Reference manual · the Bill of Defense

Every Mission Gets a Bill. This Is What Is on It.

The tower model allocates upward: assets carry a defensive weight, weight rolls through sub-towers into towers, towers are consumed by forms of maneuver, and the whole thing arrives at a mission consumer as a Bill of Defense — what defends this mission, how much of it, and what is left over. Six missions, a 46-row asset register beneath them, and the trace run in both directions: pick a mission and see everything defending it, or pick an asset and see every mission it serves.

Every figure on this page is illustrative

The criticality and exposure scores, the maturity levels the coverage percentages come from, and the recovery objectives are all the Federal Reference Agency profile — a plausible mid-adoption civilian agency, and never a named one. They are not an assessment, not a target, and not a claim about any real estate. They exist so the rollup can be shown working end to end. An adopter replaces every one of them with their own numbers; the shape of the answer is the deliverable, not the arithmetic.

6Mission consumersLayer 3 of the tower model. Each one gets a bill.

46Assets in the registerLayer 0, across 11 pools. Illustrative profile.

755Defensive weight pointsCriticality × exposure, summed. Illustrative.

2.2 ptsSpread across the six billsThe convergence is the finding, not the precision.

How a Bill Is Built

Coverage Flows Upward the Way Cost Does, and Arrives as a Bill.

The model borrows its shape from technology cost allocation, where spend flows from pools through towers to the units that consume it. What flows here is not money — it is defensive coverage and the residual risk left behind it. The provenance of the analogy, and what the framework deliberately does not take from it, is set out on the sources page.

Exhibit 1

The Allocation Chain, with Every Count Taken from the Data It Describes

Layer 0
Asset pools46 assets · 11 pools
Every asset carries a defensive weight — criticality multiplied by exposure, 1 to 25. This is the allocation driver, and nothing above it can be computed without it.
Layer 1a
Sub-towers39 sub-towers
Each asset sits under one sub-tower and inherits its maturity as a coverage percentage. Coverage is never scored twice: the 156 authored ladder statements in the terrain reference are the only place a maturity judgment is made.
Layer 1b
Defense towers10 layers
Sub-towers roll into towers as a weighted mean. A tower’s coverage is what a mission drawing on it actually receives.
Layer 2
Maneuver solutions11 forms · 154 techniques
Forms of maneuver consume tower capability to produce defensive outcomes. Which forms reach a mission is derived from the layers their techniques are emplaced on.
Layer 3
Mission consumers6 missions
The bill arrives here: weighted coverage, residual risk in points and per cent, and the assets, controls and maneuvers behind both numbers.

Nothing in this chain is asserted twice. An asset inherits its coverage from the sub-tower responsible for it; a tower rolls up from its sub-towers; a mission rolls up from the towers it declares it draws on. A number stated at one level and re-stated at another is how a model starts disagreeing with itself.

How to read the four numbers

Weight: Criticality × exposure, 1–25. A mission’s total weight is the sum of what it declares it draws from each layer. Weight is a claim on defense, not a measure of size.
Coverage: The weighted mean of the coverage of every layer the mission draws on, where a layer’s coverage is the weighted mean of its sub-towers’ maturity. It is a percentage of nothing physical — it is the model’s conversion of a maturity judgment into something that can be averaged.
Residual per cent: 100 minus coverage. Easy to read and actively misleading on its own, because it treats a mission with 127 weight points and one with 66 as though they were the same size.
Residual points: Weight multiplied by coverage gap, per layer, summed. This is the figure that ranks. The same 10-point gap is worth 2.5 points on a peripheral asset and 25 on the objective.

The Six Bills

Side by Side, and the Thing They Refuse to Show You.

Read across first, then read the spread. Six missions assessed against ten layers produce six coverage figures that land inside 2.2 points of each other — and residual weights that differ by a factor of 1.99. One of those two numbers is doing work.

Mission consumer	Total weight	Coverage	Residual risk	Layers drawn on	Assets carrying it	Heaviest dependency
Public service deliveryThe public service portal and external-user accounts	118	53.7%	54.7 pts 46.3%	7 of 10	9 outright · 37 allocated	T1 Identity · weight 25
Case processing and adjudicationThe case processing system and mission-staff workflow	127	52.4%	60.5 pts 47.6%	8 of 10	10 outright · 40 allocated	T5 Data · weight 25
Administrative adjudicationThe administrative adjudication and e-filing systems	98	53.2%	45.9 pts 46.8%	7 of 10	12 outright · 37 allocated	T1 Identity · weight 20
Secondary public serviceAdditional public service lines and secondary portals	75	54.4%	34.2 pts 45.6%	6 of 10	10 outright · 33 allocated	T4 Applications and Workloads · weight 16
Public data servicesBulk data and open API surfaces	66	53.7%	30.6 pts 46.3%	5 of 10	6 outright · 29 allocated	T4 Applications and Workloads · weight 20
Fee and financial operationsFee, payment and financial data systems	127	52.2%	60.8 pts 47.8%	8 of 10	9 outright · 40 allocated	T1 Identity · weight 25

Public service delivery

The public service portal and external-user accounts

Total weight: 118
Coverage: 53.7%
Residual risk: 54.7 pts 46.3%
Layers drawn on: 7 of 10
Assets carrying it: 9 outright · 37 allocated
Heaviest dependency: T1 Identity · weight 25

Case processing and adjudication

The case processing system and mission-staff workflow

Total weight: 127
Coverage: 52.4%
Residual risk: 60.5 pts 47.6%
Layers drawn on: 8 of 10
Assets carrying it: 10 outright · 40 allocated
Heaviest dependency: T5 Data · weight 25

Administrative adjudication

The administrative adjudication and e-filing systems

Total weight: 98
Coverage: 53.2%
Residual risk: 45.9 pts 46.8%
Layers drawn on: 7 of 10
Assets carrying it: 12 outright · 37 allocated
Heaviest dependency: T1 Identity · weight 20

Secondary public service

Additional public service lines and secondary portals

Total weight: 75
Coverage: 54.4%
Residual risk: 34.2 pts 45.6%
Layers drawn on: 6 of 10
Assets carrying it: 10 outright · 33 allocated
Heaviest dependency: T4 Applications and Workloads · weight 16

Public data services

Bulk data and open API surfaces

Total weight: 66
Coverage: 53.7%
Residual risk: 30.6 pts 46.3%
Layers drawn on: 5 of 10
Assets carrying it: 6 outright · 29 allocated
Heaviest dependency: T4 Applications and Workloads · weight 20

Fee and financial operations

Fee, payment and financial data systems

Total weight: 127
Coverage: 52.2%
Residual risk: 60.8 pts 47.8%
Layers drawn on: 8 of 10
Assets carrying it: 9 outright · 40 allocated
Heaviest dependency: T1 Identity · weight 25

Coverage does not separate these missions. Residual weight does.

The six coverage percentages run from 52.2% to 54.4% — a band of 2.2 points across the entire model. That looks like precision and is the opposite of it: average enough layers together and every mission converges on the estate’s mean maturity, because most missions draw on most layers. A briefing that ranks missions by coverage per cent is ranking them by rounding error.

Residual points do not converge. They run from 30.6 to 60.8 — Fee and financial operations carries 1.99 times the exposed weight of Public data services, on coverage figures that are 1.5 points apart. That is the number to brief, and it is the number the model was built to produce: weight against gap, not gap alone.

Illustrative — the Federal Reference Agency profile, not an assessment of any real estate. The convergence, however, is structural rather than a property of these particular figures — it is what happens whenever a weighted mean is taken over many components, and it will happen to an adopter’s real numbers too.

Layer 0 · 46 assets

The Asset Register, Which Is the Part That Makes the Trace Run Backwards.

A bill can be produced without an asset register — the towers are enough. The second direction cannot: to pick an asset and see what it protects, there has to be an asset to pick. This register is that row, and its weights are the only scores authored on this page.

Each row declares the sub-tower it sits under, and inherits that sub-tower’s maturity as its coverage. Nothing here scores coverage independently, so the register cannot produce a figure that disagrees with the terrain reference. The whole register carries 755 weight points at 51.9% coverage, leaving 363.4 residual points — of which the heaviest single pool is Application assets at 76.

Exhibit 2

The 11 pools, rolled up from their own rows

Identity assets
T1 Identity
The identity plane and everything that holds a credential. The pool that is usually complete for humans and badly incomplete for the machines.
- Assets5
- Weight96
- Coverage59.1%
- Residual39.3
Carries 6 of the 6 missions outright.
Device assets
T2 Devices
Everything that holds a session. Individually cheap to lose, which is why the register weights them on exposure rather than on what they are worth.
- Assets4
- Weight58
- Coverage56.9%
- Residual25
Carries 4 of the 6 missions outright.
Network assets
T3 Networks
The corridors and the things that constrain them. The pool most likely to be complete on the diagram and stale in the register.
- Assets5
- Weight97
- Coverage65.7%
- Residual33.3
Carries 6 of the 6 missions outright.
Application assets
T4 Applications and Workloads
The systems a mission is actually delivered through, plus the pipeline that produces them — which is in the pool despite carrying no mission of its own.
- Assets8
- Weight152
- Coverage50%
- Residual76
Carries 6 of the 6 missions outright.
Cloud workload assets
T4 Applications and Workloads
The substrate applications run on. Allocated into the same tower as the applications, because a runtime that admits an unsigned image is an application-layer failure.
- Assets2
- Weight31
- Coverage50%
- Residual15.5
Carries no mission outright — every row in this pool reaches its missions by allocation.
Data assets
T5 Data
The holdings, and every copy of them. The copies are the part that gets left out, and they are the part with no access governance on them.
- Assets6
- Weight98
- Coverage49.7%
- Residual49.3
Carries 6 of the 6 missions outright.
Operational technology assets
T6 Operational Technology
Plant and instrumentation on general-purpose networks. Procured by program offices, frequently absent from the security register entirely.
- Assets3
- Weight28
- Coverage35.7%
- Residual18
Carries 1 of the 6 missions outright.
Workforce assets
T7 Workforce
Populations rather than machines. The only pool that is simultaneously the thing defended and the force defending it.
- Assets4
- Weight68
- Coverage44.1%
- Residual38
Carries 2 of the 6 missions outright.
Facility assets
T8 Facilities
Physical space holding production. Weighted low on exposure and high on consequence, which is the inverse of most of the register.
- Assets3
- Weight34
- Coverage38.2%
- Residual21
Carries 2 of the 6 missions outright.
Supply-chain assets
T9 Supply Chain
The lines of communication: who can reach production, what they ship, and the channel it arrives through.
- Assets3
- Weight56
- Coverage42.9%
- Residual32
Carries no mission outright — every row in this pool reaches its missions by allocation.
Cross-cutting assets
TX Cross-Cutting
The enablers of movement. They allocate to no mission at all, and that fact is the sharpest limitation in this model.
- Assets3
- Weight37
- Coverage56.8%
- Residual16
Carries no mission outright — every row in this pool reaches its missions by allocation.

The tower model names six pools, because it was written when the terrain was the five zero-trust pillars and the cross-cutting enablers. Each of the four terrain layers added since brought a pool with it — a supplier is not a network asset and a wiring closet is not a device — so the register carries 11. Applications and workloads is the one tower fed by two pools.

Exhibit 3

The register in full: 46 assets, each with the sub-tower it inherits coverage from

