ASOM-Fedv6.1Open the explorer
M8 · In contact · 17 techniques

Isolation / Retrograde

Give ground deliberately to preserve the force. Degrade gracefully; never fail open.

Intent, Mechanism and Indicator

Give ground deliberately to preserve the force. Degrade gracefully; never fail open.

Role. The form that is hardest to authorize

Mechanism

Automated segment severing, credential and session revocation, graceful service degradation that preserves transaction integrity.

Observable indicator

Containment is achieved without losing statutory availability.

Terrain It Consumes

Derived from where the form’s techniques are actually emplaced. The highlighted layer is the one the catalog names as its principal ground — the rest is terrain the form still has to touch, and that spread is how much of the estate employing it implicates.

Campaign Phasing

Dominance is taken from the campaign model; participation is derived from the techniques themselves. A form is usually present in more phases than it leads, and confusing the two is how a scheme ends up with no main effort.

PhaseRolePhase objectiveTechniques employed
Phase 0 — ShapeSet conditionsSupportingContinuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.3 of 17
Phase III — DominateDefeat the attemptDominant — main effortHunt, contain, evict.14 of 17
Phase IV — StabilizeRestore secure operationsDominant — main effortEradicate, verify, and preserve availability through the recovery.7 of 17
Phase V — Enable / RestoreHand back to garrisonSupportingRecover, harden, and update the doctrine and the intelligence requirements.1 of 17

Phase 0 — Shape

Set conditions

Role
Supporting
Phase objective
Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
Techniques employed
3 of 17

Phase III — Dominate

Defeat the attempt

Role
Dominant — main effort
Phase objective
Hunt, contain, evict.
Techniques employed
14 of 17

Phase IV — Stabilize

Restore secure operations

Role
Dominant — main effort
Phase objective
Eradicate, verify, and preserve availability through the recovery.
Techniques employed
7 of 17

Phase V — Enable / Restore

Hand back to garrison

Role
Supporting
Phase objective
Recover, harden, and update the doctrine and the intelligence requirements.
Techniques employed
1 of 17

Employment

When to Choose It

Choose isolation when containment must beat availability — when the alternative to a degraded service is an exposed corpus. This is the form leaders block, because it is the one that looks like losing in a briefing, and it is the one that decides whether a bad afternoon becomes a reportable breach. Degrade to a read-only queue rather than expose the record set. Sever the federation rather than let a compromised partner authenticate. The decision has to be pre-agreed, because it will not survive being made for the first time at 03:00.

Precondition

A rehearsed degraded mode and a stated statutory availability floor. Without both, retrograde under contact is indistinguishable from an outage, and it will be treated as one.

What It Costs

Paid in mission availability, in public trust, and in the political capital of whoever authorizes it. It also costs evidence if done carelessly: severing a segment can destroy the volatile record that the investigation needed, so preservation has to be part of the isolation playbook rather than a subsequent regret.

Rules of Engagement

This is the form that most needs an explicit ROE. Segment severing and session revocation on confirmed compromise should be pre-authorized. Degrading a public-facing statutory service, cutting a third-party connection, or suspending a federation are AO decisions — and the AO’s decision criteria should be written down, in advance, as part of the scheme rather than improvised under contact.

How It Fails

Not whether it fails — how. Each of these is a state in which the form is still reported as implemented and has stopped producing the advantage it was chosen for.

  1. Something fails open. A control that permits traffic when its decision path is unavailable has converted your isolation plan into a denial-of-service trigger for the adversary.
  2. Degraded mode was never rehearsed, so degradation becomes an unplanned outage and the organization learns which dependencies were undeclared during the incident.
  3. Services are restored without preconditions, so the estate comes back into a compromise that was contained rather than removed, and the second incident is the same as the first.
  4. Isolation destroys the forensic record, and the dwell reconstruction — the input to every consolidation activity that follows — cannot be produced.
  5. The severing action is technically available but nobody is authorized to take it, so it is escalated through three layers while the exfiltration completes.

Techniques (17)

Grouped by the terrain layer each is emplaced on. Techniques are the perishable layer of the framework — they churn, the form does not — so each is stated as what it does and the observable that shows it is working, never as a product.

T1 · Identity — 2 techniques

  • M8.02

    Estate-Wide Session Revocation

    Invalidate every session and token across the estate as one action when the identity plane is in doubt.

    IndicatorEstate-wide revocation is exercised and timed, not theoretical.

    Phases
    • III
    Assessed by
  • M8.05

    Federation Trust Suspension

    Suspend an inbound federated trust independently, without dismantling the identity plane around it.

    IndicatorA compromised trust is suspended without an estate outage.

