Reference manual · the map

The Whole Manual, and Where It Is Thin.

The manual is past the size a reader can hold: 25 sections and 569 routes, all counted from the data that generates them. This is the index — every section, every control, every layer, form, step, phase, role, product and term — and then the part an index usually leaves out: the 1099 cross-references that wire them together, and an honest statement of which parts of the framework are carrying the weight and which are thin.

569Routes mappedCounted from the data that generates each one

25Sections566 routes in the manual, the rest alongside it

1099Relations tracedCross-references between entries, all derived

78ControlsReached from 5 directions, at minimum 3

How This Page Is Built

Almost Nothing Here Is Written Down.

A map that is maintained separately from the thing it maps is wrong within a month. Every count, list and ranking below is computed from the same modules the manual itself is built from.

Counts Come from the Data

Route counts are the length of whatever array generates the routes — 78 control sheets because the catalog holds 78 controls, 154 technique pages because the technique table holds 154. No number on this page is pinned to another statement of the same number.

Relations Are Inverted, Not Restated

The chain, the assessment surface, the terrain and product maps are each stated once, in one direction, somewhere in the manual. This page reads them the other way using the derivation helpers that already exist, so the two directions cannot disagree.

Only the Reading Is Authored

One line per section saying what it answers, and the interpretation attached to each finding — what a low number means and, more often, what it does not. Interpretation cannot be derived. Everything measurable beside it is.

Unfinished Sections Say So

A section whose data module has not landed is listed and linked with no count at all, and left out of every total, rather than given an estimate. Every section the manual declares currently has data behind it, so nothing here is excluded.

Sections

25 sections, and what each one answers.

The manual is not evenly sized and should not be presented as though it were. MITRE D3FEND alone accounts for 241 of the 569 routes — 42 per cent of everything on this map is one catalog.

Section	Routes	What it answers	Part of
The object modelIndex only — every object class is an anchor on one page	1	Ten object classes, each with the question it answers and the class it is most often mistaken for — and which half of the framework each one belongs to.	Orientation
TerrainOne page per layer	11	Ten layers, thirty-nine sub-towers with their maturity levels made concrete, and the tower rollup.	The ground
MissionsIndex only — no dynamic segment	1	The mission services defense exists to protect, each with a worked Bill of Defense.	The ground
Agency archetypesOne page per archetype	11	Ten federal agency shapes, and which obligations each declares — so a small agency is not marked down for a surface it does not operate.	The ground
Forms of maneuverOne page per form	12	The eleven forms at depth: when to choose each, what it costs, how it fails, what precedes and follows it.	The moves
TechniquesOne page per cataloged technique	155	All 154 cataloged techniques, each with its observable, its terrain, and the controls that assess it.	The moves
The cycleOne page per step	7	Six steps, each with entry and exit criteria, participants, products and failure modes.	The loop
Campaign phasesOne page per phase	7	Six phases, their main effort, and the conditions for moving between them.	The loop
Intelligence requirementsIndex only — no dynamic segment	1	A worked library. If no decision changes on the answer, it is not a requirement.	The loop
ProductsIndex only — every artifact is an anchor on one page	1	The artifacts the framework emits, and for each: what produces it, who owns it, who consumes it.	The loop
RolesOne page per role	7	Six roles, each with every control they are accountable, responsible, consulted or informed on.	Command
Rules of engagementIndex only — no dynamic segment	1	A worked schedule of defensive actions and the authority each needs. Tempo dies in an escalation queue.	Command
Adoption roadmapIndex only — no dynamic segment	1	Eighteen months at phase depth, the first ninety days at week granularity, and the five ways adoption fails.	Command
ControlsThe manual root, one page per family, one sheet per control	93	Seventy-eight controls across fourteen families — statement, purpose, metrics, accountability, activities, assessment.	Judgment
AssessmentIndex only — no dynamic segment	1	How an assessment is run, what evidence is expected, and how capability is scored.	Judgment
Coverage baselineIndex only — no dynamic segment	1	What the output looks like when the reference agency is scored — including where it comes out thin.	Judgment
ObligationsOne page per regime	8	The crosswalk to CSF 2.0, SP 800-53, the RMF and the zero-trust model — including what is not covered.	Judgment
MITRE D3FENDOne page per D3FEND countermeasure reached	241	The technique-level join to D3FEND — what it reaches, what it does not, and the reason recorded for each miss.	Judgment
Threat courses of actionIndex only — no dynamic segment	1	Most likely and most dangerous, modeled against the reference agency’s own terrain.	Judgment
TempoIndex only — no dynamic segment	1	How defender loop time and adversary dwell are measured, and what a deficit obliges you to do.	Judgment
GlossaryIndex only — every term is an anchor on one page	1	The doctrinal vocabulary — origin, federal-cyber meaning, and what each term is commonly confused with.	Apparatus
Doctrinal crosswalkIndex only — no dynamic segment	1	The Army-to-federal translation the framework rests on, including where the analogy strains.	Apparatus
SourcesIndex only — no dynamic segment	1	What the framework takes from each source, what it deliberately does not, and what is original.	Apparatus
Manual mapIndex only — no dynamic segment	1	The whole manual in one derived index, including where its coverage is uneven.	Apparatus
Worked casesOne page per case study	3	The whole cycle run end to end, once ahead of contact and once under it. Counted apart from the manual proper: these sit outside /reference/ because they demonstrate the cycle rather than define it.	Alongside the manual