Asset	Pool	Tower · sub-tower	Weight	Coverage	Residual	Missions it carries outright
A-01 ICAM identity provider and policy decision pointThe only row in the register that every mission depends on without exception. Criticality is 5 by construction; exposure is 5 because it fronts external-user self-service.	Identity assets	T1 IdentityAuthorization / PDP	25 5 × 5	50%	12.5 pts	Public service Case processing Adjudication Secondary service Public data Fee and financial
A-02 PKI and PIV credential serviceCarries the staff-facing missions only. Exposure is lower than the identity provider because it is not reachable from the public tier.	Identity assets	T1 IdentityAuthentication (phishing-resistant MFA)	15 5 × 3	75%	3.8 pts	Case processing Adjudication Fee and financial
A-03 External-user account directoryCitizens, businesses, partners and their agents. Maximal exposure, and the population the agency has the least control over — no device management, no joiner-mover-leaver process, no training.	Identity assets	T1 IdentityAuthentication (phishing-resistant MFA)	20 4 × 5	75%	5 pts	Public service Secondary service Adjudication
A-04 Privileged accounts and the access brokerNo mission stops if the broker stops — administration pauses. The weight is high anyway, because this is how the estate is operated and therefore how it would be operated against.	Identity assets	T1 IdentityPrivileged Access (JIT/PAM)	20 5 × 4	50%	10 pts	Nothing outright — allocated only.
A-05 Service and workload identitiesNon-person entities: service accounts, workload identities, pipeline credentials. Routinely over-permissioned and rarely recertified, because the governance process was built for humans.	Identity assets	T1 IdentityIdentity Governance (ICAM)	16 4 × 4	50%	8 pts	Nothing outright — allocated only.
A-06 Mission-staff laptopsLow criticality, maximal exposure — the inversion the device layer is built around. One laptop is worth little; it holds a live session to the tier where records are.	Device assets	T2 DevicesDevice Compliance / Posture	15 3 × 5	50%	7.5 pts	Case processing Adjudication Fee and financial
A-07 Contractor and integrator endpointsManaged by somebody else, to a standard the agency reads about in a contract clause rather than in a posture signal.	Device assets	T2 DevicesMobile & BYOD	15 3 × 5	50%	7.5 pts	Nothing outright — allocated only.
A-08 Server and virtual-machine fleetThe estate that did not move to containers. Lower exposure than the endpoints, and considerably longer-lived, which is the same thing said twice.	Device assets	T2 DevicesServer / Workload Hardening	12 4 × 3	50%	6 pts	Case processing Secondary service
A-09 Build agents and developer workstationsDevices with a route to the pipeline. Weighted as device assets, but their consequence is an application-layer consequence.	Device assets	T2 DevicesEndpoint Protection (EDR)	16 4 × 4	75%	4 pts	Nothing outright — allocated only.
A-10 TIC 3.0 access pointsEvery public-facing mission crosses here. Case processing does not appear, because its users are already inside — which is exactly why the boundary below matters more to it.	Network assets	T3 NetworksPerimeter / TIC 3.0	25 5 × 5	75%	6.3 pts	Public service Adjudication Secondary service Public data Fee and financial
A-11 Edge delivery and volumetric scrubbingThe availability control for the missions where availability is a statutory property rather than a service target.	Network assets	T3 NetworksWAF & DDoS	20 4 × 5	75%	5 pts	Public service Secondary service Public data
A-12 Web application firewall fronting the public tierShares a sub-tower with the scrubbing edge and therefore shares its coverage, which is a fair simplification and worth naming as one.	Network assets	T3 NetworksWAF & DDoS	16 4 × 4	75%	4 pts	Public service Secondary service Fee and financial
A-13 The public-tier / mission-tier boundaryThe decisive point on the network layer: the crossing an adversary who has taken a public service must make for the compromise to be worth anything.	Network assets	T3 NetworksMicrosegmentation	20 5 × 4	50%	10 pts	Case processing Adjudication
A-14 Authoritative and recursive DNSThe second row every mission depends on. It is in the register for the resolution service, and it earns its weight twice over as the estate’s most under-read egress telemetry.	Network assets	T3 NetworksEgress & DNS Control	16 4 × 4	50%	8 pts	Public service Case processing Adjudication Secondary service Public data Fee and financial
A-15 The public service portalThe front door. Maximal on both axes, and the asset most likely to be tested by somebody the agency did not invite.	Application assets	T4 Applications and WorkloadsAppSec (SAST / DAST)	25 5 × 5	50%	12.5 pts	Public service
A-16 The case filing front doorIntake and e-filing. The asset where an availability failure converts directly into a missed statutory receipt date.	Application assets	T4 Applications and WorkloadsAPI Security	25 5 × 5	50%	12.5 pts	Public service Adjudication
A-17 The case processing systemWhere records are worked. Lower exposure, because access is mediated internally — and the highest consequence in the register, because access here is access to records in volume.	Application assets	T4 Applications and WorkloadsAppSec (SAST / DAST)	15 5 × 3	50%	7.5 pts	Case processing
A-18 The administrative adjudication docketLower volume than case processing and a harder deadline, which is a different risk profile wearing the same technology.	Application assets	T4 Applications and WorkloadsAppSec (SAST / DAST)	12 4 × 3	50%	6 pts	Adjudication
A-19 Secondary public service portalsDelivered by a different program on a different schedule. The exposure is the same as the primary portal; the attention is not.	Application assets	T4 Applications and WorkloadsAppSec (SAST / DAST)	15 3 × 5	50%	7.5 pts	Secondary service
A-20 The public bulk data and open API surfaceConfidentiality is deliberately low here, so criticality reads low on a data-derived scale and the real exposure — enumeration and abuse at scale — sits in the integrity and availability columns nobody scores.	Application assets	T4 Applications and WorkloadsAPI Security	15 3 × 5	50%	7.5 pts	Public data
A-21 The fee and payment applicationThe only asset in the register facing a sustained, financially motivated adversary as well as a nation-state one.	Application assets	T4 Applications and WorkloadsAPI Security	25 5 × 5	50%	12.5 pts	Fee and financial
A-22 The CI/CD pipelineThe decisive point on the application layer, and it carries no mission. An availability-derived register would rate this asset near zero, which is the precise reason the model weights criticality by consequence rather than by outage.	Application assets	T4 Applications and WorkloadsPipeline Security (CI/CD)	20 5 × 4	50%	10 pts	Nothing outright — allocated only.
A-23 Container platform and orchestrationCarries no mission by name and hosts most of them. The admission point is where an unsigned or over-privileged image is either stopped or not.	Cloud workload assets	T4 Applications and WorkloadsRuntime & Container	16 4 × 4	50%	8 pts	Nothing outright — allocated only.
A-24 Secrets store for workload credentialsHolds the credentials the non-person identities present. Compromise here is an identity-layer event that the register files under cloud, which is a seam worth knowing about.	Cloud workload assets	T4 Applications and WorkloadsRuntime & Container	15 5 × 3	50%	7.5 pts	Nothing outright — allocated only.
A-25 Sensitive mission recordsThe crown jewels: pre-decisional, non-public, and the holding whose loss is least reversible. Every other row in this register exists to keep somebody off this one.	Data assets	T5 DataData Access Governance	20 5 × 4	50%	10 pts	Case processing Adjudication
A-26 The external-user PII storeThe privacy exposure. Its criticality comes from the obligation attached to it rather than from the mission value of the records.	Data assets	T5 DataClassification	20 5 × 4	50%	10 pts	Public service Adjudication Secondary service
A-27 The fee and financial databaseThe accounting record. Integrity dominates: a quietly altered ledger is worse than a stolen one, and far harder to notice.	Data assets	T5 DataEncryption & Key Management	15 5 × 3	75%	3.8 pts	Fee and financial
A-28 Published bulk-data extractsDeliberately public. The classification sub-tower carries it because the risk is an extract containing more than the dissemination decision authorized.	Data assets	T5 DataClassification	15 3 × 5	50%	7.5 pts	Public data
A-29 Audit and telemetry record storesThe evidence base for every claim on this site. It carries no mission and it is the first thing an adversary edits.	Data assets	T5 DataData Access Governance	12 4 × 3	50%	6 pts	Nothing outright — allocated only.
A-30 Analytic and non-production copies of mission dataThe copies. Same records, a fraction of the governance, and almost never in the authorization boundary that was assessed.	Data assets	T5 DataDLP	16 4 × 4	25%	12 pts	Nothing outright — allocated only.
A-31 Building control and physical access systemsHolds no data and can stop a data center. A consequence model derived from records exposed scores this at 1; doctrine scores it at 4.	Operational technology assets	T6 Operational TechnologyOT / IT Boundary	12 4 × 3	50%	6 pts	Nothing outright — allocated only.
A-32 Public-counter and laboratory instrumentationMission-supporting equipment on a general-purpose network. It carries a mission that does not draw on the operational-technology layer at all — the one place in this register where the two directions of the trace disagree, and it is left visible rather than tidied away.	Operational technology assets	T6 Operational TechnologyOT Asset Inventory	8 2 × 4	25%	6 pts	Secondary service
A-33 Engineering workstations for facility systemsThe crossing point between the two estates, operated by people whose profession is availability rather than confidentiality.	Operational technology assets	T6 Operational TechnologyEngineering Access	8 4 × 2	25%	6 pts	Nothing outright — allocated only.
A-34 The privileged administrator populationA population, not a machine. Weighted at the top of the register because the question "who holds privilege today" is the one most estates answer from memory.	Workforce assets	T7 WorkforcePrivileged Human Register	20 5 × 4	50%	10 pts	Nothing outright — allocated only.
A-35 Mission staff with volume record accessIndividually low-privilege, collectively the crown-jewel access path. The only workforce row that carries a mission directly, because these are the people the mission is performed by.	Workforce assets	T7 WorkforceInsider Risk Position	16 4 × 4	25%	12 pts	Case processing Adjudication
A-36 Contractor and vendor staff with production accessThe population whose departures the agency learns about last, which is why the sub-tower is separation tempo rather than headcount.	Workforce assets	T7 WorkforceSeparation Tempo	20 4 × 5	50%	10 pts	Nothing outright — allocated only.
A-37 The defending team itselfTerrain that is also the force. A saturated team is a coverage problem on every other row in this register simultaneously.	Workforce assets	T7 WorkforceRole-Based Readiness	12 4 × 3	50%	6 pts	Nothing outright — allocated only.
A-38 Primary data center and equipment roomsLow exposure, maximal consequence — the inverse of the endpoint rows, and the reason a purely logical model mis-scores it.	Facility assets	T8 FacilitiesPhysical Zone Boundary	10 5 × 2	50%	5 pts	Case processing Fee and financial
A-39 Environmental plant serving productionCooling and power. It fails in the order it happens to fail rather than in the order the mission would choose, unless somebody has said otherwise in advance.	Facility assets	T8 FacilitiesEnvironmental Continuity	8 4 × 2	50%	4 pts	Nothing outright — allocated only.
A-40 Vendor maintenance routes into production spacePhysical access granted on a work order. The highest-exposure facility row, and the one least likely to appear on a network diagram.	Facility assets	T8 FacilitiesMaintenance Access	16 4 × 4	25%	12 pts	Nothing outright — allocated only.
A-41 Managed service providers with production accessStanding access held by an organization the agency does not operate. Carries no mission and can reach most of them.	Supply-chain assets	T9 Supply ChainAccess Constraint	20 4 × 5	50%	10 pts	Nothing outright — allocated only.
A-42 Third-party components in mission applicationsThe dependency tree. The register row that a national advisory arrives about, on a clock, expecting an inventory answer.	Supply-chain assets	T9 Supply ChainComponent Provenance	16 4 × 4	25%	12 pts	Nothing outright — allocated only.
A-43 Vendor update channels into the estateThe route a trusted change arrives by, which is the route an untrusted one arrives by. Doctrinally this is a line of communication, and it is defended like logistics.	Supply-chain assets	T9 Supply ChainUpdate Staging	20 5 × 4	50%	10 pts	Nothing outright — allocated only.
A-44 The telemetry and analytics platformReconnaissance. Every detection claim on this site is downstream of it, and no mission draws on the layer it sits on.	Cross-cutting assets	TX Cross-CuttingVisibility & Analytics (ISR)	15 5 × 3	50%	7.5 pts	Nothing outright — allocated only.
A-45 Orchestration and response toolingMobility. It converts a decision into an action inside the adversary’s decision window, or it does not and the coverage figures above are theoretical.	Cross-cutting assets	TX Cross-CuttingAutomation & Orchestration (mobility)	12 4 × 3	50%	6 pts	Nothing outright — allocated only.
A-46 The rules of engagement and the cycle recordCommand authority as an asset. Without a standing authorization to act, every maneuver in the catalog is a proposal.	Cross-cutting assets	TX Cross-CuttingGovernance (command authority)	10 5 × 2	75%	2.5 pts	Nothing outright — allocated only.

A-01 ICAM identity provider and policy decision point

The only row in the register that every mission depends on without exception. Criticality is 5 by construction; exposure is 5 because it fronts external-user self-service.

Pool: Identity assets
Tower · sub-tower: T1 IdentityAuthorization / PDP
Weight: 25 5 × 5
Coverage: 50%
Residual: 12.5 pts
Missions it carries outright: Public service
Case processing
Adjudication
Secondary service
Public data
Fee and financial

A-02 PKI and PIV credential service

Carries the staff-facing missions only. Exposure is lower than the identity provider because it is not reachable from the public tier.

Pool: Identity assets
Tower · sub-tower: T1 IdentityAuthentication (phishing-resistant MFA)
Weight: 15 5 × 3
Coverage: 75%
Residual: 3.8 pts
Missions it carries outright: Case processing
Adjudication
Fee and financial

A-03 External-user account directory

Citizens, businesses, partners and their agents. Maximal exposure, and the population the agency has the least control over — no device management, no joiner-mover-leaver process, no training.

Pool: Identity assets
Tower · sub-tower: T1 IdentityAuthentication (phishing-resistant MFA)
Weight: 20 4 × 5
Coverage: 75%
Residual: 5 pts
Missions it carries outright: Public service
Secondary service
Adjudication

A-04 Privileged accounts and the access broker

No mission stops if the broker stops — administration pauses. The weight is high anyway, because this is how the estate is operated and therefore how it would be operated against.

Pool: Identity assets
Tower · sub-tower: T1 IdentityPrivileged Access (JIT/PAM)
Weight: 20 5 × 4
Coverage: 50%
Residual: 10 pts
Missions it carries outright: Nothing outright — allocated only.

A-05 Service and workload identities

Non-person entities: service accounts, workload identities, pipeline credentials. Routinely over-permissioned and rarely recertified, because the governance process was built for humans.

Pool: Identity assets
Tower · sub-tower: T1 IdentityIdentity Governance (ICAM)
Weight: 16 4 × 4
Coverage: 50%
Residual: 8 pts
Missions it carries outright: Nothing outright — allocated only.

A-06 Mission-staff laptops

Low criticality, maximal exposure — the inversion the device layer is built around. One laptop is worth little; it holds a live session to the tier where records are.

Pool: Device assets
Tower · sub-tower: T2 DevicesDevice Compliance / Posture
Weight: 15 3 × 5
Coverage: 50%
Residual: 7.5 pts
Missions it carries outright: Case processing
Adjudication
Fee and financial

A-07 Contractor and integrator endpoints

Managed by somebody else, to a standard the agency reads about in a contract clause rather than in a posture signal.

Pool: Device assets
Tower · sub-tower: T2 DevicesMobile & BYOD
Weight: 15 3 × 5
Coverage: 50%
Residual: 7.5 pts
Missions it carries outright: Nothing outright — allocated only.

A-08 Server and virtual-machine fleet

The estate that did not move to containers. Lower exposure than the endpoints, and considerably longer-lived, which is the same thing said twice.

Pool: Device assets
Tower · sub-tower: T2 DevicesServer / Workload Hardening
Weight: 12 4 × 3
Coverage: 50%
Residual: 6 pts
Missions it carries outright: Case processing
Secondary service

A-09 Build agents and developer workstations

Devices with a route to the pipeline. Weighted as device assets, but their consequence is an application-layer consequence.

Pool: Device assets
Tower · sub-tower: T2 DevicesEndpoint Protection (EDR)
Weight: 16 4 × 4
Coverage: 75%
Residual: 4 pts
Missions it carries outright: Nothing outright — allocated only.

A-10 TIC 3.0 access points

Every public-facing mission crosses here. Case processing does not appear, because its users are already inside — which is exactly why the boundary below matters more to it.

Pool: Network assets
Tower · sub-tower: T3 NetworksPerimeter / TIC 3.0
Weight: 25 5 × 5
Coverage: 75%
Residual: 6.3 pts
Missions it carries outright: Public service
Adjudication
Secondary service
Public data
Fee and financial

A-11 Edge delivery and volumetric scrubbing

The availability control for the missions where availability is a statutory property rather than a service target.

Pool: Network assets
Tower · sub-tower: T3 NetworksWAF & DDoS
Weight: 20 4 × 5
Coverage: 75%
Residual: 5 pts
Missions it carries outright: Public service
Secondary service
Public data

A-12 Web application firewall fronting the public tier

Shares a sub-tower with the scrubbing edge and therefore shares its coverage, which is a fair simplification and worth naming as one.

