Intent, Mechanism and Indicator
Make identity, not network location, the decisive plane — surround the adversary with policy.
Role. The usual main effort
Phishing-resistant MFA, continuous authorization, conditional access, just-in-time privilege.
A stolen credential, on its own, yields no movement.
Terrain It Consumes
Derived from where the form’s techniques are actually emplaced. The highlighted layer is the one the catalog names as its principal ground — the rest is terrain the form still has to touch, and that spread is how much of the estate employing it implicates.
- T1IdentityThe high ground16 techniques · principal ground
- T2DevicesThe entry fords2 techniques
- T7WorkforceTerrain that is also the force1 technique
- T9Supply ChainThe lines of communication1 technique
Campaign Phasing
Dominance is taken from the campaign model; participation is derived from the techniques themselves. A form is usually present in more phases than it leads, and confusing the two is how a scheme ends up with no main effort.
| Phase | Role | Phase objective | Techniques employed |
|---|---|---|---|
| Phase 0 — ShapeSet conditions | Dominant — main effort | Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence. | 20 of 20 |
| Phase I — DeterRaise adversary cost | Dominant — main effort | Visible hardening, a deception grid, and a stated attribution posture. | 10 of 20 |
| Phase II — Seize InitiativeContest first contact | Supporting | Detect early, canalize movement, and buy decision time. | 3 of 20 |
| Phase III — DominateDefeat the attempt | Supporting | Hunt, contain, evict. | 2 of 20 |
| Phase IV — StabilizeRestore secure operations | Supporting | Eradicate, verify, and preserve availability through the recovery. | 1 of 20 |
Phase 0 — Shape
Set conditions
- Role
- Dominant — main effort
- Phase objective
- Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
- Techniques employed
- 20 of 20
Phase I — Deter
Raise adversary cost
- Role
- Dominant — main effort
- Phase objective
- Visible hardening, a deception grid, and a stated attribution posture.
- Techniques employed
- 10 of 20
Phase II — Seize Initiative
Contest first contact
- Role
- Supporting
- Phase objective
- Detect early, canalize movement, and buy decision time.
- Techniques employed
- 3 of 20
Phase III — Dominate
Defeat the attempt
- Role
- Supporting
- Phase objective
- Hunt, contain, evict.
- Techniques employed
- 2 of 20
Phase IV — Stabilize
Restore secure operations
- Role
- Supporting
- Phase objective
- Eradicate, verify, and preserve availability through the recovery.
- Techniques employed
- 1 of 20
Employment
When to Choose It
Choose envelopment as the main effort whenever the adversary’s plan runs through a credential — which, in a federal estate with public-facing services, is nearly always. It is the only form that degrades the value of every subsequent adversary action at once: if a stolen credential yields no movement, phishing, password spray, token theft and insider misuse all lose most of their return in the same move.
Precondition
A policy decision point that something actually enforces. An authorization engine no service consults is a document, and it will score well.
What It Costs
Paid in friction and in concentration. Friction lands on the workforce and on external users, and the exception requests will come from the most senior and most targeted people in the agency. Concentration is the deeper cost: envelopment trades a distributed problem for a single, extremely valuable one. Whoever holds the policy engine holds the estate, and the break-glass path is where that bargain leaks.
Rules of Engagement
Session and token revocation on confirmed account takeover should be pre-authorized — it is the highest-tempo fire available and hesitation is measured in exfiltrated records. Suspending a federation trust, or forcing an estate-wide credential reset, affects mission partners and needs the AO.
How It Fails
Not whether it fails — how. Each of these is a state in which the form is still reported as implemented and has stopped producing the advantage it was chosen for.
- Machine and service identities are left outside the envelope. Human authentication is phishing-resistant and continuously evaluated; the service account that runs the nightly export has a static secret and a decade of standing privilege.
- Federation is extended to a partner whose identity assurance you cannot see, which imports their weakest authenticator into your policy engine.
- Break-glass accounts are created for the recovery case and then never constrained, monitored or rotated — the one credential guaranteed to work is the one nobody watches.
- Exemptions accumulate. Each is defensible in isolation and the aggregate is a bypass, because exemptions are granted to exactly the population an adversary targets.
- The identity plane itself is not monitored for tamper. Policy is evaluated correctly against a policy the adversary edited.
Techniques (20)
Grouped by the terrain layer each is emplaced on. Techniques are the perishable layer of the framework — they churn, the form does not — so each is stated as what it does and the observable that shows it is working, never as a product.
T1 · Identity — 16 techniques
- M3.01
Phishing-Resistant Authentication
Move the population to authenticators that cannot be relayed or replayed by a proxy.
IndicatorCredential phishing yields no usable authentication.
Phases- 0
- I
- M3.02
Conditional Access Policy Engine
Concentrate access decisions in one policy decision point that sees identity, device, network and behavior together.