The object model

Index only — every object class is an anchor on one page

Routes: 1
What it answers: Ten object classes, each with the question it answers and the class it is most often mistaken for — and which half of the framework each one belongs to.
Part of: Orientation

Terrain

One page per layer

Routes: 11
What it answers: Ten layers, thirty-nine sub-towers with their maturity levels made concrete, and the tower rollup.
Part of: The ground

Missions

Index only — no dynamic segment

Routes: 1
What it answers: The mission services defense exists to protect, each with a worked Bill of Defense.
Part of: The ground

Agency archetypes

One page per archetype

Routes: 11
What it answers: Ten federal agency shapes, and which obligations each declares — so a small agency is not marked down for a surface it does not operate.
Part of: The ground

Forms of maneuver

One page per form

Routes: 12
What it answers: The eleven forms at depth: when to choose each, what it costs, how it fails, what precedes and follows it.
Part of: The moves

Techniques

One page per cataloged technique

Routes: 155
What it answers: All 154 cataloged techniques, each with its observable, its terrain, and the controls that assess it.
Part of: The moves

The cycle

One page per step

Routes: 7
What it answers: Six steps, each with entry and exit criteria, participants, products and failure modes.
Part of: The loop

Campaign phases

One page per phase

Routes: 7
What it answers: Six phases, their main effort, and the conditions for moving between them.
Part of: The loop

Intelligence requirements

Index only — no dynamic segment

Routes: 1
What it answers: A worked library. If no decision changes on the answer, it is not a requirement.
Part of: The loop

Products

Index only — every artifact is an anchor on one page

Routes: 1
What it answers: The artifacts the framework emits, and for each: what produces it, who owns it, who consumes it.
Part of: The loop

Roles

One page per role

Routes: 7
What it answers: Six roles, each with every control they are accountable, responsible, consulted or informed on.
Part of: Command

Rules of engagement

Index only — no dynamic segment

Routes: 1
What it answers: A worked schedule of defensive actions and the authority each needs. Tempo dies in an escalation queue.
Part of: Command

Adoption roadmap

Index only — no dynamic segment

Routes: 1
What it answers: Eighteen months at phase depth, the first ninety days at week granularity, and the five ways adoption fails.
Part of: Command

Controls

The manual root, one page per family, one sheet per control

Routes: 93
What it answers: Seventy-eight controls across fourteen families — statement, purpose, metrics, accountability, activities, assessment.
Part of: Judgment

Assessment

Index only — no dynamic segment

Routes: 1
What it answers: How an assessment is run, what evidence is expected, and how capability is scored.
Part of: Judgment

Coverage baseline

Index only — no dynamic segment

Routes: 1
What it answers: What the output looks like when the reference agency is scored — including where it comes out thin.
Part of: Judgment

Obligations

One page per regime

Routes: 8
What it answers: The crosswalk to CSF 2.0, SP 800-53, the RMF and the zero-trust model — including what is not covered.
Part of: Judgment

