The Vocabulary, and What It Is Not.

A path an adversary can actually traverse from a starting position to a decisive point, across the permitted connections the estate really has. In ASOM-Fed an avenue is traced over the connection register (TM-5) rather than imagined: it begins at a declared threat-actor position, crosses named zone boundaries, and ends at a designated decisive point. Indirect routes through intermediate systems count, and usually dominate — adversaries rarely arrive on the direct edge.

The specific denied path that is preventing an adversary position from reaching a decisive point. Barriers are derived, not chosen: the reachability assessment (KT-4) identifies which denied paths are holding the line, and those become the load-bearing set. Each must be technically enforced rather than procedurally asserted, must have a named owner, and must be monitored — because a barrier that is removed during a change window fails silently and the reachability answer changes with nobody noticing.

The per-mission statement produced by the Defense Tower Model: for one mission service, the assets, defensive towers and maneuvers protecting it, its rolled-up coverage percentage, and the residual risk that remains. It is the artifact that lets a mission owner see defense the way a budget holder sees spend — attributable, traceable in both directions, and arguable.

A contingency maneuver planned before the cycle begins, with its trigger stated: if account takeover on external identities is confirmed, execute the envelopment maneuver on the identity plane. The value is entirely in the pre-planning — a branch decided at the moment of contact is not a branch, it is an improvisation, and it will be made by whoever is awake.

Deliberately shaping the estate so that lateral movement, when it happens, happens in instrumented segments. Microsegmentation, egress control and allow-listing are the mechanism; the intent is not to make movement impossible but to make it occur where you are watching. The measure is not “attempts blocked” but “attempts observed in instrumented terrain”.

The defensive intent paragraph: what is being protected, what degradation is acceptable, and what must never happen — issued by the Authorizing Official, in one paragraph, in language a platform owner can act on without translation. “Protect mission-transaction integrity and sensitive mission records; degrade gracefully, never fail open” is intent. It is what allows a SOC to make a containment decision at 03:00 that the Authorizing Official would have made.

An attached judgment about the evidence behind a conclusion — its quality, its corroboration, and the assumptions the conclusion rests on. In ASOM-Fed a fused assessment without a confidence level is incomplete, because a decision made on a high-confidence assessment and one made on a low-confidence assessment should not be the same decision.

A specific, terrain-grounded way an adversary could reach an objective — an avenue of approach, the maneuvers that would carry it, and what would have to be true first. ASOM-Fed models the most likely and the most dangerous threat COA against the Federal Reference Agency and scores how much of each the coverage baseline actually answers.

The weighted proportion of defensive requirement that is actually met on a given piece of terrain, rolled up from sub-towers to towers to missions. Each sub-tower’s maturity gives it a coverage percentage; those are weighted by defensive weight and aggregated. Coverage is only meaningful with its denominator visible — it rises whenever elements leave the population, which is why terrain currency (TM-6) and layer classification (TM-2) are prerequisites for believing the number.

The Map step of the cycle. Refresh the terrain overlay, enumerate avenues of approach, and build most-likely and most-dangerous threat courses of action against the ground as it currently is. CPE is what makes the rest of the cycle intelligence-led rather than alert-led: it produces the map that the scheme of maneuver is drawn on.

The defender’s culminating point is analyst saturation: the alert volume, incident concurrency or change rate beyond which the decision loop lengthens and quality falls. It is a real, measurable threshold and it is reached quietly. ASOM-Fed makes it a declared trigger (TA-5) rather than a discovery, so that the program sheds load deliberately instead of degrading invisibly. The adversary has one too, and imposing cost is an attempt to reach it first.

The one authoritative positional picture of the estate — every system, data store and external actor as a distinct element, placed inside a trust zone whose boundary is actually enforced, with its connections recorded. It is the input to almost everything else in the framework, which is why a program that skips it starves decisive-point identification, reachability analysis and coverage computation simultaneously. Competing diagrams are retired when it is published; two maps is the same as none.