Pool: Network assets
Tower · sub-tower: T3 NetworksWAF & DDoS
Weight: 16 4 × 4
Coverage: 75%
Residual: 4 pts
Missions it carries outright: Public service
Secondary service
Fee and financial

A-13 The public-tier / mission-tier boundary

The decisive point on the network layer: the crossing an adversary who has taken a public service must make for the compromise to be worth anything.

Pool: Network assets
Tower · sub-tower: T3 NetworksMicrosegmentation
Weight: 20 5 × 4
Coverage: 50%
Residual: 10 pts
Missions it carries outright: Case processing
Adjudication

A-14 Authoritative and recursive DNS

The second row every mission depends on. It is in the register for the resolution service, and it earns its weight twice over as the estate’s most under-read egress telemetry.

Pool: Network assets
Tower · sub-tower: T3 NetworksEgress & DNS Control
Weight: 16 4 × 4
Coverage: 50%
Residual: 8 pts
Missions it carries outright: Public service
Case processing
Adjudication
Secondary service
Public data
Fee and financial

A-15 The public service portal

The front door. Maximal on both axes, and the asset most likely to be tested by somebody the agency did not invite.

Pool: Application assets
Tower · sub-tower: T4 Applications and WorkloadsAppSec (SAST / DAST)
Weight: 25 5 × 5
Coverage: 50%
Residual: 12.5 pts
Missions it carries outright: Public service

A-16 The case filing front door

Intake and e-filing. The asset where an availability failure converts directly into a missed statutory receipt date.

Pool: Application assets
Tower · sub-tower: T4 Applications and WorkloadsAPI Security
Weight: 25 5 × 5
Coverage: 50%
Residual: 12.5 pts
Missions it carries outright: Public service
Adjudication

A-17 The case processing system

Where records are worked. Lower exposure, because access is mediated internally — and the highest consequence in the register, because access here is access to records in volume.

Pool: Application assets
Tower · sub-tower: T4 Applications and WorkloadsAppSec (SAST / DAST)
Weight: 15 5 × 3
Coverage: 50%
Residual: 7.5 pts
Missions it carries outright: Case processing

A-18 The administrative adjudication docket

Lower volume than case processing and a harder deadline, which is a different risk profile wearing the same technology.

Pool: Application assets
Tower · sub-tower: T4 Applications and WorkloadsAppSec (SAST / DAST)
Weight: 12 4 × 3
Coverage: 50%
Residual: 6 pts
Missions it carries outright: Adjudication

A-19 Secondary public service portals

Delivered by a different program on a different schedule. The exposure is the same as the primary portal; the attention is not.

Pool: Application assets
Tower · sub-tower: T4 Applications and WorkloadsAppSec (SAST / DAST)
Weight: 15 3 × 5
Coverage: 50%
Residual: 7.5 pts
Missions it carries outright: Secondary service

A-20 The public bulk data and open API surface

Confidentiality is deliberately low here, so criticality reads low on a data-derived scale and the real exposure — enumeration and abuse at scale — sits in the integrity and availability columns nobody scores.

Pool: Application assets
Tower · sub-tower: T4 Applications and WorkloadsAPI Security
Weight: 15 3 × 5
Coverage: 50%
Residual: 7.5 pts
Missions it carries outright: Public data

A-21 The fee and payment application

The only asset in the register facing a sustained, financially motivated adversary as well as a nation-state one.

Pool: Application assets
Tower · sub-tower: T4 Applications and WorkloadsAPI Security
Weight: 25 5 × 5
Coverage: 50%
Residual: 12.5 pts
Missions it carries outright: Fee and financial

A-22 The CI/CD pipeline

The decisive point on the application layer, and it carries no mission. An availability-derived register would rate this asset near zero, which is the precise reason the model weights criticality by consequence rather than by outage.

Pool: Application assets
Tower · sub-tower: T4 Applications and WorkloadsPipeline Security (CI/CD)
Weight: 20 5 × 4
Coverage: 50%
Residual: 10 pts
Missions it carries outright: Nothing outright — allocated only.

A-23 Container platform and orchestration

Carries no mission by name and hosts most of them. The admission point is where an unsigned or over-privileged image is either stopped or not.

Pool: Cloud workload assets
Tower · sub-tower: T4 Applications and WorkloadsRuntime & Container
Weight: 16 4 × 4
Coverage: 50%
Residual: 8 pts
Missions it carries outright: Nothing outright — allocated only.

A-24 Secrets store for workload credentials

Holds the credentials the non-person identities present. Compromise here is an identity-layer event that the register files under cloud, which is a seam worth knowing about.

Pool: Cloud workload assets
Tower · sub-tower: T4 Applications and WorkloadsRuntime & Container
Weight: 15 5 × 3
Coverage: 50%
Residual: 7.5 pts
Missions it carries outright: Nothing outright — allocated only.

A-25 Sensitive mission records

The crown jewels: pre-decisional, non-public, and the holding whose loss is least reversible. Every other row in this register exists to keep somebody off this one.

Pool: Data assets
Tower · sub-tower: T5 DataData Access Governance
Weight: 20 5 × 4
Coverage: 50%
Residual: 10 pts
Missions it carries outright: Case processing
Adjudication

A-26 The external-user PII store

The privacy exposure. Its criticality comes from the obligation attached to it rather than from the mission value of the records.

Pool: Data assets
Tower · sub-tower: T5 DataClassification
Weight: 20 5 × 4
Coverage: 50%
Residual: 10 pts
Missions it carries outright: Public service
Adjudication
Secondary service

A-27 The fee and financial database

The accounting record. Integrity dominates: a quietly altered ledger is worse than a stolen one, and far harder to notice.

Pool: Data assets
Tower · sub-tower: T5 DataEncryption & Key Management
Weight: 15 5 × 3
Coverage: 75%
Residual: 3.8 pts
Missions it carries outright: Fee and financial

A-28 Published bulk-data extracts

Deliberately public. The classification sub-tower carries it because the risk is an extract containing more than the dissemination decision authorized.

Pool: Data assets
Tower · sub-tower: T5 DataClassification
Weight: 15 3 × 5
Coverage: 50%
Residual: 7.5 pts
Missions it carries outright: Public data

A-29 Audit and telemetry record stores

The evidence base for every claim on this site. It carries no mission and it is the first thing an adversary edits.

Pool: Data assets
Tower · sub-tower: T5 DataData Access Governance
Weight: 12 4 × 3
Coverage: 50%
Residual: 6 pts
Missions it carries outright: Nothing outright — allocated only.

A-30 Analytic and non-production copies of mission data

The copies. Same records, a fraction of the governance, and almost never in the authorization boundary that was assessed.

Pool: Data assets
Tower · sub-tower: T5 DataDLP
Weight: 16 4 × 4
Coverage: 25%
Residual: 12 pts
Missions it carries outright: Nothing outright — allocated only.

A-31 Building control and physical access systems

Holds no data and can stop a data center. A consequence model derived from records exposed scores this at 1; doctrine scores it at 4.

Pool: Operational technology assets
Tower · sub-tower: T6 Operational TechnologyOT / IT Boundary
Weight: 12 4 × 3
Coverage: 50%
Residual: 6 pts
Missions it carries outright: Nothing outright — allocated only.

A-32 Public-counter and laboratory instrumentation

Mission-supporting equipment on a general-purpose network. It carries a mission that does not draw on the operational-technology layer at all — the one place in this register where the two directions of the trace disagree, and it is left visible rather than tidied away.

Pool: Operational technology assets
Tower · sub-tower: T6 Operational TechnologyOT Asset Inventory
Weight: 8 2 × 4
Coverage: 25%
Residual: 6 pts
Missions it carries outright: Secondary service

A-33 Engineering workstations for facility systems

The crossing point between the two estates, operated by people whose profession is availability rather than confidentiality.

Pool: Operational technology assets
Tower · sub-tower: T6 Operational TechnologyEngineering Access
Weight: 8 4 × 2
Coverage: 25%
Residual: 6 pts
Missions it carries outright: Nothing outright — allocated only.

A-34 The privileged administrator population

A population, not a machine. Weighted at the top of the register because the question "who holds privilege today" is the one most estates answer from memory.

Pool: Workforce assets
Tower · sub-tower: T7 WorkforcePrivileged Human Register
Weight: 20 5 × 4
Coverage: 50%
Residual: 10 pts
Missions it carries outright: Nothing outright — allocated only.

A-35 Mission staff with volume record access

Individually low-privilege, collectively the crown-jewel access path. The only workforce row that carries a mission directly, because these are the people the mission is performed by.

Pool: Workforce assets
Tower · sub-tower: T7 WorkforceInsider Risk Position
Weight: 16 4 × 4
Coverage: 25%
Residual: 12 pts
Missions it carries outright: Case processing
Adjudication

A-36 Contractor and vendor staff with production access

The population whose departures the agency learns about last, which is why the sub-tower is separation tempo rather than headcount.

Pool: Workforce assets
Tower · sub-tower: T7 WorkforceSeparation Tempo
Weight: 20 4 × 5
Coverage: 50%
Residual: 10 pts
Missions it carries outright: Nothing outright — allocated only.

A-37 The defending team itself

Terrain that is also the force. A saturated team is a coverage problem on every other row in this register simultaneously.

Pool: Workforce assets
Tower · sub-tower: T7 WorkforceRole-Based Readiness
Weight: 12 4 × 3
Coverage: 50%
Residual: 6 pts
Missions it carries outright: Nothing outright — allocated only.

A-38 Primary data center and equipment rooms

Low exposure, maximal consequence — the inverse of the endpoint rows, and the reason a purely logical model mis-scores it.

Pool: Facility assets
Tower · sub-tower: T8 FacilitiesPhysical Zone Boundary
Weight: 10 5 × 2
Coverage: 50%
Residual: 5 pts
Missions it carries outright: Case processing
Fee and financial

A-39 Environmental plant serving production

Cooling and power. It fails in the order it happens to fail rather than in the order the mission would choose, unless somebody has said otherwise in advance.

Pool: Facility assets
Tower · sub-tower: T8 FacilitiesEnvironmental Continuity
Weight: 8 4 × 2
Coverage: 50%
Residual: 4 pts
Missions it carries outright: Nothing outright — allocated only.

A-40 Vendor maintenance routes into production space

Physical access granted on a work order. The highest-exposure facility row, and the one least likely to appear on a network diagram.

Pool: Facility assets
Tower · sub-tower: T8 FacilitiesMaintenance Access
Weight: 16 4 × 4
Coverage: 25%
Residual: 12 pts
Missions it carries outright: Nothing outright — allocated only.

A-41 Managed service providers with production access

Standing access held by an organization the agency does not operate. Carries no mission and can reach most of them.

Pool: Supply-chain assets
Tower · sub-tower: T9 Supply ChainAccess Constraint
Weight: 20 4 × 5
Coverage: 50%
Residual: 10 pts
Missions it carries outright: Nothing outright — allocated only.

A-42 Third-party components in mission applications

The dependency tree. The register row that a national advisory arrives about, on a clock, expecting an inventory answer.

Pool: Supply-chain assets
Tower · sub-tower: T9 Supply ChainComponent Provenance
Weight: 16 4 × 4
Coverage: 25%
Residual: 12 pts
Missions it carries outright: Nothing outright — allocated only.

A-43 Vendor update channels into the estate

The route a trusted change arrives by, which is the route an untrusted one arrives by. Doctrinally this is a line of communication, and it is defended like logistics.

Pool: Supply-chain assets
Tower · sub-tower: T9 Supply ChainUpdate Staging
Weight: 20 5 × 4
Coverage: 50%
Residual: 10 pts
Missions it carries outright: Nothing outright — allocated only.

A-44 The telemetry and analytics platform

Reconnaissance. Every detection claim on this site is downstream of it, and no mission draws on the layer it sits on.

Pool: Cross-cutting assets
Tower · sub-tower: TX Cross-CuttingVisibility & Analytics (ISR)
Weight: 15 5 × 3
Coverage: 50%
Residual: 7.5 pts
Missions it carries outright: Nothing outright — allocated only.

A-45 Orchestration and response tooling

Mobility. It converts a decision into an action inside the adversary’s decision window, or it does not and the coverage figures above are theoretical.

Pool: Cross-cutting assets
Tower · sub-tower: TX Cross-CuttingAutomation & Orchestration (mobility)
Weight: 12 4 × 3
Coverage: 50%
Residual: 6 pts
Missions it carries outright: Nothing outright — allocated only.

A-46 The rules of engagement and the cycle record

Command authority as an asset. Without a standing authorization to act, every maneuver in the catalog is a proposal.

Pool: Cross-cutting assets
Tower · sub-tower: TX Cross-CuttingGovernance (command authority)
Weight: 10 5 × 2
Coverage: 75%
Residual: 2.5 pts
Missions it carries outright: Nothing outright — allocated only.

Illustrative — the Federal Reference Agency profile, not an assessment of any real estate. “Carries outright” is a deliberately narrow relation: the mission stops if this asset stops. It is not “is relevant to”. 22 of the 46 rows carry nothing under that test, and that is the honest answer rather than a gap in the authoring — those assets reach their missions by allocation, which the next section does in full.

The Bills of Defense

Each Mission, Written Out in Full.

What it delivers, what obligation it is exposed on, the terrain it draws from, the assets that carry it, the controls in scope, the maneuvers reaching it, what recovery has to demonstrate — and then the bill, with the arithmetic shown rather than summarized.

Public service delivery

The public service portal and external-user accounts

Weight118
Coverage53.7%
Residual54.7 pts
Illustrative

Draws most heavily on identity and applications because its user population is external and its surface is public. Device weight is low: it does not control the endpoints its users arrive on, which is itself the finding.

What it delivers

The front door. Account creation, submission, status, correspondence and payment initiation for the agency’s primary public service line — the surface most people mean when they say they have dealt with the agency.

It is also the intake path for the mission that follows it: what is filed here becomes the work that case processing does, so an availability failure at the front door is a workload failure downstream three weeks later.

Consumed by Members of the public, businesses and their representatives, arriving on devices the agency does not manage.