MITRE D3FEND

One page per D3FEND countermeasure reached

Routes: 241
What it answers: The technique-level join to D3FEND — what it reaches, what it does not, and the reason recorded for each miss.
Part of: Judgment

Threat courses of action

Index only — no dynamic segment

Routes: 1
What it answers: Most likely and most dangerous, modeled against the reference agency’s own terrain.
Part of: Judgment

Tempo

Index only — no dynamic segment

Routes: 1
What it answers: How defender loop time and adversary dwell are measured, and what a deficit obliges you to do.
Part of: Judgment

Glossary

Index only — every term is an anchor on one page

Routes: 1
What it answers: The doctrinal vocabulary — origin, federal-cyber meaning, and what each term is commonly confused with.
Part of: Apparatus

Doctrinal crosswalk

Index only — no dynamic segment

Routes: 1
What it answers: The Army-to-federal translation the framework rests on, including where the analogy strains.
Part of: Apparatus

Sources

Index only — no dynamic segment

Routes: 1
What it answers: What the framework takes from each source, what it deliberately does not, and what is original.
Part of: Apparatus

Manual map

Index only — no dynamic segment

Routes: 1
What it answers: The whole manual in one derived index, including where its coverage is uneven.
Part of: Apparatus

Worked cases

One page per case study

Routes: 3
What it answers: The whole cycle run end to end, once ahead of contact and once under it. Counted apart from the manual proper: these sit outside /reference/ because they demonstrate the cycle rather than define it.
Part of: Alongside the manual

The Controls

All 78 controls, in 14 families.

Every control has a full reference sheet. The family is the unit a program adopts in — a family with one control missing is a family that does not close.

TM

Terrain Management7 controls

KT

Key Terrain and Decisive Points5 controls

ID

Identity Terrain5 controls

DV

Devices Terrain5 controls

SM

Scheme of Maneuver7 controls

TA

Tempo and Temporal Advantage5 controls

EN

Engagement and Pursuit6 controls

CE

Cycle Execution and Assurance7 controls

CG

Command and Governance5 controls

RC

Reconstitution and Recovery5 controls

FO

Federal Obligations7 controls

WF

Workforce Terrain5 controls

FC

Facilities Terrain4 controls

LC

Lines of Communication5 controls

Inventory

Everything Else the Manual Contains, in One List.

The ground, the moves, the loop, the campaign, the people, the artifacts and the vocabulary. Grouped the way the manual groups them, so a reader who knows the shape can jump; one who does not can read down.

Terrain layers10 layers · 39 sub-towers

Five inherited from the zero-trust pillars, four added for federal ground, one cross-cutting. Each layer carries its own sub-towers and maturity ladder.

Forms of maneuver11 forms · 154 techniques

The durable layer. Techniques churn; the categories of maneuver outlive them, which is what lets a leader direct a scheme without being an engineer. The number beside each form is its cataloged techniques.

The operating cycle6 steps

One loop, run on a declared cadence. The number beside each step is the controls that govern it.

Campaign phases6 phases

Declared against a scope, not against an agency, and not a maturity ladder. The number is the forms of maneuver that dominate the phase.

Roles6 roles

Deliberately few. The number beside each is the controls it is named on in any capacity — accountable, responsible, consulted or informed.

Products61 artifacts · 11 groups

What the framework leaves behind. Grouped by the cycle step that produces them, then by the standing artifacts held continuously rather than per cycle.

Agency archetypes10 estates

The Federal Reference Agency is one shape of estate among several. Each archetype lays out a different one, so a reader can find the estate nearest their own. The number is the elements modeled on it.

Worked cases2 studies

The cycle run end to end rather than described. These sit outside the manual because they demonstrate it rather than define it. The number is the beats each study is told in.

Glossary38 terms · 12 letters

Borrowed words are the framework’s largest failure mode, so each term states its origin, its meaning on a federal network, and the term it is commonly confused with.

Connective Tissue

How the Manual Is Wired.

1099 cross-references hold the manual together, and none of them is visible from any single page. Read together they show which controls the framework leans on, which sit at the end of a chain, and where the coverage runs out.