IndicatorAccess decisions are made in one place and are inspectable.
Phases- 0
- I
- M3.03
Continuous Authorization
Re-evaluate authorization during a session on changed signal, rather than only at sign-in.
IndicatorA session that becomes risky is downgraded mid-flight.
Phases- 0
- II
- M3.04
Just-in-Time Privilege
Grant privilege for a bounded task and window, with the grant itself recorded as an event.
IndicatorStanding privileged sessions approach zero.
Phases- 0
- I
- M3.06
Machine and Service Identity Governance
Give non-human identities owners, expiry and scope on the same terms as human ones.
IndicatorEvery service account has a named owner and an expiry date.
Phases- 0
- M3.07
Standing Privilege Elimination
Systematically remove permanent administrative rights, replacing them with request-and-grant paths.
IndicatorPermanent privileged entitlements trend to a declared floor.
Phases- 0
- I
- M3.08
Identity Lifecycle Enforcement
Bind joiner, mover and leaver events to authoritative sources so access follows the person, not the ticket.
IndicatorDeparture removes access within the stated interval, provably.
Phases- 0
- M3.09
External-User Identity Assurance
Apply proportionate identity assurance to public and partner users of mission services without denying access to the public.
IndicatorAccount takeover of external users falls while service access holds.
Phases- 0
- I
- M3.11
Session and Token Revocation Path
Maintain a tested path to invalidate sessions and tokens estate-wide within a stated interval.
IndicatorRevocation completes inside the interval the rules of engagement assume.
Phases- 0
- III
- M3.12
Authorization Policy as Code
Express access policy as reviewed, version-controlled, testable code rather than console state.
IndicatorPolicy change is reviewable and revertible like any other change.
Phases- 0
- M3.13
Federation Trust Boundary Control
Enumerate every federated trust into the estate, own each one, and constrain what it may assert.
IndicatorEvery inbound trust has an owner, a scope and a suspension path.
Phases- 0
- I
- M3.14
Entitlement Recertification
Review entitlements on a cadence against actual use, and remove what is not used.
IndicatorUnused entitlements are removed rather than recertified.
Phases- 0
- M3.15
Break-Glass Account Control
Hold emergency accounts under split control with alerting on any use, so the last resort is not the soft target.
IndicatorBreak-glass use is always deliberate and always noticed.
Phases- 0
- IV
- M3.16
Token Replay Protection
Bind issued tokens to sender and context so a captured token cannot be replayed from elsewhere.
IndicatorReplayed tokens fail outside their issuing context.
Phases- 0
- II
- M3.17
Authentication Anomaly Scoring
Score authentication against the behavioral baseline and feed the score back into the policy decision point.
IndicatorAnomalous authentication changes the access decision automatically.
Phases- 0
- II
- M3.18
Identity Provider Tamper Detection
Treat the identity provider as decisive terrain: alert on federation, policy, key and admin changes independently of the provider itself.
IndicatorChanges to the identity plane are detected out-of-band.
Phases- 0
- III
T2 · Devices — 2 techniques
- M3.05
Privileged Access Workstations
Require administration of decisive systems from dedicated, hardened, separately governed endpoints.
IndicatorNo decisive system is administered from a general-purpose desktop.
Phases- 0
- I
- M3.10
Device-Bound Credentials
Bind credentials cryptographically to hardware so that stolen material cannot be spent elsewhere.
IndicatorExported credential material is unusable off its device.
Phases- 0
- I
T7 · Workforce — 1 technique
- M3.19
Human-to-Account Binding
Bind every privileged account to a named, current, cleared human, so an orphaned credential has nowhere to hide.
IndicatorNo privileged account exists without a named accountable holder.
Phases- 0
- I
Controls That Assess It
Derived from the controls the form’s own techniques name, so the assessment surface cannot disagree with the catalog. A control reached by many techniques is load-bearing for this form; one reached by a single technique is not, and an assessor sampling it will learn very little.
By Family
- SMScheme of Maneuver2 controls · reaches 13 of 20 techniques
- IDIdentity Terrain5 controls · reaches 12 of 20 techniques
- KTKey Terrain and Decisive Points3 controls · reaches 10 of 20 techniques
- TMTerrain Management4 controls · reaches 4 of 20 techniques
- CGCommand and Governance3 controls · reaches 3 of 20 techniques
- CECycle Execution and Assurance1 control · reaches 2 of 20 techniques
- DVDevices Terrain1 control · reaches 2 of 20 techniques
- TATempo and Temporal Advantage2 controls · reaches 2 of 20 techniques
- WFWorkforce Terrain2 controls · reaches 2 of 20 techniques
- LCLines of Communication1 control · reaches 1 of 20 techniques
By Control
- SM-2 Maneuver Assignment9 techniques — To bind defensive intent to specific ground, so that coverage reflects what protects which element rather than what the program has bought.