Statutory or service-level exposure

Statutory receipt date and a published service commitment

The obligation: Anything submitted through the portal acquires a receipt date, and rights attach to it. The agency also publishes a service commitment for availability and response, which is a promise rather than a statute but is read as one by everybody who relies on it.
The clock: The submission clock, which the agency does not control. A filing accepted at 23:58 on a due date is timely; one the portal refuses at 23:58 is not, and no amount of subsequent uptime repairs it.
What it costs when it is missed: Members of the public who did nothing wrong lose a date. The agency absorbs the correction as a manual intake process it has to staff, plus a class of appeals it did not budget for, plus the public account of the outage.
The availability floor · FO-5: The availability floor is the deadline calendar, not a percentage. Peaks around statutory dates are the hours that matter, and a defensive action that takes the portal down during one has traded the mission to protect it.

Recovery objectives Illustrative

RTO4 hours
RPO15 minutes
MTD24 hours

What an exercise has to demonstrate · RC-5: A restore that stands up the portal and the account directory from copies held outside the production identity plane, with the identity plane itself rebuilt first, and proves the restored submissions against an independent receipt record rather than against the application’s own database.
The part that actually fails: The receipt record. Restoring the portal is a platform exercise; proving that every submission accepted in the fifteen minutes before the event is either present or accounted for is an evidence exercise, and it is the one that has never been run.

Objectives are declared per mission service under RC-1, restored on a path that does not depend on the production identity plane (RC-3), and verified against an independent integrity record (RC-4). The form of maneuver is M11 Reconstitution, whose indicator is that every objective has been demonstrated within its stated period — not that one exists.

The Bill of Defense · 7 of 10 layers

T1IdentityWeight25Share21.2%Layer coverage58.1%Residual10.5 pts
T4Applications and WorkloadsWeight25Share21.2%Layer coverage50%Residual12.5 pts
T3NetworksWeight20Share16.9%Layer coverage63.2%Residual7.4 pts
T5DataWeight20Share16.9%Layer coverage49.6%Residual10.1 pts
T9Supply ChainWeight12Share10.2%Layer coverage44.4%Residual6.7 pts
T2DevicesWeight10Share8.5%Layer coverage57.9%Residual4.2 pts
T7WorkforceWeight6Share5.1%Layer coverage44.9%Residual3.3 pts
Rolled upWeight118Share100%Coverage53.7%Residual54.7 pts · 46.3%

Layers absent from this list contribute nothing to the bill because the mission declares no draw on them: T6 Operational Technology, T8 Facilities, TX Cross-Cutting. Absence is a declaration, not an oversight — and it is where the trace below finds what the bill cannot see.

Assets that carry it · 9 outright

A-01ICAM identity provider and policy decision pointT1 · weight 25 · 50% covered
A-03External-user account directoryT1 · weight 20 · 75% covered
A-10TIC 3.0 access pointsT3 · weight 25 · 75% covered
A-11Edge delivery and volumetric scrubbingT3 · weight 20 · 75% covered
A-12Web application firewall fronting the public tierT3 · weight 16 · 75% covered
A-14Authoritative and recursive DNST3 · weight 16 · 50% covered
A-15The public service portalT4 · weight 25 · 50% covered
A-16The case filing front doorT4 · weight 25 · 50% covered
A-26The external-user PII storeT5 · weight 20 · 50% covered

A further 28 assets are allocated to this mission without stopping it, carrying 129.7 allocated weight points in total. The full split is in the trace.

Controls in scope · 59

Derived from the layers this mission draws on, not authored against the mission. Nine act on the terrain model itself and therefore apply to every layer by construction; the remaining 42 are named by one or more of the 7 layers in the bill above, for reasons those layers give themselves.

Maneuvers defending it

Ranked by reach: the share of this mission’s weight that sits on layers where the form actually has cataloged techniques. Selecting forms by their declared primary terrain returns all 11 for all 6 missions and differentiates nothing, so the ranking is derived from the technique catalog’s own terrain declarations instead.

M1Screen / Guard100% reach10 techniques on 7 layers it draws on
M8Isolation / Retrograde100% reach11 techniques on 7 layers it draws on
M5Ambush89.8% reach10 techniques on 6 layers it draws on
M6Delay86.4% reach9 techniques on 5 layers it draws on
M11Reconstitution83.1% reach9 techniques on 6 layers it draws on
M7Counterattack83.1% reach8 techniques on 6 layers it draws on
M2Defense in Depth78.8% reach14 techniques on 6 layers it draws on
M9Spoiling Attack74.6% reach6 techniques on 5 layers it draws on
M3Envelopment44.9% reach20 techniques on 4 layers it draws on
M4Obstacle / Canalization35.6% reach13 techniques on 3 layers it draws on
M10Exploitation & Pursuit10.2% reach1 technique on 1 layer it draws on

Main effort · SM-4

M3 Envelopment44.9% reach

The adversary’s plan runs through a credential belonging to somebody the agency cannot manage, train or issue a device to. Every other form in the sequence is buying time for the envelopment to hold.

The widest-reaching form here is M1 Screen / Guard at 100%, and the main effort is M3 anyway. Reach is breadth; main effort is concentration. A form that touches every layer a mission stands on is not thereby the place to mass — that is a claim about where the adversary’s plan is decided, and it is a commander’s judgment rather than an output of this table.

What this bill hidesThe device weight is the lowest of the six, and that is not a finding about risk — it is a finding about control. The mission’s users arrive on endpoints the agency has no posture signal for, so the layer that would carry that risk is scored light because there is nothing to score. The bill reads as though devices barely matter to this mission; what it means is that devices are somebody else’s.

Case processing and adjudication

The case processing system and mission-staff workflow

Weight127
Coverage52.4%
Residual60.5 pts
Illustrative

The mission with the heaviest data dependency, and the only one whose workforce weight is comparable to its network weight — its staff hold volume access to the crown-jewel record set.

What it delivers

The work itself. Examination, analysis, correspondence and decision on the case load the filing front door produces, performed by staff who hold volume access to the record set the whole estate exists to protect.

It is the mission with the heaviest data dependency in the model, and the only one whose workforce weight is comparable to its network weight, for the same reason: the people performing it are an access path.

Consumed by Mission staff working cases, and — at one remove, on a pendency clock — everybody waiting on one.

Statutory or service-level exposure

Statutory processing timelines and privacy obligations over a system of records

The obligation: Processing timelines the agency reports against, and privacy obligations attaching to a record set that is largely pre-decisional and non-public. The reporting obligation makes pendency a public number, which changes how an outage is experienced politically.
The clock: The pendency clock, which does not stop for an incident. A week of degraded processing is a week added to every case in the queue and a number the agency will publish.
What it costs when it is missed: Backlog, compounding. Unlike a missed filing date, this failure has no single victim and no single remedy — it is absorbed by everybody in the queue and cleared over quarters, at overtime rates.
The availability floor · FO-5: The floor is throughput rather than uptime. Isolation that keeps the system running at a third of capacity may be the correct defensive trade; isolation that stops it during a reporting period is not.

Recovery objectives Illustrative

RTO12 hours
RPO1 hour
MTD72 hours

What an exercise has to demonstrate · RC-5: A rebuild of the case processing system on a trusted path, with the record set restored and verified against an independent integrity record, and a demonstration that in-flight work — the drafts and partial decisions that live nowhere else — is either recovered or provably lost so the queue can be re-worked deliberately.
The part that actually fails: In-flight work. The record store restores; the half-finished analysis in a staff member’s working session does not, and no recovery objective in any agency’s plan has ever named it.

The Bill of Defense · 8 of 10 layers

T5DataWeight25Share19.7%Layer coverage49.6%Residual12.6 pts
T1IdentityWeight20Share15.7%Layer coverage58.1%Residual8.4 pts
T4Applications and WorkloadsWeight20Share15.7%Layer coverage50%Residual10 pts
T2DevicesWeight16Share12.6%Layer coverage57.9%Residual6.7 pts
T3NetworksWeight16Share12.6%Layer coverage63.2%Residual5.9 pts
T7WorkforceWeight15Share11.8%Layer coverage44.9%Residual8.3 pts
T9Supply ChainWeight9Share7.1%Layer coverage44.4%Residual5 pts
T8FacilitiesWeight6Share4.7%Layer coverage40.5%Residual3.6 pts
Rolled upWeight127Share100%Coverage52.4%Residual60.5 pts · 47.6%

Layers absent from this list contribute nothing to the bill because the mission declares no draw on them: T6 Operational Technology, TX Cross-Cutting. Absence is a declaration, not an oversight — and it is where the trace below finds what the bill cannot see.

Assets that carry it · 10 outright

A-01ICAM identity provider and policy decision pointT1 · weight 25 · 50% covered
A-02PKI and PIV credential serviceT1 · weight 15 · 75% covered
A-06Mission-staff laptopsT2 · weight 15 · 50% covered
A-08Server and virtual-machine fleetT2 · weight 12 · 50% covered
A-13The public-tier / mission-tier boundaryT3 · weight 20 · 50% covered
A-14Authoritative and recursive DNST3 · weight 16 · 50% covered
A-17The case processing systemT4 · weight 15 · 50% covered
A-25Sensitive mission recordsT5 · weight 20 · 50% covered
A-35Mission staff with volume record accessT7 · weight 16 · 25% covered
A-38Primary data center and equipment roomsT8 · weight 10 · 50% covered

A further 30 assets are allocated to this mission without stopping it, carrying 149.7 allocated weight points in total. The full split is in the trace.

Controls in scope · 64

Derived from the layers this mission draws on, not authored against the mission. Nine act on the terrain model itself and therefore apply to every layer by construction; the remaining 47 are named by one or more of the 8 layers in the bill above, for reasons those layers give themselves.

Maneuvers defending it

M1Screen / Guard100% reach11 techniques on 8 layers it draws on
M8Isolation / Retrograde100% reach12 techniques on 8 layers it draws on
M5Ambush92.9% reach11 techniques on 7 layers it draws on
M11Reconstitution87.4% reach10 techniques on 7 layers it draws on
M2Defense in Depth84.3% reach15 techniques on 7 layers it draws on
M7Counterattack75.6% reach8 techniques on 6 layers it draws on
M6Delay70.9% reach9 techniques on 5 layers it draws on
M9Spoiling Attack63% reach6 techniques on 5 layers it draws on
M3Envelopment47.2% reach20 techniques on 4 layers it draws on
M4Obstacle / Canalization37% reach15 techniques on 4 layers it draws on
M10Exploitation & Pursuit7.1% reach1 technique on 1 layer it draws on

Main effort · SM-4

M5 Ambush92.9% reach

Identity envelopment is assumed as the base, not the differentiator: the access that matters here looks authorized, because it is. The decisive move is seeding the record set so that volume access to it produces a detection with no false-positive budget.

The widest-reaching form here is M1 Screen / Guard at 100%, and the main effort is M5 anyway. Reach is breadth; main effort is concentration. A form that touches every layer a mission stands on is not thereby the place to mass — that is a claim about where the adversary’s plan is decided, and it is a commander’s judgment rather than an output of this table.

What this bill hidesThis bill carries the heaviest weight and the lowest coverage in the model, which reads as the worst answer of the six. It is not — it is the most honestly scored, because the layers this mission depends on are the ones the reference profile assessed carefully. A mission whose bill looks better may simply be drawing on layers nobody has looked at.

Administrative adjudication

The administrative adjudication and e-filing systems

Weight98
Coverage53.2%
Residual45.9 pts
Illustrative

Similar in shape to case processing at lower volume, with a heavier statutory-deadline constraint that makes availability a security property rather than a service target.

What it delivers

Docketing, filing, scheduling and decision issuance for administrative proceedings — lower volume than case processing, and a considerably harder clock, because a hearing date is a commitment to a person who has arranged their life around it.

Similar in technology to case processing and different in obligation: the due-process character of the proceeding makes availability a property of fairness rather than of service quality.

Consumed by Parties to a proceeding, their representatives, and the adjudicators hearing it.

Statutory or service-level exposure

Due-process obligations and deadlines set by regulation

The obligation: Filing windows, response periods and hearing dates fixed by regulation, with due-process obligations to the parties over the top of them. The record of the proceeding is itself the thing being protected — integrity failures here are not data-loss events, they are challenges to the decision.
The clock: A filing window that closes on a stated date, and a hearing calendar set months ahead. Both are visible to the parties, so a failure is contemporaneously documented by the people it happened to.
What it costs when it is missed: Continuances, and challenges to decisions issued on a record the agency cannot fully attest to. The cost is not throughput; it is the reviewability of the outcome.
The availability floor · FO-5: The floor is the filing window and the hearing calendar. Availability may be traded on any other day and may not be traded on those, which is a constraint a generic percentage-based availability target cannot express.

Recovery objectives Illustrative

RTO8 hours
RPO30 minutes
MTD48 hours

What an exercise has to demonstrate · RC-5: Restoration of the docket with its ordering and timestamps intact and independently verifiable, because a docket whose sequence cannot be attested is not a docket. The exercise has to prove the order, not merely the contents.
The part that actually fails: Timestamp provenance. Most restores prove that the records are present; proving when each one arrived, from a source other than the system that lost them, is a different capability and one almost nobody has built.

The Bill of Defense · 7 of 10 layers

T1IdentityWeight20Share20.4%Layer coverage58.1%Residual8.4 pts
T5DataWeight20Share20.4%Layer coverage49.6%Residual10.1 pts
T4Applications and WorkloadsWeight16Share16.3%Layer coverage50%Residual8 pts
T2DevicesWeight12Share12.2%Layer coverage57.9%Residual5.1 pts
T3NetworksWeight12Share12.2%Layer coverage63.2%Residual4.4 pts
T7WorkforceWeight12Share12.2%Layer coverage44.9%Residual6.6 pts
T9Supply ChainWeight6Share6.1%Layer coverage44.4%Residual3.3 pts
Rolled upWeight98Share100%Coverage53.2%Residual45.9 pts · 46.8%

Assets that carry it · 12 outright

A-01ICAM identity provider and policy decision pointT1 · weight 25 · 50% covered
A-02PKI and PIV credential serviceT1 · weight 15 · 75% covered
A-03External-user account directoryT1 · weight 20 · 75% covered
A-06Mission-staff laptopsT2 · weight 15 · 50% covered
A-10TIC 3.0 access pointsT3 · weight 25 · 75% covered
A-13The public-tier / mission-tier boundaryT3 · weight 20 · 50% covered
A-14Authoritative and recursive DNST3 · weight 16 · 50% covered
A-16The case filing front doorT4 · weight 25 · 50% covered
A-18The administrative adjudication docketT4 · weight 12 · 50% covered
A-25Sensitive mission recordsT5 · weight 20 · 50% covered
A-26The external-user PII storeT5 · weight 20 · 50% covered
A-35Mission staff with volume record accessT7 · weight 16 · 25% covered

A further 25 assets are allocated to this mission without stopping it, carrying 106.5 allocated weight points in total. The full split is in the trace.