Control → control 286: Declared inputs and outputs, de-duplicated by direction
Technique → control 394: Each technique naming the controls that assess it
Terrain → control 81: Beyond the common spine, which applies everywhere
Product → control 280: Producers plus consumers, from the same flows
Cycle step → control 58: Controls that govern a step, with the job they do in it

The Control Chain

Every control declares what it consumes and what it produces. Inverting those declarations gives each control two degrees: how many controls feed it, and how many it feeds. The second is the one that matters for sequencing — it is the count of what a program starves by skipping the control.

Exhibit 1

The Twelve Most-Connected Controls, by Distinct Neighbors in the Chain

TM-1Terrain Inventory and Overlay

fed by 1

feeds 18

CE-5Remediation Backlog Prioritization

fed by 17

feeds 2

KT-1Decisive Point Identification

fed by 5

feeds 12

KT-3Avenue of Approach Analysis

fed by 11

feeds 5

CE-4Coverage and Residual Risk Computation

fed by 12

feeds 3

CE-7Brief Generation and Distribution

fed by 13

feeds 1

CE-6Cycle Record and Trend

fed by 10

feeds 2

CG-4Findings Disposition

fed by 11

feeds 1

KT-5Barrier Sufficiency

fed by 8

feeds 2

TA-1Decision Loop Measurement

fed by 6

feeds 5

TM-2Defensive Layer Classification

fed by 2

feeds 6

TM-5Connection and Denied-Path Register

fed by 5

feeds 4

Derived by inverting every control’s declared inputs and outputs. Bars are scaled against the largest single figure on the exhibit (18), so the two directions are comparable within a row and across rows.

Terminal — 13 controls

Nothing inside the framework consumes what they produce. Their output leaves it, or stops.

Headwater — 19 controls

Nothing inside the framework feeds them. They draw their inputs from outside it, which makes them the places a program can start without prerequisites.

Both at once — 3 controls

Every flow they declare crosses the boundary in one direction or the other, so the chain cannot say what breaks if they are skipped.

The terrain spine — 17 controls

These run through every layer by construction, which is why the per-layer control lists below exclude them: ten identical links would bury the two or three a layer names for a reason of its own.

Assessment Load

A second, independent measure of how load-bearing a control is: how many of the 154 cataloged techniques name it as the thing that assesses them. A control named by one technique and a control named by thirty are judged on very different amounts of evidence.

Exhibit 2

The Ten Controls Carrying the Most of the Technique Catalog

CE-2Priority Intelligence Requirements

29 techniques · 7 forms

KT-2Decisive Point Protection Floor

28 techniques · 7 forms

TA-4Pre-authorized Response

18 techniques · 7 forms

SM-2Maneuver Assignment

15 techniques · 3 forms

KT-5Barrier Sufficiency

14 techniques · 6 forms

SM-7Deception Emplacement

13 techniques · 1 forms

TM-5Connection and Denied-Path Register

12 techniques · 5 forms

SM-5Branches and Sequels

11 techniques · 3 forms

SM-6Maneuver Effectiveness Validation

10 techniques · 6 forms

TM-6Terrain Currency

9 techniques · 4 forms

Derived from the techniques’ own control declarations. The second figure is the distinct forms of maneuver those techniques belong to — a control named by many techniques within one form is narrower than the first number suggests.

Forms by Control Surface

How wide a net each form of maneuver casts over the control set. Defense in Depth touches 28 controls across 11 families; Spoiling Attack touches 12. The weight column is the form’s weighting in the framework contract — it is a weight, not a technique count, and reading it as one is the error that put a wrong total on this site.

Form	Techniques	Controls named	Families reached	Contract weight
M2 Defense in DepthEnsure no single failure is decisive.	18	28	11 of 14	12
M8 Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open.	17	27	14 of 14	10
M7 CounterattackSeize the initiative and evict before the adversary reaches the objective.	17	25	10 of 14	11
M3 EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy.	20	24	10 of 14	15
M1 Screen / GuardGain early warning and buy reaction time before the adversary touches key terrain.	15	22	11 of 14	7
M5 AmbushTrade space for information and time, and impose cost.	13	17	9 of 14	9
M11 ReconstitutionRestore the mission on evidence, not on hope — and prove it before you need it.	11	16	10 of 14	7
M4 Obstacle / CanalizationForce the adversary onto ground you own and watch.	17	15	9 of 14	10
M10 Exploitation & PursuitConvert contact into durable advantage rather than closing the ticket.	7	14	6 of 14	5
M6 DelayBuy decision time and prevent the adversary culminating on the objective.	10	12	7 of 14	8
M9 Spoiling AttackDisrupt adversary staging before the attack is launched.	9	12	8 of 14	6

M2 Defense in Depth

Ensure no single failure is decisive.