    Phases
    • III
    Assessed by

T2 · Devices — 1 technique

  • M8.17

    Device Decommissioning and Sanitization

    Remove a retired, lost or reassigned device from the estate's trust and sanitize its media within a period derived from what its retained trust could do.

    IndicatorNo device holds estate trust without a current accountable holder.

    Phases
    • 0
    • V
    Assessed by

T3 · Networks — 3 techniques

  • M8.01

    Automated Segment Severing

    Hold a tested capability to sever a segment or zone on decision, without an unplanned outage of everything else.

    IndicatorA zone can be severed inside the interval the plan assumes.

    Phases
    • III
    Assessed by
  • M8.07

    Egress Blackhole

    Cut outbound reachability for a defined scope to stop exfiltration and command channels while analysis continues.

    IndicatorExfiltration stops without severing the whole estate.

    Phases
    • III
    Assessed by
  • M8.10

    Third-Party Connection Cutout

    Cut a specific partner or vendor connection on decision without taking down the shared boundary.

    IndicatorA single external connection can be cut in isolation.

    Phases
    • III
    Assessed by

T4 · Applications and Workloads — 2 techniques

  • M8.03

    Read-Only Service Degradation

    Degrade mission services to read-only or queued operation rather than exposing or losing the corpus.

    IndicatorService degrades gracefully instead of failing open or dark.

    Phases
    • III
    • IV
    Assessed by
  • M8.06

    Cloud Account Quarantine

    Quarantine a cloud account or subscription — revoking roles and cutting peering — as one rehearsed action.

    IndicatorA cloud account is isolated inside the stated interval.

    Phases
    • III
    Assessed by

T5 · Data — 1 technique

  • M8.09

    Contained Forensic Preservation

    Preserve evidence in a way that survives containment and recovery, on storage the adversary could not reach.

    IndicatorEvidence survives the response intact and admissible.

    Phases
    • III
    • IV
    Assessed by

T6 · Operational Technology — 1 technique

  • M8.13

    Safe-State Isolation

    Sever the control network to a defined safe state that preserves the physical process, rather than a network state that abandons it.

    IndicatorIsolation leaves the process safe, not merely disconnected.

    Phases
    • III
    Assessed by

T7 · Workforce — 1 technique

  • M8.14

    Rapid Offboarding and Revocation

    Remove all access from a departing or suspended person in one action, in a time measured against the tempo an insider needs.

    IndicatorFull revocation completes within the stated tempo, evidenced by exercise.

    Phases
    • III
    • IV
    Assessed by

T8 · Facilities — 1 technique

  • M8.15

    Facility Isolation

    Be able to sever a building or floor from the estate without severing the mission, and know in advance what that costs.

    IndicatorA facility can be isolated on a rehearsed procedure without an unplanned outage.

    Phases
    • III
    Assessed by

T9 · Supply Chain — 1 technique

  • M8.16

    Supplier Severance

    Be able to cut a supplier's access immediately and continue the mission, because the alternative is negotiating with an intrusion.

    IndicatorA supplier can be severed within a stated period without halting the mission.

    Phases
    • III
    • IV
    Assessed by

TX · Cross-Cutting — 4 techniques

  • M8.04

    Fail-Secure Default Posture

    Ensure that when a control fails, the estate denies rather than permits — including under load and during recovery.

    IndicatorControl failure denies access rather than bypassing the control.

    Phases
    • 0
    • III
    Assessed by
  • M8.08

    Statutory Availability Floor

    Declare in advance which mission functions may never be taken offline, and design containment around them.

    IndicatorContainment never breaches the declared availability floor.

    Phases
    • III
    • IV
    Assessed by
  • M8.11

    Restoration Preconditions

    Define what must be true before anything comes back — no restoration on hope.

    IndicatorNothing is restored until its preconditions are evidenced.

    Phases
    • IV
    Assessed by
  • M8.12

    Degradation Rehearsal

    Rehearse degradation and severing on the real estate, because an untested retrograde is a plan, not a capability.

    IndicatorEvery severing action has been exercised within its stated period.

    Phases
    • 0
    • IV
    Assessed by

Controls That Assess It

Derived from the controls the form’s own techniques name, so the assessment surface cannot disagree with the catalog. A control reached by many techniques is load-bearing for this form; one reached by a single technique is not, and an assessor sampling it will learn very little.