Controls in scope · 59

Maneuvers defending it

M1Screen / Guard100% reach10 techniques on 7 layers it draws on
M8Isolation / Retrograde100% reach11 techniques on 7 layers it draws on
M5Ambush93.9% reach10 techniques on 6 layers it draws on
M11Reconstitution87.8% reach9 techniques on 6 layers it draws on
M2Defense in Depth79.6% reach14 techniques on 6 layers it draws on
M7Counterattack79.6% reach8 techniques on 6 layers it draws on
M6Delay75.5% reach9 techniques on 5 layers it draws on
M9Spoiling Attack67.3% reach6 techniques on 5 layers it draws on
M3Envelopment51% reach20 techniques on 4 layers it draws on
M4Obstacle / Canalization30.6% reach13 techniques on 3 layers it draws on
M10Exploitation & Pursuit6.1% reach1 technique on 1 layer it draws on

Main effort · SM-4

M8 Isolation / Retrograde100% reach

The whole problem is containing an intrusion without taking a proceeding off the calendar. This is the mission where giving ground deliberately — degrading in the order the mission dictates rather than the order the incident dictates — is the decisive skill.

The widest-reaching form here is M1 Screen / Guard at 100%, and the main effort is M8 anyway. Reach is breadth; main effort is concentration. A form that touches every layer a mission stands on is not thereby the place to mass — that is a claim about where the adversary’s plan is decided, and it is a commander’s judgment rather than an output of this table.

What this bill hidesThe bill is a scaled-down copy of case processing, and that similarity is the risk. The two missions share a technology stack and differ in obligation, so a control decision justified by case processing’s throughput floor can be silently applied here, where the floor is a fixed date and the trade is not available.

Secondary public service

Additional public service lines and secondary portals

Weight75
Coverage54.4%
Residual34.2 pts
Illustrative

Consistently the least-defended mission in the reference profile, and for an unremarkable reason: a separate program shipped it on a separate schedule, so it inherited the estate’s controls instead of shaping them.

What it delivers

Additional public service lines and secondary portals — smaller in volume, delivered by a different program on a different schedule, and inheriting the estate’s controls rather than driving them.

It exists in the model because it is the mission every agency has and no agency briefs. Its exposure is comparable to the primary portal’s and its attention is not.

Consumed by A narrower public: users of an additional service line the agency delivers alongside the primary one.

Statutory or service-level exposure

Service-level only. No statutory clock attaches.

The obligation: A published availability commitment and nothing behind it. This mission is the control case in the model: it demonstrates what a bill looks like when the only thing enforcing defense is an internal service target.
The clock: None that binds. Which is the exposure — with no clock, an outage here is negotiable, so the mission is always the one that yields when defensive work is scheduled against operational work.
What it costs when it is missed: Reputational, cumulative, and invisible in any reporting the agency does. The failure mode is not a bad week; it is a decade of deferral that shows up as an inherited estate nobody owns.
The availability floor · FO-5: There is no statutory floor, which means the floor is whatever the last exception approval said. That is the finding, not a footnote to it.

Recovery objectives Illustrative

RTO48 hours
RPO24 hours
MTD5 days

What an exercise has to demonstrate · RC-5: A restore performed by the program that owns the service, not by the central platform team, because the recovery assumption that has never been tested is that somebody knows how this system is built.
The part that actually fails: Finding the runbook. On the archetype profile this is the mission whose recovery documentation was written by an integrator whose contract ended, and the exercise usually discovers that before it discovers anything about the backups.

The Bill of Defense · 6 of 10 layers

T4Applications and WorkloadsWeight16Share21.3%Layer coverage50%Residual8 pts
T1IdentityWeight15Share20%Layer coverage58.1%Residual6.3 pts
T3NetworksWeight15Share20%Layer coverage63.2%Residual5.5 pts
T5DataWeight12Share16%Layer coverage49.6%Residual6 pts
T9Supply ChainWeight9Share12%Layer coverage44.4%Residual5 pts
T2DevicesWeight8Share10.7%Layer coverage57.9%Residual3.4 pts
Rolled upWeight75Share100%Coverage54.4%Residual34.2 pts · 45.6%

Layers absent from this list contribute nothing to the bill because the mission declares no draw on them: T6 Operational Technology, T7 Workforce, T8 Facilities, TX Cross-Cutting. Absence is a declaration, not an oversight — and it is where the trace below finds what the bill cannot see.

Assets that carry it · 10 outright

A-01ICAM identity provider and policy decision pointT1 · weight 25 · 50% covered
A-03External-user account directoryT1 · weight 20 · 75% covered
A-08Server and virtual-machine fleetT2 · weight 12 · 50% covered
A-10TIC 3.0 access pointsT3 · weight 25 · 75% covered
A-11Edge delivery and volumetric scrubbingT3 · weight 20 · 75% covered
A-12Web application firewall fronting the public tierT3 · weight 16 · 75% covered
A-14Authoritative and recursive DNST3 · weight 16 · 50% covered
A-19Secondary public service portalsT4 · weight 15 · 50% covered
A-26The external-user PII storeT5 · weight 20 · 50% covered
A-32Public-counter and laboratory instrumentationT6 · weight 8 · 25% covered

A further 23 assets are allocated to this mission without stopping it, carrying 81.3 allocated weight points in total. The full split is in the trace.

Controls in scope · 53

Derived from the layers this mission draws on, not authored against the mission. Nine act on the terrain model itself and therefore apply to every layer by construction; the remaining 36 are named by one or more of the 6 layers in the bill above, for reasons those layers give themselves.

Maneuvers defending it

M1Screen / Guard100% reach9 techniques on 6 layers it draws on
M8Isolation / Retrograde100% reach10 techniques on 6 layers it draws on
M6Delay89.3% reach9 techniques on 5 layers it draws on
M5Ambush88% reach9 techniques on 5 layers it draws on
M7Counterattack84% reach7 techniques on 5 layers it draws on
M11Reconstitution80% reach8 techniques on 5 layers it draws on
M2Defense in Depth80% reach13 techniques on 5 layers it draws on
M9Spoiling Attack73.3% reach5 techniques on 4 layers it draws on
M3Envelopment42.7% reach19 techniques on 3 layers it draws on
M4Obstacle / Canalization42.7% reach13 techniques on 3 layers it draws on
M10Exploitation & Pursuit12% reach1 technique on 1 layer it draws on

Main effort · SM-4

M2 Defense in Depth80% reach

The mission cannot be given a dedicated defensive effort and should not pretend otherwise. The correct concentration is on ensuring no single failure here is decisive — that a compromise of a neglected portal does not become a compromise of the tier behind it.

The widest-reaching form here is M1 Screen / Guard at 100%, and the main effort is M2 anyway. Reach is breadth; main effort is concentration. A form that touches every layer a mission stands on is not thereby the place to mass — that is a claim about where the adversary’s plan is decided, and it is a commander’s judgment rather than an output of this table.

What this bill hidesThis is the lightest bill in the model and the coverage figure is mid-pack, which is the most misleading pairing on the page. Light weight means the mission declared modest dependencies, not that it has few — a mission nobody has assessed will always score as though it depends on little.

Public data services

Bulk data and open API surfaces

Weight66
Coverage53.7%
Residual30.6 pts
Illustrative

The mission where confidentiality is deliberately low and integrity and availability carry the weight. Its exposure is maximal by design, which is exactly why abuse and enumeration must be modeled as mission risk.

What it delivers

Bulk data products and open API access to the agency’s public holdings — the mission where confidentiality is deliberately low and integrity and availability carry the entire weight.

Its exposure is maximal by design. That is not a defect to be reduced; it is the service. What has to be modeled is abuse of an interface that is working exactly as intended.

Consumed by Researchers, businesses, journalists, automated consumers, and anybody who has ever written a script against a public endpoint.

Statutory or service-level exposure

Dissemination commitment, and the integrity of a public record of fact

The obligation: A published commitment to make the data available in bulk, and a much larger implicit obligation: downstream consumers make decisions on these extracts, so a quietly altered figure propagates into work the agency will never see.
The clock: Publication cadence. A late extract is a service failure; a wrong extract that publishes on time is a much more expensive one and produces no alert.
What it costs when it is missed: Availability failures are visible and forgiven. Integrity failures are invisible and are not — they surface months later, in somebody else’s analysis, with the agency as the cited source.
The availability floor · FO-5: The floor is integrity, not uptime. Withdrawing an extract is an available defensive move; publishing a suspect one to keep the cadence is not.

Recovery objectives Illustrative

RTO24 hours
RPO24 hours
MTD7 days

What an exercise has to demonstrate · RC-5: Reproduction of a published extract from source, byte-for-byte, and comparison against the copy that was actually served — the only exercise that tests the property this mission is actually exposed on.
The part that actually fails: Reproducibility. Extracts are usually generated by a pipeline that has changed since, so proving what was published on a given date requires an artifact nobody kept.

The Bill of Defense · 5 of 10 layers

T4Applications and WorkloadsWeight20Share30.3%Layer coverage50%Residual10 pts
T3NetworksWeight16Share24.2%Layer coverage63.2%Residual5.9 pts
T5DataWeight15Share22.7%Layer coverage49.6%Residual7.6 pts
T1IdentityWeight9Share13.6%Layer coverage58.1%Residual3.8 pts
T9Supply ChainWeight6Share9.1%Layer coverage44.4%Residual3.3 pts
Rolled upWeight66Share100%Coverage53.7%Residual30.6 pts · 46.3%

Layers absent from this list contribute nothing to the bill because the mission declares no draw on them: T2 Devices, T6 Operational Technology, T7 Workforce, T8 Facilities, TX Cross-Cutting. Absence is a declaration, not an oversight — and it is where the trace below finds what the bill cannot see.

Assets that carry it · 6 outright

A-01ICAM identity provider and policy decision pointT1 · weight 25 · 50% covered
A-10TIC 3.0 access pointsT3 · weight 25 · 75% covered
A-11Edge delivery and volumetric scrubbingT3 · weight 20 · 75% covered
A-14Authoritative and recursive DNST3 · weight 16 · 50% covered
A-20The public bulk data and open API surfaceT4 · weight 15 · 50% covered
A-28Published bulk-data extractsT5 · weight 15 · 50% covered

A further 23 assets are allocated to this mission without stopping it, carrying 75.4 allocated weight points in total. The full split is in the trace.

Controls in scope · 46

Derived from the layers this mission draws on, not authored against the mission. Nine act on the terrain model itself and therefore apply to every layer by construction; the remaining 29 are named by one or more of the 5 layers in the bill above, for reasons those layers give themselves.

Maneuvers defending it

M1Screen / Guard100% reach8 techniques on 5 layers it draws on
M6Delay100% reach9 techniques on 5 layers it draws on
M8Isolation / Retrograde100% reach9 techniques on 5 layers it draws on
M5Ambush90.9% reach8 techniques on 4 layers it draws on
M2Defense in Depth86.4% reach10 techniques on 4 layers it draws on
M7Counterattack77.3% reach5 techniques on 4 layers it draws on
M9Spoiling Attack77.3% reach5 techniques on 4 layers it draws on
M11Reconstitution75.8% reach7 techniques on 4 layers it draws on
M4Obstacle / Canalization33.3% reach11 techniques on 2 layers it draws on
M3Envelopment22.7% reach17 techniques on 2 layers it draws on
M10Exploitation & Pursuit9.1% reach1 technique on 1 layer it draws on

Main effort · SM-4

M6 Delay100% reach

The adversary here is not trying to get in — they are using the service as designed, faster and more completely than any legitimate consumer. The decisive move is imposing tempo: rate limits, step-up conditions and throttles that make enumeration cost more than it returns.

The widest-reaching form here is M1 Screen / Guard at 100%, and the main effort is M6 anyway. Reach is breadth; main effort is concentration. A form that touches every layer a mission stands on is not thereby the place to mass — that is a claim about where the adversary’s plan is decided, and it is a commander’s judgment rather than an output of this table.

What this bill hidesThis mission draws on no device layer and no workforce layer at all, so both are absent from the bill. That is correct as far as it goes — it has no staff population of its own — and it means the bill cannot see the analyst who curates the extracts or the workstation the curation happens on.

Fee and financial operations

Fee, payment and financial data systems

Weight127
Coverage52.2%
Residual60.8 pts
Illustrative

The only mission facing a sustained, low-intensity, financially motivated adversary in addition to the nation-state one, which is why its workforce and identity weights are as high as its data weight.

What it delivers

Fee collection, payment processing, refunds, and the accounting record behind all of it — the mission with the most immediate and most quantifiable consequence of failure, and the only one with a permanently interested criminal adversary.

Its identity and workforce weights are as high as its data weight, which is unusual in the model and correct here: fraud against this mission runs through a legitimate-looking authorization far more often than through a technical compromise.

Consumed by Fee payers, the agency’s financial management function, and an annual financial-statement audit.

Statutory or service-level exposure

Financial-integrity obligations and an annual audit

The obligation: Obligations over the accuracy and completeness of the accounting record, tested annually by an independent financial-statement audit, plus the practical duty not to lose public money. A material weakness finding here is a published, named, durable outcome.
The clock: Two clocks at once: the transaction clock, which is immediate, and the audit cycle, which is annual and remembers. A control failure fixed in March is still a finding in the audit that covers March.
What it costs when it is missed: Direct loss, a reportable control deficiency, and a remediation program with an external observer attached to it for at least a year.
The availability floor · FO-5: Payment acceptance is the floor during any period with a statutory fee deadline behind it, because a payment that cannot be made is a filing that cannot be completed — this mission’s availability is another mission’s statutory exposure.