Techniques: 18
Controls named: 28
Families reached: 11 of 14
Contract weight: 12

M8 Isolation / Retrograde

Give ground deliberately to preserve the force. Degrade gracefully; never fail open.

Techniques: 17
Controls named: 27
Families reached: 14 of 14
Contract weight: 10

M7 Counterattack

Seize the initiative and evict before the adversary reaches the objective.

Techniques: 17
Controls named: 25
Families reached: 10 of 14
Contract weight: 11

M3 Envelopment

Make identity, not network location, the decisive plane — surround the adversary with policy.

Techniques: 20
Controls named: 24
Families reached: 10 of 14
Contract weight: 15

M1 Screen / Guard

Gain early warning and buy reaction time before the adversary touches key terrain.

Techniques: 15
Controls named: 22
Families reached: 11 of 14
Contract weight: 7

M5 Ambush

Trade space for information and time, and impose cost.

Techniques: 13
Controls named: 17
Families reached: 9 of 14
Contract weight: 9

M11 Reconstitution

Restore the mission on evidence, not on hope — and prove it before you need it.

Techniques: 11
Controls named: 16
Families reached: 10 of 14
Contract weight: 7

M4 Obstacle / Canalization

Force the adversary onto ground you own and watch.

Techniques: 17
Controls named: 15
Families reached: 9 of 14
Contract weight: 10

M10 Exploitation & Pursuit

Convert contact into durable advantage rather than closing the ticket.

Techniques: 7
Controls named: 14
Families reached: 6 of 14
Contract weight: 5

M6 Delay

Buy decision time and prevent the adversary culminating on the objective.

Techniques: 10
Controls named: 12
Families reached: 7 of 14
Contract weight: 8

M9 Spoiling Attack

Disrupt adversary staging before the attack is launched.

Techniques: 9
Controls named: 12
Families reached: 8 of 14
Contract weight: 6

Terrain Coverage

The same question asked of the ground. Cross-Cutting carries 29 techniques; the thinnest layer carries 7. Every layer has the same number of sub-towers to defend regardless, which is what makes the disparity worth stating rather than smoothing.

Layer	Sub-towers	Techniques	Controls named	Forms holding it primary	Forms supporting
T1 IdentityThe high ground	4	28	11 beyond the spine	M3	3
T2 DevicesThe entry fords	4	13	10 beyond the spine	None	3
T3 NetworksThe corridors	4	22	7 beyond the spine	M1, M2, M4, M8	3
T4 Applications and WorkloadsThe urban terrain	4	18	6 beyond the spine	M6	3
T5 DataThe objective	4	12	6 beyond the spine	M5	3
T6 Operational TechnologyGround you cannot maneuver freely on	4	7	6 beyond the spine	None	3
T7 WorkforceTerrain that is also the force	4	8	7 beyond the spine	None	3
T8 FacilitiesThe physical boundary	4	7	7 beyond the spine	None	3
T9 Supply ChainThe lines of communication	4	10	7 beyond the spine	None	3
TX Cross-CuttingThe enablers of movement	3	29	14 beyond the spine	M7, M9, M10, M11	0

T1 Identity

The high ground

Sub-towers: 4
Techniques: 28
Controls named: 11 beyond the spine
Forms holding it primary: M3
Forms supporting: 3

T2 Devices

The entry fords

Sub-towers: 4
Techniques: 13
Controls named: 10 beyond the spine
Forms holding it primary: None
Forms supporting: 3

T3 Networks

The corridors

Sub-towers: 4
Techniques: 22
Controls named: 7 beyond the spine
Forms holding it primary: M1, M2, M4, M8
Forms supporting: 3

