Control Statement
Every designated decisive point shall have at least one defensive move assigned and operational, and shall meet a defined minimum effective coverage.
Purpose. To ensure designation produces protection, so that identifying a decisive point is an act with consequences rather than an annotation.
Discussion
The gap between designation and protection is where most programs fail. An element can be starred on the overlay for four consecutive cycles with a planned maneuver against it and never receive one. The *operational* qualifier is doing the work here: a move recorded as planned or partial does not satisfy the floor, because an adversary is not slowed by intent.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Number of decisive points with no operational defensive move assigned
- Number of decisive points below the declared minimum effective coverage
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Informed | SOC / Defensive Operations: Consulted | Hunt team: Informed | Platform and product owners: Responsible | Governance / RMF / ISSO: Consulted |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- InformedCyber Threat Intelligence cell
- ConsultedSOC / Defensive Operations
- InformedHunt team
- ResponsiblePlatform and product owners
- ConsultedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- KT-1 Decisive Point IdentificationDesignated decisive points
- SM-2 Maneuver AssignmentManeuvers assigned to elements and their implementation state
Produces
- CE-5 Remediation Backlog PrioritizationFloor breaches entering the remediation backlog at highest priority
- CG-4 Findings DispositionFindings where a decisive point sits below its floor
Activities
- L2Assign at least one defensive maneuver to each designated decisive point.
- L2Record the implementation state of each assignment as planned, partial or operational.
- L2Raise a finding where a decisive point carries no operational move.
- L3Define the minimum effective coverage floor and the basis on which it was set, and obtain the accountable authority's approval recording the date relative to first measurement (GA4).
- L3Compute effective coverage per decisive point, weighting by implementation state so that partial assignments do not count in full, and excluding moves recorded as constrained under FO-4 so that a decisive point on operational technology is scored against achievable coverage rather than against a floor it cannot reach.
- L3Assign an owner and a target date to each decisive point below the floor.
- L3Verify by sampling that moves recorded as operational are present and functioning in production, not merely licensed.
- L4Trend the number of decisive points below the floor across cycles and escalate where the count fails to fall.
- L4Measure the elapsed time from designation to first operational move, since that interval is the window in which designation was decorative.
- L5Re-base the floor from exercise and incident evidence rather than leaving it at the value first chosen.
Measurement
Percentage of decisive points meeting the coverage floor.
Median elapsed time from designation to first operational move.
Evidence and Assessment
Findings list; per-asset maneuver assignment in the Register; sampling record.
Test each decisive point for assigned and operational moves; examine effective coverage against the defined floor; test a sample of "operational" states against production reality.
Related Guidance
- SC-7
- AC-6
- SI-4
- PR.AA-05
- PR.PS-01
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M2Defense in DepthEnsure no single failure is decisive.11 of 18 techniques — M2.02, M2.03, M2.04, M2.06, M2.07, M2.08, M2.09, M2.10, M2.12, M2.13, M2.15
- M3EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy.7 of 20 techniques — M3.01, M3.04, M3.05, M3.07, M3.09, M3.10, M3.15
- M4Obstacle / CanalizationForce the adversary onto ground you own and watch.4 of 17 techniques — M4.05, M4.06, M4.09, M4.10
- M6DelayBuy decision time and prevent the adversary culminating on the objective.2 of 10 techniques — M6.03, M6.09
- M8Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open.2 of 17 techniques — M8.04, M8.09
- M5AmbushTrade space for information and time, and impose cost.1 of 13 techniques — M5.01
- M11ReconstitutionRestore the mission on evidence, not on hope — and prove it before you need it.1 of 11 techniques — M11.02
Terrain It Is Named On
Applies to all ten layersSets the minimum protection the layer’s decisive point must hold regardless of its rolled-up coverage.
Artifacts It Stands On
- producesDecisive point registerThe elements whose control confers decisive advantage — each carrying the evidence that raised it above merely important, and the protection floor it owes as a result.
- consumesScheme of maneuverOne graphic and one narrative: which forms of maneuver are sited where, in what sequence. The assignment record behind it carries the element, the avenue and the implementation state for every move.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsiblePlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- ConsultedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- ConsultedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.
- InformedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- InformedHunt teamCounterattack. Works the hypotheses that Fuse raises.