Intent, Mechanism and Indicator
Convert contact into durable advantage rather than closing the ticket.
Role. The form that is skipped
Harvest indicators into detections, close the exploited avenue, update the terrain overlay and intelligence requirements, share to the community.
The same avenue of approach is never successfully used twice.
Terrain It Consumes
Derived from where the form’s techniques are actually emplaced. The highlighted layer is the one the catalog names as its principal ground — the rest is terrain the form still has to touch, and that spread is how much of the estate employing it implicates.
- T9Supply ChainThe lines of communication1 technique
- TXCross-CuttingThe enablers of movement6 techniques · principal ground
Campaign Phasing
Dominance is taken from the campaign model; participation is derived from the techniques themselves. A form is usually present in more phases than it leads, and confusing the two is how a scheme ends up with no main effort.
| Phase | Role | Phase objective | Techniques employed |
|---|---|---|---|
| Phase IV — StabilizeRestore secure operations | Dominant — main effort | Eradicate, verify, and preserve availability through the recovery. | 2 of 7 |
| Phase V — Enable / RestoreHand back to garrison | Dominant — main effort | Recover, harden, and update the doctrine and the intelligence requirements. | 7 of 7 |
Phase IV — Stabilize
Restore secure operations
- Role
- Dominant — main effort
- Phase objective
- Eradicate, verify, and preserve availability through the recovery.
- Techniques employed
- 2 of 7
Phase V — Enable / Restore
Hand back to garrison
- Role
- Dominant — main effort
- Phase objective
- Recover, harden, and update the doctrine and the intelligence requirements.
- Techniques employed
- 7 of 7
Employment
When to Choose It
Choose exploitation after every contact, including the ones that were repelled trivially. This is the form that converts an incident from a cost into an asset, and it is skipped more often than any other because the pressure at that moment is entirely toward closing the ticket. The discipline it requires is not analytic; it is refusing to declare the incident over until the indicators are detections, the avenue is verified closed, the overlay is updated and the intelligence requirements are revised.
Precondition
A dwell reconstruction from the incident. You cannot close an avenue you have not reconstructed, and the reconstruction gets harder every day after the ticket closes.
What It Costs
Paid by the most tired people in the organization, immediately after the hardest week. There is no tooling that enforces it, and no ticket state that fails when it is skipped, which is why it has to be a named step in the cycle with an accountable owner rather than an expectation.
Rules of Engagement
Detection engineering, overlay revision and requirement updates are standing work. External reporting — to the sector, to partners, to law enforcement — follows the agency’s disclosure authorities and is a command decision, not an analyst’s.
How It Fails
Not whether it fails — how. Each of these is a state in which the form is still reported as implemented and has stopped producing the advantage it was chosen for.
- Indicators are harvested into a spreadsheet and never converted into detections, so the next occurrence is found by the same manual effort.
- The avenue is declared closed without verification. Closure is asserted from the change record rather than tested from the adversary’s position.
- The terrain overlay is not updated, so the next cycle plans from a map the incident already proved wrong.
- Intelligence requirements are unchanged, which means the collection posture still points where the adversary was rather than where they went.
- The lesson stays inside the agency. In a federal community, reporting is not altruism — it is how the next agency’s spoiling attack becomes possible, and how yours does.
Techniques (7)
Grouped by the terrain layer each is emplaced on. Techniques are the perishable layer of the framework — they churn, the form does not — so each is stated as what it does and the observable that shows it is working, never as a product.
T9 · Supply Chain — 1 technique
- M10.07
Supply Chain Lesson Propagation
Feed what a supplier incident taught you back into acquisition and into the terrain register, so the next contract starts from it.
IndicatorSupplier incidents change the acquisition record, not only the ticket.
Phases- V
TX · Cross-Cutting — 6 techniques
- M10.01
Indicator-to-Detection Conversion
Convert every indicator observed in contact into a durable, tested detection rather than a one-time block.
IndicatorContact leaves behind detection, not just a blocklist entry.
Phases- IV
- V
- M10.02
Avenue Closure Verification
Verify by test that the avenue actually used is closed — not that a change was made.
IndicatorThe used avenue fails a deliberate re-test.
Phases- IV
- V
- M10.03
Terrain Overlay Update
Update the terrain overlay with what contact revealed, including everything the map got wrong.
IndicatorThe overlay reflects the estate as contact proved it to be.