T4 Applications and Workloads

The urban terrain

Sub-towers: 4
Techniques: 18
Controls named: 6 beyond the spine
Forms holding it primary: M6
Forms supporting: 3

T5 Data

The objective

Sub-towers: 4
Techniques: 12
Controls named: 6 beyond the spine
Forms holding it primary: M5
Forms supporting: 3

T6 Operational Technology

Ground you cannot maneuver freely on

Sub-towers: 4
Techniques: 7
Controls named: 6 beyond the spine
Forms holding it primary: None
Forms supporting: 3

T7 Workforce

Terrain that is also the force

Sub-towers: 4
Techniques: 8
Controls named: 7 beyond the spine
Forms holding it primary: None
Forms supporting: 3

T8 Facilities

The physical boundary

Sub-towers: 4
Techniques: 7
Controls named: 7 beyond the spine
Forms holding it primary: None
Forms supporting: 3

T9 Supply Chain

The lines of communication

Sub-towers: 4
Techniques: 10
Controls named: 7 beyond the spine
Forms holding it primary: None
Forms supporting: 3

TX Cross-Cutting

The enablers of movement

Sub-towers: 3
Techniques: 29
Controls named: 14 beyond the spine
Forms holding it primary: M7, M9, M10, M11
Forms supporting: 0

Product Flows

Each artifact is produced by the controls that declare it as an output and consumed by the controls that declare it as an input. Both ends come from the same declarations, so an artifact cannot be claimed as load-bearing by one page and orphaned by another.

Most consumed

Consumed by nothing in the chain — 8

Accountability Across the Control Set

Read across rather than down, the accountability chart states something the prose never does: command is concentrated in one role and the work is not. None of this is authored — it falls out of the sixty individual RACI assignments.

Role	Accountable	Responsible	Consulted	Informed	Controls touched
Authorizing Official / CISOIntent, risk acceptance, and the scheme itself.	78	0	0	0	78 of 78
Cyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.	0	9	27	42	78 of 78
SOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.	0	8	50	20	78 of 78
Hunt teamCounterattack. Works the hypotheses that Fuse raises.	0	3	18	57	78 of 78
Platform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.	0	36	20	22	78 of 78
Governance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.	0	18	34	26	78 of 78

Authorizing Official / CISO

Intent, risk acceptance, and the scheme itself.

Accountable: 78
Responsible: 0
Consulted: 0
Informed: 0
Controls touched: 78 of 78

Cyber Threat Intelligence cell

Frame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.

Accountable: 0
Responsible: 9
Consulted: 27
Informed: 42
Controls touched: 78 of 78

SOC / Defensive Operations

Maneuver. Executes fires and emplaces obstacles inside the standing rules of engagement.

Accountable: 0
Responsible: 8
Consulted: 50
Informed: 20
Controls touched: 78 of 78

Hunt team

Counterattack. Works the hypotheses that Fuse raises.

Accountable: 0
Responsible: 3
Consulted: 18
Informed: 57
Controls touched: 78 of 78

Platform and product owners

Their own terrain. Obstacles get emplaced on their ground, so they site them.

Accountable: 0
Responsible: 36
Consulted: 20
Informed: 22
Controls touched: 78 of 78

Governance / RMF / ISSO

Translating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.

Accountable: 0
Responsible: 18
Consulted: 34
Informed: 26
Controls touched: 78 of 78

Reach: How Many Ways There Are into Each Control

A reader arrives at a control from somewhere — a technique, a terrain layer, a cycle step, an artifact, or a glossary term. Scoring every control against all 5 shows whether the manual is navigable from wherever a reader happens to start. The floor is 3: no control in the catalog is reachable from fewer than that.

Exhibit 3

Controls by the Number of Cross-Sections That Name Them

reached from 0 of 5 — 0 controls
reached from 1 of 5 — 0 controls
reached from 2 of 5 — 0 controls
reached from 3 of 5 — 28 controls
reached from 4 of 5 — 18 controls
reached from 5 of 5 — 32 controls

Derived by intersecting the control set with the technique declarations, the per-layer control lists and the terrain spine, the cycle steps’ governing controls, the product flows, and the glossary’s citations.