The small number of elements whose compromise unhinges the wider defense — where control is decided, not merely where value sits. In a federal estate the two usual candidates are the identity policy decision point and the build pipeline: capture either and everything downstream follows without further effort. Designation is a recorded decision with a written justification in terms of what the adversary gains, and it must be discriminating. A designation covering most of the estate has designated nothing.

Criticality × Exposure, each scored 1–5, giving every element a comparable 1–25 measure of how much it matters. Criticality comes from the mission consequence of loss — not from the size or cost of the system. Exposure comes from reachability by untrusted actors, read off the connection register rather than estimated. Weight is what makes prioritization arithmetic instead of argument, and what lets coverage roll up as a weighted average rather than a count.

A connection between two elements that has been deliberately prevented, recorded distinctly from the mere absence of a connection, with the control that enforces it named. The distinction matters because the two look identical in a firewall export and behave completely differently over time: an absence is reopened by the next change request; a denied path has an owner, a rationale, and a monitor.

Active defensive actions: revoke a session, quarantine a host, block infrastructure, sever a segment, deploy a decoy. The word is used deliberately, because it brings engagement authority with it — every fire is either pre-authorized in the rules of engagement or requires the Authorizing Official, and the proportion that is pre-authorized is one of the framework’s headline measures of performance.

One of the eleven defensive forms in the ASOM-Fed catalog: screen, defense in depth, envelopment, obstacle emplacement, ambush, delay, counterattack, isolation, spoiling attack, exploitation and pursuit, reconstitution. A form is intent-first — leaders pick the form, engineers pick the technique. That separation is what lets the framework survive tool churn: 154 cataloged techniques will change, the eleven forms will not.

Systems and data whose control confers decisive advantage — the identity plane, the public service portal, sensitive pre-decisional records, mission-staff workflow. Key terrain is where the campaign’s effort is concentrated, and the ASOM-Fed measure of performance “key terrain behind a policy enforcement point” is the crudest useful test of whether that concentration is real.

The one place defensive mass and priority are concentrated this cycle — typically the identity plane plus the crown-jewel record set. Designation only means something at the moment of contention: when the backlog, the budget and the on-call attention cannot all go to everything, the main effort wins by prior decision rather than by argument.

A measure of whether executing the maneuvers changed the outcome. In ASOM-Fed: temporal advantage, positional advantage, cost imposition, resilience, and the zero-trust maturity vector. These are the measures capable of reporting that a busy program is losing, which is precisely why they are harder to collect and easier to quietly drop.

A measure of execution: percentage of key terrain behind a policy enforcement point, deception coverage of the data terrain, percentage of fires pre-authorized, overlay freshness, intelligence requirements answered per cycle. Every one of these can be excellent while the defense is losing. They are necessary, cheap to collect, and dangerous alone.

The lateral-movement paths inside the estate: flat network segments, over-permissioned service accounts, shared cloud roles, trust relationships between tenancies. An avenue of approach describes how an adversary gets toward an objective; the mobility corridor is the ground they move along once inside, and it is the natural target for canalization — you cannot close every corridor, so you narrow them until movement happens where you are watching.

A control that shapes adversary movement rather than merely existing: segmentation, phishing-resistant multi-factor authentication, conditional access, egress control. The doctrinal condition carries over exactly — an obstacle that is not observed does not impede for long, which is why maneuver assignment (SM-2) and barrier sufficiency (KT-5) both ask what watches the obstacle, not only whether it is in place.

The two to five questions the defense needs answered this cycle, each tied to a decision somebody will make — “are external-user accounts being taken over at a rate above baseline?”, “has our build pipeline been touched by the tradecraft in the current advisory?”. Requirements are set at Frame and closed at Assess; the count answered per cycle against the count set is a headline measure of performance.

A declared statement of what the defense is currently trying to do — shaping conditions, deterring, contesting first contact, defeating an attempt, restoring secure operations, or handing back to steady state. Declaring the phase changes what “good” looks like: the maneuvers that dominate, the resourcing, and the tolerance for disruption all differ between shape and dominate. An undeclared phase means the program is permanently in an undifferentiated grind.

