Eleven Forms, in Full.
The catalog states what each form of defensive maneuver is for. This is the reference treatment: the terrain it consumes, every cataloged technique that implements it, the campaign phases it dominates, the controls that assess it — and the part no catalog carries, which is when to choose it, what holding it costs, and how it fails while still reporting green.
Seven Questions, Answered the Same Way Every Time.
A form is chosen against a situation, not collected. Each entry is written so that a leader can answer “should we be doing this one?” without reading the other ten, and so that an assessor can find the controls that would prove it.
Intent, mechanism, indicator
What the commander is buying, what implements it, and the observable that shows it worked.
Terrain consumed
Which layers the form is actually emplaced on, and where its weight falls.
Techniques
The cataloged entries, grouped by the layer they sit on, each with its own observable.
Campaign phasing
The phases where the form is the dominant effort, and those where it merely participates.
Assessment
The controls that test it, derived from the controls its own techniques name.
Employment
When to choose it, what it costs, and the specific ways it fails while still reporting green.
Sequencing
What is normally emplaced before it, and what it hands off to.
Grouped by When They Do Their Work.
A scheme of maneuver names a sequence with one designated main effort — not all eleven at once. The bands below are the ordinary order of employment: shaping forms are emplaced on your own timeline, contact forms trade something for time or the initiative, and consolidation forms are the ones the queue eats.
Shaping
Employed before contact, on ground of your choosing and on your own timeline. These forms are cheap to emplace and expensive to retrofit under fire.
Gain early warning and buy reaction time before the adversary touches key terrain.
RoleThe form that opens the campaignIndicatorThreats are detected before they reach key terrain.PreconditionSomething on the far side of the screen must be able to act inside the warning’s useful life. Warning delivered to an organization that cannot move is not early warning; it is anxiety with a timestamp.Ensure no single failure is decisive.
RoleThe form that makes no single failure decisiveIndicatorAn adversary must defeat three or more independent controls to reach data terrain.PreconditionA terrain overlay that names the crown-jewel record set. Depth is measured toward something; layering applied uniformly across an estate is not depth, it is spend.Make identity, not network location, the decisive plane — surround the adversary with policy.
RoleThe usual main effortIndicatorA stolen credential, on its own, yields no movement.PreconditionA policy decision point that something actually enforces. An authorization engine no service consults is a document, and it will score well.Force the adversary onto ground you own and watch.
RoleThe form that chooses the groundIndicatorObserved lateral attempts land in instrumented segments.PreconditionA sensor on the corridor. An obstacle that funnels movement into unmonitored ground has made the adversary’s route more predictable and told you nothing.Disrupt adversary staging before the attack is launched.
RoleThe form that uses someone else’s contactIndicatorA named campaign never reaches the avenue of approach.PreconditionAn intake path with a clock on it. A spoiling attack is only available during the window between a partner publishing and the adversary arriving, and that window is usually days.In contact
Employed while the adversary is on the estate. These forms trade something — availability, mission friction, the collection you were running — for time or for the initiative.
Trade space for information and time, and impose cost.
RoleThe cheapest high-confidence detection availableIndicatorThe adversary interacts with a decoy, producing a detection with no false-positive budget.PreconditionAn alert path that ends in a human within minutes. A decoy is a detection with no false-positive budget, and routing it into a queue that is triaged tomorrow throws that property away.Buy decision time and prevent the adversary culminating on the objective.
RoleThe form that buys decision timeIndicatorAdversary tempo drops below defender decision tempo.PreconditionA declared availability floor. Delay is deliberate degradation, and without a floor agreed in advance the SOC will either apply it too late or be overruled while applying it.Seize the initiative and evict before the adversary reaches the objective.
RoleThe form that seizes the initiativeIndicatorMean time to evict is inside the adversary’s dwell budget.PreconditionA hypothesis. Hunting without one is sampling, and sampling an estate of this size returns whatever the analyst already expected to find.Give ground deliberately to preserve the force. Degrade gracefully; never fail open.
RoleThe form that is hardest to authorizeIndicatorContainment is achieved without losing statutory availability.PreconditionA rehearsed degraded mode and a stated statutory availability floor. Without both, retrograde under contact is indistinguishable from an outage, and it will be treated as one.Consolidation
Employed after the attempt is defeated. These are the forms most often skipped, because the incident is closed and the queue is not.
Convert contact into durable advantage rather than closing the ticket.
RoleThe form that is skippedIndicatorThe same avenue of approach is never successfully used twice.PreconditionA dwell reconstruction from the incident. You cannot close an avenue you have not reconstructed, and the reconstruction gets harder every day after the ticket closes.Restore the mission on evidence, not on hope — and prove it before you need it.
RoleThe form that is asserted and not demonstratedIndicatorEvery recovery objective has been demonstrated within its stated period.PreconditionA recovery objective per mission service, signed by the service owner. Without a stated time and a stated tolerable data loss, recovery cannot succeed or fail — it can only take however long it takes.Which Forms Carry Which Phase.
The campaign moves through six phases over months; the operating cycle turns inside all of them. A form named dominant here is the main effort for that phase — the others are still employed, but they are supporting it rather than being resourced first.
| Phase | Cyber objective | Dominant forms |
|---|---|---|
| Phase 0 — ShapeSet conditions | Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence. | |
| Phase I — DeterRaise adversary cost | Visible hardening, a deception grid, and a stated attribution posture. | |
| Phase II — Seize InitiativeContest first contact | Detect early, canalize movement, and buy decision time. | |
| Phase III — DominateDefeat the attempt | Hunt, contain, evict. | |
| Phase IV — StabilizeRestore secure operations | Eradicate, verify, and preserve availability through the recovery. | |
| Phase V — Enable / RestoreHand back to garrison | Recover, harden, and update the doctrine and the intelligence requirements. |
Phase 0 — Shape
Set conditions
- Cyber objective
- Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
Phase I — Deter
Raise adversary cost
- Cyber objective
- Visible hardening, a deception grid, and a stated attribution posture.
- Dominant forms
Phase II — Seize Initiative
Contest first contact
- Cyber objective
- Detect early, canalize movement, and buy decision time.
- Dominant forms
Phase III — Dominate
Defeat the attempt
- Cyber objective
- Hunt, contain, evict.
- Dominant forms
Phase IV — Stabilize
Restore secure operations
- Cyber objective
- Eradicate, verify, and preserve availability through the recovery.
Phase V — Enable / Restore
Hand back to garrison
- Cyber objective
- Recover, harden, and update the doctrine and the intelligence requirements.
Dominance is taken from the campaign model in the framework, not restated here. Each form’s own entry lists the wider set of phases in which at least one of its techniques is employed, which is always the larger number.
New to this vocabulary? Form of maneuver, technique and control are different classes of thing, and swapping two of them produces work that looks correct and decides nothing. The object model states each one with the question it answers and the class it is most often mistaken for.