Where It Is Thin

An Index That Presents Uniform Coverage over Uneven Material Is Misleading.

Each finding is a measure taken from the data, beside an authored reading of what it means — and, where it applies, what it does not. None of these is a defect list. Several are the correct shape for the thing being described, and say so.

7techniques on Facilities, against 29 on Cross-Cutting

The thinnest terrain layers carry a fraction of the techniques the thickest do

Some of that is honest: the added federal layers are newer and genuinely have fewer distinct moves on them. Some of it is not — a layer with a handful of techniques cannot support a scheme of maneuver that names it as main effort, and a reader planning on that ground should know they are working ahead of the catalog.

5of 10 layers claimed by no form as primary terrain

Several layers are the principal ground of no form of maneuver

Every form declares one layer as its principal ground, and eleven forms cannot cover ten layers evenly. These layers are still reached — each is named as supporting terrain by other forms — but no form is written from their point of view, which is a real asymmetry between the terrain model and the maneuver catalog.

14of 78 controls named by exactly one technique

Controls whose entire technique basis is a single entry

These controls are assessable — the catalog states evidence and a procedure for every one of them. What they lack is a spread of ways to satisfy them, so an assessor and an engineer are likely to converge on the same single implementation, and a weakness in that implementation looks like compliance.

32of 78 controls govern no step of the loop

The cycle does not govern the whole control set

Nearly all of them belong to the families added for federal ground — obligations, workforce, facilities, lines of communication and reconstitution. That is coherent rather than accidental: those controls are held continuously rather than run once per cycle. It is still worth stating, because a program that runs the cycle and nothing else will not touch them.

3of 78 controls whose declared inputs and outputs all cross the boundary

Controls that exchange with nothing else in the framework

Both ends of every flow they declare sit outside the framework. That can be correct — an obligation that consumes an external mandate and emits a report to an external body genuinely has no internal neighbor — but it also means the chain cannot tell you what breaks if the control is skipped.

13of 78 controls with no downstream control

Controls whose output nothing else consumes

A terminal control is not a broken one — reports to oversight bodies are supposed to leave the framework. But every terminal control is a place where an internal quality problem has no internal consumer to notice it, so the only check on the artifact is whoever reads it outside.

8of 61 products with no consuming control

Artifacts no control declares as an input

Each of these is produced, owned and given a refresh cadence, and then read by nothing in the chain. Where the real consumer is an oversight body that is the right answer; where it is not, the artifact is a cost with no declared beneficiary, and the flows are the place to fix it rather than this page.

3of 78 controls named by no layer and absent from the common spine

Controls no terrain layer names

These are the controls that act on the scheme and on tempo rather than on ground, so having no layer is arguably correct. It does mean a reader who navigates the manual by terrain — which is the way the framework tells them to — will never arrive at them.

On the controls with no ground of their own

3 controls are named by no terrain layer and are not on the common spine. They act on the scheme and on tempo rather than on ground, so having no layer is arguably correct — but the framework tells a reader to navigate by terrain, and by that route these controls are unreachable. They are SM-4, SM-5, TA-2.

And Where It Is Not

Four Conditions, Evaluated Rather Than Claimed.

A page that lists only weaknesses is as misleading as one that lists none. Each of these is a check run against the data at build time; if one stops holding, the marker beside it changes and the page says so without anyone editing it.

Every declared flow resolves — holds

286 internal edges and 36 crossing the boundary; 0 naming anything else

Every control is named by at least one technique — holds

394 technique-to-control references across 78 controls

Every control is reachable from more than one cross-section — holds

the least-reached control appears in 3 of the 5 cross-sections

Every family has controls and every form has techniques — holds

14 control families, 11 forms of maneuver, 6 cycle steps, none empty

On sections that have not landed

The manual is still being extended, and a section can have a frozen URL before it has any data. When that happens the row appears here with no count, is linked anyway, and is excluded from every total — never estimated. At the moment there are none: every section this map declares has a data module behind it, and the 566 routes of the manual proper plus the worked cases account for all 569.

New to this vocabulary? The framework fixes 10 object classes, and four of them are ordinary English words doing exact work. The object model states each one with the question it answers and the class it is most often mistaken for.