The share of adversary attempts canalized into instrumented terrain, and the share stopped before reaching data terrain. Positional advantage is what obstacles, canalization and deception buy: not fewer attempts, but attempts happening on ground you own and observe. It is a measure of effectiveness, and it moves slowly.

The defensive actions the SOC may execute without escalation: revoke a session on confirmed account takeover, quarantine an endpoint, block named infrastructure. Everything else needs the Authorizing Official — degrading a public service, for instance. This list is the single largest lever on defensive tempo that leadership controls, and its width should be a deliberate decision reviewed each cycle rather than an artifact of whoever was nervous when it was written.

Whether an adversary starting from a declared position can arrive at a decisive point across permitted paths. The assessment runs on permitted paths only — a denied path is not a route unless it fails — and starts from every declared threat-actor position, not only the internet. The answer is recorded every cycle whichever way it comes out; where a point is reachable, the shortest path becomes the remediation target, and where it is not, the specific denied paths preventing it become the barrier set.

Restoring the mission on evidence rather than on hope. Declared recovery time and recovery point objectives per mission service, means of recovery held outside the production identity plane, a trusted rebuild path that covers the identity plane itself, restored data verified against an independent integrity record, and the whole thing exercised on a stated cadence. The indicator is not that a plan exists but that every recovery objective has been demonstrated inside its stated period.

The inverse of coverage, weighted and rolled up the same way, so that it lands on a named mission rather than on the estate in aggregate. Its value is that it is stated as a number attached to a consumer, which makes it something an Authorizing Official can accept in writing (CG-4) instead of something that accumulates unremarked in a register.

The standing statement of which defensive actions may be executed without escalation, by whom, against what, and with what recording obligation — plus what requires the Authorizing Official. Governance owns the document, the SOC drafts what it needs to operate, the Authorizing Official approves it. Without it, every containment decision is an escalation, and tempo is capped by the availability of an executive.

The living situational picture the SOC and hunt work from and the intelligence cell fuses into: what is currently believed about the ground, the adversary and the defense, with confidence attached, updated continuously rather than assembled for a meeting. It is also the artifact that turns out to be audit evidence of a functioning, continuously-monitored program — which is a by-product, not the purpose.

The defensive campaign plan: which forms of maneuver apply, on which terrain, in what sequence, with which main and supporting efforts, and with branches and sequels attached. Screen → Ambush → Delay → Counterattack → Exploitation is a scheme; a list of purchased products is not. The scheme is a deliverable — one graphic and a narrative — and it is what the Authorizing Official actually approves.

What the defense does after this engagement ends, planned in advance for each plausible outcome. After a repelled intrusion: harvest indicators into detections, close the exploited avenue, update the overlay and the intelligence requirements, and share to the community. After a successful intrusion: reconstitution, and a terrain picture that has changed. The point of pre-planning is that the hours after an incident are the hours when nobody has the attention to plan.

Defensive work whose purpose is to make the main effort succeed: endpoint detection on mission-staff workstations and the log pipeline, when the main effort is the identity plane and the crown-jewel records. Supporting efforts are legitimate, funded and necessary. They lose the argument when resources are contested, and knowing that in advance is what makes the designation useful.

The rate at which the defense detects, decides and acts, measured against the rate at which the adversary advances and adapts. ASOM-Fed measures the defender side directly (TA-1) and estimates the adversary side (TA-2), and declares a threshold below which the deficit escalates (TA-3). Tempo is also degradable: TA-5 requires a declared trigger for the conditions under which the defense is no longer keeping up, so that load is shed deliberately.

The defender’s decision tempo — detect to decide to contain — set against adversary dwell time. It is the signature ASOM-Fed metric and the one that can be honestly lost: a cycle is won when temporal advantage is positive at a stated confidence level. Positive means the defender’s loop closes faster than the adversary can adapt, not merely that a service was restored.

A grouping of elements sharing a boundary that is actually enforced by a named technical control. The definition is deliberately strict — zones that exist on paper but are not technically enforced are recorded as findings, not as zones — because “inside” and “outside” have to be properties of the model rather than assumptions in somebody’s head. Every element sits in exactly one zone, and a new element defaults to none until placed.