Phases- V
- M10.04
Intelligence Requirement Revision
Revise the priority intelligence requirements from what the engagement showed you could not see.
IndicatorRequirements change after contact rather than persisting by inertia.
Phases- V
- M10.05
Community Reporting
Report to CISA and sector partners so the next agency starts from your contact.
IndicatorFindings are shared within the stated reporting window.
Phases- V
- M10.06
Doctrine and Catalog Update
Fold what was learned back into the maneuver catalog, the control set and the rules of engagement.
IndicatorEach engagement changes the doctrine that governs the next.
Phases- V
Controls That Assess It
Derived from the controls the form’s own techniques name, so the assessment surface cannot disagree with the catalog. A control reached by many techniques is load-bearing for this form; one reached by a single technique is not, and an assessor sampling it will learn very little.
By Family
- CECycle Execution and Assurance5 controls · reaches 4 of 7 techniques
- ENEngagement and Pursuit2 controls · reaches 4 of 7 techniques
- CGCommand and Governance2 controls · reaches 3 of 7 techniques
- SMScheme of Maneuver2 controls · reaches 3 of 7 techniques
- TMTerrain Management2 controls · reaches 2 of 7 techniques
- LCLines of Communication1 control · reaches 1 of 7 techniques
By Control
- EN-2 Engagement Reconstruction3 techniques — To establish what actually happened, since every consolidation activity depends on a reconstruction and none of them can be performed without one.
- CG-5 Control Inheritance Mapping2 techniques — To keep the framework additive, so that adopting it adds assessment effort only where it adds assessable content.
- SM-6 Maneuver Effectiveness Validation2 techniques — To replace assumed effectiveness with demonstrated effectiveness, so the coverage figure reflects what controls do rather than what was assumed of them.
- TM-1 Terrain Inventory and Overlay2 techniques — To establish one authoritative positional picture of the estate, so that every later judgment about priority, reachability and risk is made against the same ground.
- CE-2 Priority Intelligence Requirements1 technique — To direct analytic effort at named questions, so that collection and hunting answer what the accountable authority needs rather than processing what arrives.
- CE-4 Coverage and Residual Risk Computation1 technique — To produce a posture figure that can be reproduced and challenged rather than asserted, so that the number carries authority beyond the tool that generated it.
- CE-5 Remediation Backlog Prioritization1 technique — To make the backlog answer where the next hour of work goes, rather than enumerate everything wrong.
- CE-6 Cycle Record and Trend1 technique — To answer whether the program is improving — a question no point-in-time assessment can address.
- CE-7 Brief Generation and Distribution1 technique — To produce one document per cycle that an Authorizing Official can decide from, rather than a dashboard nobody decides from.
- CG-3 Rules of Engagement1 technique — To let operators act inside a known mandate rather than guessing at one, and to make the boundaries of that mandate legally and operationally sound.
- EN-6 Engagement Communication1 technique — To ensure the people who must know, do — inside the agency, across the federal community, and among those the mission serves.
- LC-1 Supplier Terrain Register1 technique — To make third parties positional, so that supplier risk is assessed against what a supplier can reach rather than against what they were contracted to do.
- SM-1 Maneuver Catalog Adoption1 technique — To fix a shared vocabulary of defensive moves stated as intent, so the plan survives replacement of the tools that implement it.
- TM-6 Terrain Currency1 technique — To keep the overlay current against both the clock and the change, so that planning is conducted against ground as it currently is.
The maneuver-tracking controls test conversion of findings into detections and verified closure; the terrain controls test that the overlay was actually revised; the cycle controls test requirement revision and the reporting path. Ask which detections in production were authored as a result of the last incident. If the answer is none, this form is not being run.
Sequencing
A scheme names a sequence, not a set. These are the ordinary neighbors of this form — not a mandatory order, but the order in which each one’s preconditions are usually met.
Typically Preceded By
- M7 CounterattackThe hunt produces the indicators and the reconstruction this form consumes.
- M8 Isolation / RetrogradeWhat forced the retrograde is the finding most worth propagating.
Typically Followed By
- M1 Screen / GuardRevised intelligence requirements re-point the screen for the next cycle.
- M2 Defense in DepthThe exploited avenue is layered so the next attempt meets more than one control.
Named as a successor by M7 Counterattack, M8 Isolation / Retrograde, M11 Reconstitution. Derived from those forms’ own declarations, so the two directions of the sequence cannot disagree.