By Family

By Control

  • SM-5 Branches and Sequels7 techniques — To decide contingency responses before contact, so that the decision loop under pressure is a selection rather than a design exercise.
  • TA-4 Pre-authorized Response5 techniques — To remove authority latency from the decision loop, so that the segment most programs cannot shorten with tooling is shortened by governance.
  • CG-3 Rules of Engagement2 techniques — To let operators act inside a known mandate rather than guessing at one, and to make the boundaries of that mandate legally and operationally sound.
  • DV-5 Device Lifecycle and Sanitization2 techniques — To close the ends of the device lifecycle — the point of entry and the point of exit — where trust is granted and where it is most often left behind.
  • KT-2 Decisive Point Protection Floor2 techniques — To ensure designation produces protection, so that identifying a decisive point is an act with consequences rather than an annotation.
  • TM-5 Connection and Denied-Path Register2 techniques — To record connectivity as three distinct states — permitted, denied, unknown — so that reachability conclusions rest on tested denials rather than on absence of evidence.
  • WF-5 Separation and Revocation Tempo2 techniques — To close the window between a person ceasing to be trusted and their access ceasing to work.
  • CE-1 Cycle Cadence1 technique — To keep the loop turning, so that defensive posture is a maintained position rather than a periodic assessment.
  • CE-6 Cycle Record and Trend1 technique — To answer whether the program is improving — a question no point-in-time assessment can address.
  • CG-1 Defensive Intent1 technique — To give subordinate decisions a reference point, so that people can act correctly without referring upward.
  • CG-4 Findings Disposition1 technique — To ensure every finding reaches a decision, so that the open set reflects work in progress rather than accumulated neglect.
  • CG-5 Control Inheritance Mapping1 technique — To keep the framework additive, so that adopting it adds assessment effort only where it adds assessable content.
  • EN-3 Evidence Preservation1 technique — To ensure the material an engagement depends on still exists when it is needed, and is admissible where that matters.
  • EN-4 Escalation and Engagement Authority1 technique — To remove the search for a decision-maker from the decision loop, which is where the decide segment is usually spent.
  • EN-5 Eradication and Transition to Recovery1 technique — To ensure the adversary is actually gone before the mission is restored, and that the transition is a decision rather than a drift.
  • FC-2 Physical Zone Boundary1 technique — To establish physical boundaries that constrain movement and produce a record of crossing, so that physical terrain can be defended in depth rather than at a perimeter.
  • FC-4 Environmental Continuity1 technique — To know how long the physical ground holds without support, so that recovery objectives are not contradicted by the buildings the services sit in.
  • FO-4 Operational Technology Terrain1 technique — To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
  • ID-4 Identity Assertion Protection1 technique — To prevent a valid authentication from becoming a durable, portable credential in an adversary's hands.
  • KT-5 Barrier Sufficiency1 technique — To make the barriers on which negative reachability results depend into named, owned, monitored controls, so that the assurance KT-4 provides cannot be silently withdrawn.
  • LC-5 Supplier Severance Capability1 technique — To retain the option of cutting a line of communication, so that a compromised or failed supplier is a decision rather than a dependency.
  • RC-1 Recovery Objectives1 technique — To establish what recovery must achieve, so that restoration can succeed or fail rather than simply take however long it takes.
  • SM-6 Maneuver Effectiveness Validation1 technique — To replace assumed effectiveness with demonstrated effectiveness, so the coverage figure reflects what controls do rather than what was assumed of them.
  • TA-1 Decision Loop Measurement1 technique — To make the defender's tempo a measured quantity rather than an impression, so that the numerator of temporal advantage exists at all.
  • TA-5 Tempo Degradation Trigger1 technique — To plan for the periods in which tempo predictably falls, so that the measured advantage is not a statement about the organization's best hours only.
  • TM-4 Trust Zone Definition1 technique — To establish boundaries that something enforces, so that reachability and denied-path analysis rest on configuration rather than on design intent.
  • TM-7 Terrain Ownership1 technique — To attach every element to a person who can be asked to act, so that findings convert into work rather than accumulating.

The maneuver-tracking controls test that degradation modes exist, are owned, and have been exercised; the command controls test that the availability floor and the pre-authorized fire set were declared by an accountable official; the cycle controls test the evidentiary record. Ask for the last degradation rehearsal, and for what it found — a rehearsal with no findings was a demonstration.

Sequencing

A scheme names a sequence, not a set. These are the ordinary neighbors of this form — not a mandatory order, but the order in which each one’s preconditions are usually met.

Typically Preceded By

  • M7 CounterattackIsolation carries what the counterattack could not evict in time.
  • M6 DelayDelay is the graduated version of the same trade; retrograde is where it stops being graduated.

Typically Followed By

Named as a successor by M6 Delay, M7 Counterattack. Derived from those forms’ own declarations, so the two directions of the sequence cannot disagree.

Named as a predecessor by M10 Exploitation & Pursuit, M11 Reconstitution. Derived the same way, from the other direction.