre-authorized and what may be degraded under contact.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsibleGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.
- ConsultedPlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- InformedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- InformedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- InformedHunt teamCounterattack. Works the hypotheses that Fuse raises.