Recovery objectives Illustrative

RTO4 hours
RPOZero — no committed transaction may be lost
MTD24 hours

What an exercise has to demonstrate · RC-5: A restore that reconciles: the recovered ledger balanced against the payment processor’s independent record and against the filings the payments were made for, with any discrepancy enumerated rather than netted.
The part that actually fails: The reconciliation, every time. Recovering the database is routine; proving that the recovered ledger agrees with two external records — and being willing to publish the difference when it does not — is the part organizations discover they cannot do during the exercise.

The Bill of Defense · 8 of 10 layers

T1IdentityWeight25Share19.7%Layer coverage58.1%Residual10.5 pts
T5DataWeight25Share19.7%Layer coverage49.6%Residual12.6 pts
T4Applications and WorkloadsWeight16Share12.6%Layer coverage50%Residual8 pts
T7WorkforceWeight16Share12.6%Layer coverage44.9%Residual8.8 pts
T3NetworksWeight15Share11.8%Layer coverage63.2%Residual5.5 pts
T2DevicesWeight12Share9.4%Layer coverage57.9%Residual5.1 pts
T9Supply ChainWeight12Share9.4%Layer coverage44.4%Residual6.7 pts
T8FacilitiesWeight6Share4.7%Layer coverage40.5%Residual3.6 pts
Rolled upWeight127Share100%Coverage52.2%Residual60.8 pts · 47.8%

Assets that carry it · 9 outright

A-01ICAM identity provider and policy decision pointT1 · weight 25 · 50% covered
A-02PKI and PIV credential serviceT1 · weight 15 · 75% covered
A-06Mission-staff laptopsT2 · weight 15 · 50% covered
A-10TIC 3.0 access pointsT3 · weight 25 · 75% covered
A-12Web application firewall fronting the public tierT3 · weight 16 · 75% covered
A-14Authoritative and recursive DNST3 · weight 16 · 50% covered
A-21The fee and payment applicationT4 · weight 25 · 50% covered
A-27The fee and financial databaseT5 · weight 15 · 75% covered
A-38Primary data center and equipment roomsT8 · weight 10 · 50% covered

A further 31 assets are allocated to this mission without stopping it, carrying 146.9 allocated weight points in total. The full split is in the trace.

Controls in scope · 64

Derived from the layers this mission draws on, not authored against the mission. Nine act on the terrain model itself and therefore apply to every layer by construction; the remaining 47 are named by one or more of the 8 layers in the bill above, for reasons those layers give themselves.

Maneuvers defending it

M1Screen / Guard100% reach11 techniques on 8 layers it draws on
M8Isolation / Retrograde100% reach12 techniques on 8 layers it draws on
M5Ambush90.6% reach11 techniques on 7 layers it draws on
M11Reconstitution88.2% reach10 techniques on 7 layers it draws on
M2Defense in Depth80.3% reach15 techniques on 7 layers it draws on
M7Counterattack75.6% reach8 techniques on 6 layers it draws on
M6Delay73.2% reach9 techniques on 5 layers it draws on
M9Spoiling Attack66.1% reach6 techniques on 5 layers it draws on
M3Envelopment51.2% reach20 techniques on 4 layers it draws on
M4Obstacle / Canalization35.4% reach15 techniques on 4 layers it draws on
M10Exploitation & Pursuit9.4% reach1 technique on 1 layer it draws on

Main effort · SM-4

M7 Counterattack75.6% reach

This is the one mission in continuous contact. Against a sustained, financially motivated adversary the decisive measurement is not whether an intrusion occurred but how quickly the current one is evicted, which makes counterattack the effort everything else supports.

The widest-reaching form here is M1 Screen / Guard at 100%, and the main effort is M7 anyway. Reach is breadth; main effort is concentration. A form that touches every layer a mission stands on is not thereby the place to mass — that is a claim about where the adversary’s plan is decided, and it is a commander’s judgment rather than an output of this table.

What this bill hidesThis bill ties for the heaviest weight in the model and its residual points are the highest of the six, which is the correct answer arrived at slightly wrongly: the weight is driven by data and identity, and the loss event this mission actually faces is fraud through legitimate authorization — a scenario that raises no layer’s coverage gap and therefore appears nowhere in the arithmetic.

Bidirectional Traceability

The Model Promises the Trace Runs Both Ways. One Direction Is Stronger Than the Other.

Pick a mission and see everything defending it: that is the six sheets above, and it is complete. Pick an asset and see every mission it serves: that is the table below, and it is weaker in three specific ways, all of them named rather than smoothed over.

Exhibit 4

Direction Two: Every Asset, and the Missions It Serves

Asset	Tower	Missions it carries outright	Missions it is allocated to, by share	Allocated weight
A-01 ICAM identity provider and policy decision point	T1	Public service Case processing Adjudication Secondary service Public data Fee and financial	Public service delivery22% · 5.5 pts Fee and financial operations22% · 5.5 pts Case processing and adjudication18% · 4.4 pts Administrative adjudication18% · 4.4 pts Secondary public service13% · 3.3 pts Public data services8% · 2 pts	25.1 pts
A-02 PKI and PIV credential service	T1	Case processing Adjudication Fee and financial	Public service delivery22% · 3.3 pts Fee and financial operations22% · 3.3 pts Case processing and adjudication18% · 2.6 pts Administrative adjudication18% · 2.6 pts Secondary public service13% · 2 pts Public data services8% · 1.2 pts	15 pts
A-03 External-user account directory	T1	Public service Secondary service Adjudication	Public service delivery22% · 4.4 pts Fee and financial operations22% · 4.4 pts Case processing and adjudication18% · 3.5 pts Administrative adjudication18% · 3.5 pts Secondary public service13% · 2.6 pts Public data services8% · 1.6 pts	20 pts
A-04 Privileged accounts and the access broker	T1	None	Public service delivery22% · 4.4 pts Fee and financial operations22% · 4.4 pts Case processing and adjudication18% · 3.5 pts Administrative adjudication18% · 3.5 pts Secondary public service13% · 2.6 pts Public data services8% · 1.6 pts	20 pts
A-05 Service and workload identities	T1	None	Public service delivery22% · 3.5 pts Fee and financial operations22% · 3.5 pts Case processing and adjudication18% · 2.8 pts Administrative adjudication18% · 2.8 pts Secondary public service13% · 2.1 pts Public data services8% · 1.3 pts	16 pts
A-06 Mission-staff laptops	T2	Case processing Adjudication Fee and financial	Case processing and adjudication28% · 4.1 pts Administrative adjudication21% · 3.1 pts Fee and financial operations21% · 3.1 pts Public service delivery17% · 2.6 pts Secondary public service14% · 2.1 pts	15 pts
A-07 Contractor and integrator endpoints	T2	None	Case processing and adjudication28% · 4.1 pts Administrative adjudication21% · 3.1 pts Fee and financial operations21% · 3.1 pts Public service delivery17% · 2.6 pts Secondary public service14% · 2.1 pts	15 pts
A-08 Server and virtual-machine fleet	T2	Case processing Secondary service	Case processing and adjudication28% · 3.3 pts Administrative adjudication21% · 2.5 pts Fee and financial operations21% · 2.5 pts Public service delivery17% · 2.1 pts Secondary public service14% · 1.7 pts	12.1 pts
A-09 Build agents and developer workstations	T2	None	Case processing and adjudication28% · 4.4 pts Administrative adjudication21% · 3.3 pts Fee and financial operations21% · 3.3 pts Public service delivery17% · 2.8 pts Secondary public service14% · 2.2 pts	16 pts
A-10 TIC 3.0 access points	T3	Public service Adjudication Secondary service Public data Fee and financial	Public service delivery21% · 5.3 pts Case processing and adjudication17% · 4.3 pts Public data services17% · 4.3 pts Secondary public service16% · 4 pts Fee and financial operations16% · 4 pts Administrative adjudication13% · 3.2 pts	25.1 pts
A-11 Edge delivery and volumetric scrubbing	T3	Public service Secondary service Public data	Public service delivery21% · 4.3 pts Case processing and adjudication17% · 3.4 pts Public data services17% · 3.4 pts Secondary public service16% · 3.2 pts Fee and financial operations16% · 3.2 pts Administrative adjudication13% · 2.6 pts	20.1 pts
A-12 Web application firewall fronting the public tier	T3	Public service Secondary service Fee and financial	Public service delivery21% · 3.4 pts Case processing and adjudication17% · 2.7 pts Public data services17% · 2.7 pts Secondary public service16% · 2.6 pts Fee and financial operations16% · 2.6 pts Administrative adjudication13% · 2 pts	16 pts
A-13 The public-tier / mission-tier boundary	T3	Case processing Adjudication	Public service delivery21% · 4.3 pts Case processing and adjudication17% · 3.4 pts Public data services17% · 3.4 pts Secondary public service16% · 3.2 pts Fee and financial operations16% · 3.2 pts Administrative adjudication13% · 2.6 pts	20.1 pts
A-14 Authoritative and recursive DNS	T3	Public service Case processing Adjudication Secondary service Public data Fee and financial	Public service delivery21% · 3.4 pts Case processing and adjudication17% · 2.7 pts Public data services17% · 2.7 pts Secondary public service16% · 2.6 pts Fee and financial operations16% · 2.6 pts Administrative adjudication13% · 2 pts	16 pts
A-15 The public service portal	T4	Public service	Public service delivery22% · 5.5 pts Case processing and adjudication18% · 4.4 pts Public data services18% · 4.4 pts Administrative adjudication14% · 3.5 pts Secondary public service14% · 3.5 pts Fee and financial operations14% · 3.5 pts	24.8 pts
A-16 The case filing front door	T4	Public service Adjudication	Public service delivery22% · 5.5 pts Case processing and adjudication18% · 4.4 pts Public data services18% · 4.4 pts Administrative adjudication14% · 3.5 pts Secondary public service14% · 3.5 pts Fee and financial operations14% · 3.5 pts	24.8 pts
A-17 The case processing system	T4	Case processing	Public service delivery22% · 3.3 pts Case processing and adjudication18% · 2.7 pts Public data services18% · 2.7 pts Administrative adjudication14% · 2.1 pts Secondary public service14% · 2.1 pts Fee and financial operations14% · 2.1 pts	15 pts
A-18 The administrative adjudication docket	T4	Adjudication	Public service delivery22% · 2.7 pts Case processing and adjudication18% · 2.1 pts Public data services18% · 2.1 pts Administrative adjudication14% · 1.7 pts Secondary public service14% · 1.7 pts Fee and financial operations14% · 1.7 pts	12 pts
A-19 Secondary public service portals	T4	Secondary service	Public service delivery22% · 3.3 pts Case processing and adjudication18% · 2.7 pts Public data services18% · 2.7 pts Administrative adjudication14% · 2.1 pts Secondary public service14% · 2.1 pts Fee and financial operations14% · 2.1 pts	15 pts
A-20 The public bulk data and open API surface	T4	Public data	Public service delivery22% · 3.3 pts Case processing and adjudication18% · 2.7 pts Public data services18% · 2.7 pts Administrative adjudication14% · 2.1 pts Secondary public service14% · 2.1 pts Fee and financial operations14% · 2.1 pts	15 pts
A-21 The fee and payment application	T4	Fee and financial	Public service delivery22% · 5.5 pts Case processing and adjudication18% · 4.4 pts Public data services18% · 4.4 pts Administrative adjudication14% · 3.5 pts Secondary public service14% · 3.5 pts Fee and financial operations14% · 3.5 pts	24.8 pts
A-22 The CI/CD pipeline	T4	None	Public service delivery22% · 4.4 pts Case processing and adjudication18% · 3.5 pts Public data services18% · 3.5 pts Administrative adjudication14% · 2.8 pts Secondary public service14% · 2.8 pts Fee and financial operations14% · 2.8 pts	19.8 pts
A-23 Container platform and orchestration	T4	None	Public service delivery22% · 3.5 pts Case processing and adjudication18% · 2.8 pts Public data services18% · 2.8 pts Administrative adjudication14% · 2.3 pts Secondary public service14% · 2.3 pts Fee and financial operations14% · 2.3 pts	16 pts
A-24 Secrets store for workload credentials	T4	None	Public service delivery22% · 3.3 pts Case processing and adjudication18% · 2.7 pts Public data services18% · 2.7 pts Administrative adjudication14% · 2.1 pts Secondary public service14% · 2.1 pts Fee and financial operations14% · 2.1 pts	15 pts
A-25 Sensitive mission records	T5	Case processing Adjudication	Case processing and adjudication21% · 4.3 pts Fee and financial operations21% · 4.3 pts Public service delivery17% · 3.4 pts Administrative adjudication17% · 3.4 pts Public data services13% · 2.6 pts Secondary public service10% · 2.1 pts	20.1 pts
A-26 The external-user PII store	T5	Public service Adjudication Secondary service	Case processing and adjudication21% · 4.3 pts Fee and financial operations21% · 4.3 pts Public service delivery17% · 3.4 pts Administrative adjudication17% · 3.4 pts Public data services13% · 2.6 pts Secondary public service10% · 2.1 pts	20.1 pts
A-27 The fee and financial database	T5	Fee and financial	Case processing and adjudication21% · 3.2 pts Fee and financial operations21% · 3.2 pts Public service delivery17% · 2.6 pts Administrative adjudication17% · 2.6 pts Public data services13% · 1.9 pts Secondary public service10% · 1.5 pts	15 pts
A-28 Published bulk-data extracts	T5	Public data	Case processing and adjudication21% · 3.2 pts Fee and financial operations21% · 3.2 pts Public service delivery17% · 2.6 pts Administrative adjudication17% · 2.6 pts Public data services13% · 1.9 pts Secondary public service10% · 1.5 pts	15 pts
A-29 Audit and telemetry record stores	T5	None	Case processing and adjudication21% · 2.6 pts Fee and financial operations21% · 2.6 pts Public service delivery17% · 2.1 pts Administrative adjudication17% · 2.1 pts Public data services13% · 1.5 pts Secondary public service10% · 1.2 pts	12.1 pts
A-30 Analytic and non-production copies of mission data	T5	None	Case processing and adjudication21% · 3.4 pts Fee and financial operations21% · 3.4 pts Public service delivery17% · 2.7 pts Administrative adjudication17% · 2.7 pts Public data services13% · 2.1 pts Secondary public service10% · 1.6 pts	15.9 pts
A-31 Building control and physical access systems	T6	None	Nothing. No mission draws on T6, so this asset allocates to no mission at all.	0
A-32 Public-counter and laboratory instrumentation	T6	Secondary service	Nothing. No mission draws on T6, so this asset allocates to no mission at all.	0
A-33 Engineering workstations for facility systems	T6	None	Nothing. No mission draws on T6, so this asset allocates to no mission at all.	0
A-34 The privileged administrator population	T7	None	Fee and financial operations33% · 6.5 pts Case processing and adjudication31% · 6.1 pts Administrative adjudication25% · 4.9 pts Public service delivery12% · 2.4 pts	19.9 pts
A-35 Mission staff with volume record access	T7	Case processing Adjudication	Fee and financial operations33% · 5.2 pts Case processing and adjudication31% · 4.9 pts Administrative adjudication25% · 3.9 pts Public service delivery12% · 2 pts	16 pts
A-36 Contractor and vendor staff with production access	T7	None	Fee and financial operations33% · 6.5 pts Case processing and adjudication31% · 6.1 pts Administrative adjudication25% · 4.9 pts Public service delivery12% · 2.4 pts	19.9 pts
A-37 The defending team itself	T7	None	Fee and financial operations33% · 3.9 pts Case processing and adjudication31% · 3.7 pts Administrative adjudication25% · 2.9 pts Public service delivery12% · 1.5 pts	12 pts
A-38 Primary data center and equipment rooms	T8	Case processing Fee and financial	Case processing and adjudication50% · 5 pts Fee and financial operations50% · 5 pts	10 pts
A-39 Environmental plant serving production	T8	None	Case processing and adjudication50% · 4 pts Fee and financial operations50% · 4 pts	8 pts
A-40 Vendor maintenance routes into production space	T8	None	Case processing and adjudication50% · 8 pts Fee and financial operations50% · 8 pts	16 pts
A-41 Managed service providers with production access	T9	None	Public service delivery22% · 4.4 pts Fee and financial operations22% · 4.4 pts Case processing and adjudication17% · 3.3 pts Secondary public service17% · 3.3 pts Administrative adjudication11% · 2.2 pts Public data services11% · 2.2 pts	19.8 pts
A-42 Third-party components in mission applications	T9	None	Public service delivery22% · 3.6 pts Fee and financial operations22% · 3.6 pts Case processing and adjudication17% · 2.7 pts Secondary public service17% · 2.7 pts Administrative adjudication11% · 1.8 pts Public data services11% · 1.8 pts	16.2 pts
A-43 Vendor update channels into the estate	T9	None	Public service delivery22% · 4.4 pts Fee and financial operations22% · 4.4 pts Case processing and adjudication17% · 3.3 pts Secondary public service17% · 3.3 pts Administrative adjudication11% · 2.2 pts Public data services11% · 2.2 pts	19.8 pts
A-44 The telemetry and analytics platform	TX	None	Nothing. No mission draws on TX, so this asset allocates to no mission at all.	0
A-45 Orchestration and response tooling	TX	None	Nothing. No mission draws on TX, so this asset allocates to no mission at all.	0
A-46 The rules of engagement and the cycle record	TX	None	Nothing. No mission draws on TX, so this asset allocates to no mission at all.	0