- KT-2 Decisive Point Protection Floor7 techniques — To ensure designation produces protection, so that identifying a decisive point is an act with consequences rather than an annotation.
- SM-3 Implementation State Tracking5 techniques — To make the coverage figure reflect what is defending the estate rather than what is intended to, by weighting mitigation by implementation state.
- ID-1 Identity Plane Definition3 techniques — To make identity positional, so that the plane controlling movement everywhere else is itself defensible ground rather than an assumed service.
- ID-2 Credential Strength and Binding3 techniques — To ensure the credential is as strong as the access behind it, so that proofing and authentication assurance are matched rather than assumed.
- ID-3 Authentication Assurance3 techniques — To ensure authentication strength varies with what is being reached, and that the level achieved is available to the decision that relies on it.
- ID-5 Authorization Decision Integrity3 techniques — To ensure the policy that governs movement is actually consulted and cannot be altered without trace.
- CE-2 Priority Intelligence Requirements2 techniques — To direct analytic effort at named questions, so that collection and hunting answer what the accountable authority needs rather than processing what arrives.
- DV-2 Device Posture as an Access Precondition2 techniques — To ensure a compromised or non-compliant device cannot spend a valid credential, closing the gap `M3` Envelopment leaves when identity alone is enforced.
- ID-4 Identity Assertion Protection2 techniques — To prevent a valid authentication from becoming a durable, portable credential in an adversary's hands.
- KT-1 Decisive Point Identification2 techniques — To concentrate defensive effort on the small number of elements whose loss is decisive, so that priority is a stated judgment rather than an emergent property of the asset register.
- TA-4 Pre-authorized Response2 techniques — To remove authority latency from the decision loop, so that the segment most programs cannot shorten with tooling is shortened by governance.
- WF-2 Privileged Human Register2 techniques — To ensure privilege is held by accountable people, so that every privileged action has a person behind it.
- CG-3 Rules of Engagement1 technique — To let operators act inside a known mandate rather than guessing at one, and to make the boundaries of that mandate legally and operationally sound.
- CG-4 Findings Disposition1 technique — To ensure every finding reaches a decision, so that the open set reflects work in progress rather than accumulated neglect.
- CG-5 Control Inheritance Mapping1 technique — To keep the framework additive, so that adopting it adds assessment effort only where it adds assessable content.
- KT-5 Barrier Sufficiency1 technique — To make the barriers on which negative reachability results depend into named, owned, monitored controls, so that the assurance KT-4 provides cannot be silently withdrawn.
- LC-3 Supplier Access Constraint1 technique — To keep supplier access scoped, observable, and revocable by the agency rather than by the supplier.
- TA-1 Decision Loop Measurement1 technique — To make the defender's tempo a measured quantity rather than an impression, so that the numerator of temporal advantage exists at all.
- TM-2 Defensive Layer Classification1 technique — To make posture summable and comparable by layer, and to force an explicit ownership decision for every element.
- TM-5 Connection and Denied-Path Register1 technique — To record connectivity as three distinct states — permitted, denied, unknown — so that reachability conclusions rest on tested denials rather than on absence of evidence.
- TM-6 Terrain Currency1 technique — To keep the overlay current against both the clock and the change, so that planning is conducted against ground as it currently is.
- TM-7 Terrain Ownership1 technique — To attach every element to a person who can be asked to act, so that findings convert into work rather than accumulating.
- WF-5 Separation and Revocation Tempo1 technique — To close the window between a person ceasing to be trusted and their access ceasing to work.
The scheme-of-maneuver controls test that identity moves are assigned to named terrain and driven to an implementation state rather than assumed from a purchase; the key-terrain controls test whether the policy decision point is identified as decisive and defended as such; the tempo controls test revocation speed. Recertification evidence is where over-claimed envelopment usually breaks: ask for the last cycle’s entitlement decisions, not the policy document.
Sequencing
A scheme names a sequence, not a set. These are the ordinary neighbors of this form — not a mandatory order, but the order in which each one’s preconditions are usually met.
Typically Preceded By
- M2 Defense in DepthThe envelope has to be enforced somewhere; depth supplies the enforcement points.
- M1 Screen / GuardCredential exposure and authentication-geography baselines tell the envelope what normal is.
Typically Followed By
- M4 Obstacle / CanalizationIdentity constrains who may move; canalization constrains where.
- M6 DelayStep-up and session reduction are delay riding on the envelope.
Named as a successor by M2 Defense in Depth. Derived from those forms’ own declarations, so the two directions of the sequence cannot disagree.
Named as a predecessor by M4 Obstacle / Canalization, M6 Delay. Derived the same way, from the other direction.