A-04 Privileged accounts and the access broker

Tower: T1
Missions it carries outright: None
Missions it is allocated to, by share: Public service delivery22% · 4.4 pts
Fee and financial operations22% · 4.4 pts
Case processing and adjudication18% · 3.5 pts
Administrative adjudication18% · 3.5 pts
Secondary public service13% · 2.6 pts
Public data services8% · 1.6 pts
Allocated weight: 20 pts

A-05 Service and workload identities

Tower: T1
Missions it carries outright: None
Missions it is allocated to, by share: Public service delivery22% · 3.5 pts
Fee and financial operations22% · 3.5 pts
Case processing and adjudication18% · 2.8 pts
Administrative adjudication18% · 2.8 pts
Secondary public service13% · 2.1 pts
Public data services8% · 1.3 pts
Allocated weight: 16 pts

A-06 Mission-staff laptops

Tower: T2
Missions it carries outright: Case processing
Adjudication
Fee and financial
Missions it is allocated to, by share: Case processing and adjudication28% · 4.1 pts
Administrative adjudication21% · 3.1 pts
Fee and financial operations21% · 3.1 pts
Public service delivery17% · 2.6 pts
Secondary public service14% · 2.1 pts
Allocated weight: 15 pts

A-07 Contractor and integrator endpoints

Tower: T2
Missions it carries outright: None
Missions it is allocated to, by share: Case processing and adjudication28% · 4.1 pts
Administrative adjudication21% · 3.1 pts
Fee and financial operations21% · 3.1 pts
Public service delivery17% · 2.6 pts
Secondary public service14% · 2.1 pts
Allocated weight: 15 pts

A-08 Server and virtual-machine fleet

Tower: T2
Missions it carries outright: Case processing
Secondary service
Missions it is allocated to, by share: Case processing and adjudication28% · 3.3 pts
Administrative adjudication21% · 2.5 pts
Fee and financial operations21% · 2.5 pts
Public service delivery17% · 2.1 pts
Secondary public service14% · 1.7 pts
Allocated weight: 12.1 pts

A-09 Build agents and developer workstations

Tower: T2
Missions it carries outright: None
Missions it is allocated to, by share: Case processing and adjudication28% · 4.4 pts
Administrative adjudication21% · 3.3 pts
Fee and financial operations21% · 3.3 pts
Public service delivery17% · 2.8 pts
Secondary public service14% · 2.2 pts
Allocated weight: 16 pts

A-10 TIC 3.0 access points

Tower: T3
Missions it carries outright: Public service
Adjudication
Secondary service
Public data
Fee and financial
Missions it is allocated to, by share: Public service delivery21% · 5.3 pts
Case processing and adjudication17% · 4.3 pts
Public data services17% · 4.3 pts
Secondary public service16% · 4 pts
Fee and financial operations16% · 4 pts
Administrative adjudication13% · 3.2 pts
Allocated weight: 25.1 pts

A-11 Edge delivery and volumetric scrubbing

Tower: T3
Missions it carries outright: Public service
Secondary service
Public data
Missions it is allocated to, by share: Public service delivery21% · 4.3 pts
Case processing and adjudication17% · 3.4 pts
Public data services17% · 3.4 pts
Secondary public service16% · 3.2 pts
Fee and financial operations16% · 3.2 pts
Administrative adjudication13% · 2.6 pts
Allocated weight: 20.1 pts

A-12 Web application firewall fronting the public tier

Tower: T3
Missions it carries outright: Public service
Secondary service
Fee and financial
Missions it is allocated to, by share: Public service delivery21% · 3.4 pts
Case processing and adjudication17% · 2.7 pts
Public data services17% · 2.7 pts
Secondary public service16% · 2.6 pts
Fee and financial operations16% · 2.6 pts
Administrative adjudication13% · 2 pts
Allocated weight: 16 pts

A-13 The public-tier / mission-tier boundary

Tower: T3
Missions it carries outright: Case processing
Adjudication
Missions it is allocated to, by share: Public service delivery21% · 4.3 pts
Case processing and adjudication17% · 3.4 pts
Public data services17% · 3.4 pts
Secondary public service16% · 3.2 pts
Fee and financial operations16% · 3.2 pts
Administrative adjudication13% · 2.6 pts
Allocated weight: 20.1 pts

A-14 Authoritative and recursive DNS

Tower: T3
Missions it carries outright: Public service
Case processing
Adjudication
Secondary service
Public data
Fee and financial
Missions it is allocated to, by share: Public service delivery21% · 3.4 pts
Case processing and adjudication17% · 2.7 pts
Public data services17% · 2.7 pts
Secondary public service16% · 2.6 pts
Fee and financial operations16% · 2.6 pts
Administrative adjudication13% · 2 pts
Allocated weight: 16 pts

A-15 The public service portal

Tower: T4
Missions it carries outright: Public service
Missions it is allocated to, by share: Public service delivery22% · 5.5 pts
Case processing and adjudication18% · 4.4 pts
Public data services18% · 4.4 pts
Administrative adjudication14% · 3.5 pts
Secondary public service14% · 3.5 pts
Fee and financial operations14% · 3.5 pts
Allocated weight: 24.8 pts

A-16 The case filing front door

Tower: T4
Missions it carries outright: Public service
Adjudication
Missions it is allocated to, by share: Public service delivery22% · 5.5 pts
Case processing and adjudication18% · 4.4 pts
Public data services18% · 4.4 pts
Administrative adjudication14% · 3.5 pts
Secondary public service14% · 3.5 pts
Fee and financial operations14% · 3.5 pts
Allocated weight: 24.8 pts

A-17 The case processing system

Tower: T4
Missions it carries outright: Case processing
Missions it is allocated to, by share: Public service delivery22% · 3.3 pts
Case processing and adjudication18% · 2.7 pts
Public data services18% · 2.7 pts
Administrative adjudication14% · 2.1 pts
Secondary public service14% · 2.1 pts
Fee and financial operations14% · 2.1 pts
Allocated weight: 15 pts

A-18 The administrative adjudication docket

Tower: T4
Missions it carries outright: Adjudication
Missions it is allocated to, by share: Public service delivery22% · 2.7 pts
Case processing and adjudication18% · 2.1 pts
Public data services18% · 2.1 pts
Administrative adjudication14% · 1.7 pts
Secondary public service14% · 1.7 pts
Fee and financial operations14% · 1.7 pts
Allocated weight: 12 pts

A-19 Secondary public service portals

Tower: T4
Missions it carries outright: Secondary service
Missions it is allocated to, by share: Public service delivery22% · 3.3 pts
Case processing and adjudication18% · 2.7 pts
Public data services18% · 2.7 pts
Administrative adjudication14% · 2.1 pts
Secondary public service14% · 2.1 pts
Fee and financial operations14% · 2.1 pts
Allocated weight: 15 pts

A-20 The public bulk data and open API surface

Tower: T4
Missions it carries outright: Public data
Missions it is allocated to, by share: Public service delivery22% · 3.3 pts
Case processing and adjudication18% · 2.7 pts
Public data services18% · 2.7 pts
Administrative adjudication14% · 2.1 pts
Secondary public service14% · 2.1 pts
Fee and financial operations14% · 2.1 pts
Allocated weight: 15 pts

A-21 The fee and payment application

Tower: T4
Missions it carries outright: Fee and financial
Missions it is allocated to, by share: Public service delivery22% · 5.5 pts
Case processing and adjudication18% · 4.4 pts
Public data services18% · 4.4 pts
Administrative adjudication14% · 3.5 pts
Secondary public service14% · 3.5 pts
Fee and financial operations14% · 3.5 pts
Allocated weight: 24.8 pts

A-22 The CI/CD pipeline

Tower: T4
Missions it carries outright: None
Missions it is allocated to, by share: Public service delivery22% · 4.4 pts
Case processing and adjudication18% · 3.5 pts
Public data services18% · 3.5 pts
Administrative adjudication14% · 2.8 pts
Secondary public service14% · 2.8 pts
Fee and financial operations14% · 2.8 pts
Allocated weight: 19.8 pts

A-23 Container platform and orchestration

Tower: T4
Missions it carries outright: None
Missions it is allocated to, by share: Public service delivery22% · 3.5 pts
Case processing and adjudication18% · 2.8 pts
Public data services18% · 2.8 pts
Administrative adjudication14% · 2.3 pts
Secondary public service14% · 2.3 pts
Fee and financial operations14% · 2.3 pts
Allocated weight: 16 pts

A-24 Secrets store for workload credentials

Tower: T4
Missions it carries outright: None
Missions it is allocated to, by share: Public service delivery22% · 3.3 pts
Case processing and adjudication18% · 2.7 pts
Public data services18% · 2.7 pts
Administrative adjudication14% · 2.1 pts
Secondary public service14% · 2.1 pts
Fee and financial operations14% · 2.1 pts
Allocated weight: 15 pts

A-25 Sensitive mission records

Tower: T5
Missions it carries outright: Case processing
Adjudication
Missions it is allocated to, by share: Case processing and adjudication21% · 4.3 pts
Fee and financial operations21% · 4.3 pts
Public service delivery17% · 3.4 pts
Administrative adjudication17% · 3.4 pts
Public data services13% · 2.6 pts
Secondary public service10% · 2.1 pts
Allocated weight: 20.1 pts

A-26 The external-user PII store

Tower: T5
Missions it carries outright: Public service
Adjudication
Secondary service
Missions it is allocated to, by share: Case processing and adjudication21% · 4.3 pts
Fee and financial operations21% · 4.3 pts
Public service delivery17% · 3.4 pts
Administrative adjudication17% · 3.4 pts
Public data services13% · 2.6 pts
Secondary public service10% · 2.1 pts
Allocated weight: 20.1 pts

A-27 The fee and financial database

Tower: T5
Missions it carries outright: Fee and financial
Missions it is allocated to, by share: Case processing and adjudication21% · 3.2 pts
Fee and financial operations21% · 3.2 pts
Public service delivery17% · 2.6 pts
Administrative adjudication17% · 2.6 pts
Public data services13% · 1.9 pts
Secondary public service10% · 1.5 pts
Allocated weight: 15 pts

A-28 Published bulk-data extracts

Tower: T5
Missions it carries outright: Public data
Missions it is allocated to, by share: Case processing and adjudication21% · 3.2 pts
Fee and financial operations21% · 3.2 pts
Public service delivery17% · 2.6 pts
Administrative adjudication17% · 2.6 pts
Public data services13% · 1.9 pts
Secondary public service10% · 1.5 pts
Allocated weight: 15 pts

A-29 Audit and telemetry record stores

Tower: T5
Missions it carries outright: None
Missions it is allocated to, by share: Case processing and adjudication21% · 2.6 pts
Fee and financial operations21% · 2.6 pts
Public service delivery17% · 2.1 pts
Administrative adjudication17% · 2.1 pts
Public data services13% · 1.5 pts
Secondary public service10% · 1.2 pts
Allocated weight: 12.1 pts

A-30 Analytic and non-production copies of mission data

Tower: T5
Missions it carries outright: None
Missions it is allocated to, by share: Case processing and adjudication21% · 3.4 pts
Fee and financial operations21% · 3.4 pts
Public service delivery17% · 2.7 pts
Administrative adjudication17% · 2.7 pts
Public data services13% · 2.1 pts
Secondary public service10% · 1.6 pts
Allocated weight: 15.9 pts

A-31 Building control and physical access systems

Tower: T6
Missions it carries outright: None
Missions it is allocated to, by share: Nothing. No mission draws on T6, so this asset allocates to no mission at all.
Allocated weight: 0

A-32 Public-counter and laboratory instrumentation

Tower: T6
Missions it carries outright: Secondary service
Missions it is allocated to, by share: Nothing. No mission draws on T6, so this asset allocates to no mission at all.
Allocated weight: 0

A-33 Engineering workstations for facility systems

Tower: T6
Missions it carries outright: None
Missions it is allocated to, by share: Nothing. No mission draws on T6, so this asset allocates to no mission at all.
Allocated weight: 0

A-34 The privileged administrator population

Tower: T7
Missions it carries outright: None
Missions it is allocated to, by share: Fee and financial operations33% · 6.5 pts
Case processing and adjudication31% · 6.1 pts
Administrative adjudication25% · 4.9 pts
Public service delivery12% · 2.4 pts
Allocated weight: 19.9 pts

A-35 Mission staff with volume record access

Tower: T7
Missions it carries outright: Case processing
Adjudication
Missions it is allocated to, by share: Fee and financial operations33% · 5.2 pts
Case processing and adjudication31% · 4.9 pts
Administrative adjudication25% · 3.9 pts
Public service delivery12% · 2 pts
Allocated weight: 16 pts

A-36 Contractor and vendor staff with production access

Tower: T7
Missions it carries outright: None
Missions it is allocated to, by share: Fee and financial operations33% · 6.5 pts
Case processing and adjudication31% · 6.1 pts
Administrative adjudication25% · 4.9 pts
Public service delivery12% · 2.4 pts
Allocated weight: 19.9 pts

A-37 The defending team itself

Tower: T7
Missions it carries outright: None
Missions it is allocated to, by share: Fee and financial operations33% · 3.9 pts
Case processing and adjudication31% · 3.7 pts
Administrative adjudication25% · 2.9 pts
Public service delivery12% · 1.5 pts
Allocated weight: 12 pts

A-38 Primary data center and equipment rooms

Tower: T8
Missions it carries outright: Case processing
Fee and financial
Missions it is allocated to, by share: Case processing and adjudication50% · 5 pts
Fee and financial operations50% · 5 pts
Allocated weight: 10 pts

A-39 Environmental plant serving production

Tower: T8
Missions it carries outright: None
Missions it is allocated to, by share: Case processing and adjudication50% · 4 pts
Fee and financial operations50% · 4 pts
Allocated weight: 8 pts

A-40 Vendor maintenance routes into production space

Tower: T8
Missions it carries outright: None
Missions it is allocated to, by share: Case processing and adjudication50% · 8 pts
Fee and financial operations50% · 8 pts
Allocated weight: 16 pts

A-41 Managed service providers with production access

Tower: T9
Missions it carries outright: None
Missions it is allocated to, by share: Public service delivery22% · 4.4 pts
Fee and financial operations22% · 4.4 pts
Case processing and adjudication17% · 3.3 pts
Secondary public service17% · 3.3 pts
Administrative adjudication11% · 2.2 pts
Public data services11% · 2.2 pts
Allocated weight: 19.8 pts

A-42 Third-party components in mission applications

Tower: T9
Missions it carries outright: None
Missions it is allocated to, by share: Public service delivery22% · 3.6 pts
Fee and financial operations22% · 3.6 pts
Case processing and adjudication17% · 2.7 pts
Secondary public service17% · 2.7 pts
Administrative adjudication11% · 1.8 pts
Public data services11% · 1.8 pts
Allocated weight: 16.2 pts

A-43 Vendor update channels into the estate

Tower: T9
Missions it carries outright: None
Missions it is allocated to, by share: Public service delivery22% · 4.4 pts
Fee and financial operations22% · 4.4 pts
Case processing and adjudication17% · 3.3 pts
Secondary public service17% · 3.3 pts
Administrative adjudication11% · 2.2 pts
Public data services11% · 2.2 pts
Allocated weight: 19.8 pts

A-44 The telemetry and analytics platform

Tower: TX
Missions it carries outright: None
Missions it is allocated to, by share: Nothing. No mission draws on TX, so this asset allocates to no mission at all.
Allocated weight: 0

A-45 Orchestration and response tooling

Tower: TX
Missions it carries outright: None
Missions it is allocated to, by share: Nothing. No mission draws on TX, so this asset allocates to no mission at all.
Allocated weight: 0

A-46 The rules of engagement and the cycle record

Tower: TX
Missions it carries outright: None
Missions it is allocated to, by share: Nothing. No mission draws on TX, so this asset allocates to no mission at all.
Allocated weight: 0

Two relations, deliberately kept apart. Carries outright is authored per asset and means the mission stops without it. Allocated is arithmetic: an asset’s weight is split across the missions drawing on its tower, in proportion to their declared draws, so the shares on any layer sum to one. The first is precise and sparse; the second is complete and coarse. Neither is presented as the other.

Where the Second Direction Is Weaker, Stated in Numbers

Allocation resolves to a tower, not to an asset
The register knows which tower an asset sits in; the mission declares a draw on that tower. Nothing joins a specific asset to a specific mission except the 24 authored “carries outright” relations. So the allocated answer for shared infrastructure is every mission drawing on that layer — true, arithmetically clean, and low-resolution. The identity provider allocates to all six missions because all six draw on identity, which is correct and is not the same as knowing which mission would notice first.
22 of 46 assets carry no mission outright
The pipeline, the access broker, the telemetry platform, every supplier row: 22 assets — 47.8% of the register — stop no mission if they stop. For those, allocation is the only answer the trace can give. Widening the relation to “is relevant to” would fill the column and destroy it, because then everything would carry everything.
6 assets allocate to nothing at all
2 of the 10 layers — T6 Operational Technology and TX Cross-Cutting — are drawn on by no mission in the model. Every asset sitting on them therefore allocates to no mission, and the arithmetic is not wrong: the enabler layer is deliberately scored as an enabler rather than as ground, and the operational-technology layer carries no declared mission draw. It does mean the trace returns an empty answer for the telemetry platform and the rules of engagement, which are two of the assets a defender would least like to be told nothing about.

One dependency the register asserts and the bill cannot price

A-32 Public-counter and laboratory instrumentation is declared a hard dependency of Secondary public service — the mission stops without it — and it sits on T6 Operational Technology, which that mission’s draw vector gives no weight to at all. Its bill therefore prices this dependency at zero.

This is left visible on purpose. It is the most useful thing the second direction produces, and it exists only because the two directions were built from different data: the draw vectors are declared per mission in the terrain reference, and the dependencies are declared per asset here. Where they disagree, one of them is wrong — and finding out which is a conversation with a mission owner, not an edit to a table. A model that quietly reconciled the two would have destroyed the finding to protect the arithmetic.

What the Numbers Are For

Weight Against Coverage Gap Is a Ranked Backlog, Not a Dashboard.

A coverage percentage that does not change what gets funded next quarter has cost the agency the effort of computing it. Multiplying weight by the gap turns the whole model into an ordered list, which is the only output of it that anybody acts on.

Exhibit 5

The Twelve Heaviest Remediation Items, Ranked by Residual Weight Points

01
A-01 ICAM identity provider and policy decision point
- Weight25
- Coverage50%
- Residual12.5 pts
- TowerT1
Stops Public service delivery, Case processing and adjudication, Administrative adjudication, Secondary public service, Public data services, Fee and financial operations. Allocated weight across every mission it serves: 25.1 points.
02
A-15 The public service portal
- Weight25
- Coverage50%
- Residual12.5 pts
- TowerT4
Stops Public service delivery. Allocated weight across every mission it serves: 24.8 points.
03
A-16 The case filing front door
- Weight25
- Coverage50%
- Residual12.5 pts
- TowerT4
Stops Public service delivery, Administrative adjudication. Allocated weight across every mission it serves: 24.8 points.
04
A-21 The fee and payment application
- Weight25
- Coverage50%
- Residual12.5 pts
- TowerT4
Stops Fee and financial operations. Allocated weight across every mission it serves: 24.8 points.
05
A-30 Analytic and non-production copies of mission data
- Weight16
- Coverage25%
- Residual12 pts
- TowerT5
Stops no mission outright. Allocated weight across every mission it serves: 15.9 points — which is the entire funding argument for it, and it is a weaker one than the number deserves.
06
A-35 Mission staff with volume record access
- Weight16
- Coverage25%
- Residual12 pts
- TowerT7
Stops Case processing and adjudication, Administrative adjudication. Allocated weight across every mission it serves: 16 points.
07
A-40 Vendor maintenance routes into production space
- Weight16
- Coverage25%
- Residual12 pts
- TowerT8
Stops no mission outright. Allocated weight across every mission it serves: 16 points — which is the entire funding argument for it, and it is a weaker one than the number deserves.
08
A-42 Third-party components in mission applications
- Weight16
- Coverage25%
- Residual12 pts
- TowerT9
Stops no mission outright. Allocated weight across every mission it serves: 16.2 points — which is the entire funding argument for it, and it is a weaker one than the number deserves.
09
A-04 Privileged accounts and the access broker
- Weight20
- Coverage50%
- Residual10 pts
- TowerT1
Stops no mission outright. Allocated weight across every mission it serves: 20 points — which is the entire funding argument for it, and it is a weaker one than the number deserves.
10
A-13 The public-tier / mission-tier boundary
- Weight20
- Coverage50%
- Residual10 pts
- TowerT3
Stops Case processing and adjudication, Administrative adjudication. Allocated weight across every mission it serves: 20.1 points.
11
A-22 The CI/CD pipeline
- Weight20
- Coverage50%
- Residual10 pts
- TowerT4
Stops no mission outright. Allocated weight across every mission it serves: 19.8 points — which is the entire funding argument for it, and it is a weaker one than the number deserves.
12
A-25 Sensitive mission records
- Weight20
- Coverage50%
- Residual10 pts
- TowerT5
Stops Case processing and adjudication, Administrative adjudication. Allocated weight across every mission it serves: 20.1 points.

Illustrative — the Federal Reference Agency profile, not an assessment of any real estate. Ranked over assets rather than sub-towers, because a backlog item has to be a thing somebody can be assigned. The right-hand column is the funding argument: an item that stops a mission outright is a different conversation from one that merely carries allocated weight, even at identical residual points — compare the pipeline with the portal.

The computation is CE-4; the ranking is CE-5. Both are controls rather than practices for the same reason: a rollup performed once, at authorization time, describes an estate that no longer exists by the time anybody reads it. The register’s currency is TM-6, and every figure above inherits the staleness of the inventory it was computed from.

What This Page Does Not Tell You

Four Limits, Stated so Nobody Has to Discover Them in a Briefing.

Reach Is Normalized per Mission, so It Does Not Compare Across Them

A form’s reach is the share of that mission’s weight it touches. A mission drawing on five layers is easier to reach completely than one drawing on eight, so the narrowest bill on the page shows the highest reach figures. Reach ranks forms within a mission and says nothing across missions.

Coverage Is a Conversion, Not a Measurement

Every percentage traces back to a four-rung maturity judgment converted to 25, 50, 75 or 100. The conversion is the model’s own convention. It makes maturity averageable, which is useful, and it invites more confidence than a four-point ordinal scale can carry.

The Register Is an Archetype, Not an Inventory

46 rows stand in for an estate that would run to tens of thousands. Aggregation at this level is what makes the model briefable and is also what hides the one unpatched host. The register is the shape of an answer; the inventory that TM-1 demands is the answer.

Nothing Here Is Denominated in Money

The allocation borrows a shape, not a currency. This model does not cost a control, price a maneuver, or produce a budget artifact — so “where to spend the next control dollar” is a ranking of what is exposed, not an estimate of what closing it costs.

Elsewhere in the Manual

Every Mission Gets a Bill. This Is What Is on It.

Coverage Flows Upward the Way Cost Does, and Arrives as a Bill.

Asset pools46 assets · 11 pools

Sub-towers39 sub-towers

Defense towers10 layers

Maneuver solutions11 forms · 154 techniques

Mission consumers6 missions

Side by Side, and the Thing They Refuse to Show You.

Public service delivery

Case processing and adjudication

Administrative adjudication

Secondary public service

Public data services

Fee and financial operations

The Asset Register, Which Is the Part That Makes the Trace Run Backwards.

Identity assets

Device assets

Network assets

Application assets

Cloud workload assets

Data assets

Operational technology assets

Workforce assets

Facility assets

Supply-chain assets

Cross-cutting assets

A-01 ICAM identity provider and policy decision point

A-02 PKI and PIV credential service

A-03 External-user account directory

A-04 Privileged accounts and the access broker

A-05 Service and workload identities

A-06 Mission-staff laptops

A-07 Contractor and integrator endpoints

A-08 Server and virtual-machine fleet

A-09 Build agents and developer workstations

A-10 TIC 3.0 access points

A-11 Edge delivery and volumetric scrubbing

A-12 Web application firewall fronting the public tier

A-13 The public-tier / mission-tier boundary

A-14 Authoritative and recursive DNS

A-15 The public service portal

A-16 The case filing front door

A-17 The case processing system

A-18 The administrative adjudication docket

A-19 Secondary public service portals

A-20 The public bulk data and open API surface

A-21 The fee and payment application

A-22 The CI/CD pipeline

A-23 Container platform and orchestration

A-24 Secrets store for workload credentials

A-25 Sensitive mission records

A-26 The external-user PII store

A-27 The fee and financial database

A-28 Published bulk-data extracts

A-29 Audit and telemetry record stores

A-30 Analytic and non-production copies of mission data

A-31 Building control and physical access systems

A-32 Public-counter and laboratory instrumentation

A-33 Engineering workstations for facility systems

A-34 The privileged administrator population

A-35 Mission staff with volume record access

A-36 Contractor and vendor staff with production access

A-37 The defending team itself

A-38 Primary data center and equipment rooms

A-39 Environmental plant serving production

A-40 Vendor maintenance routes into production space

A-41 Managed service providers with production access

A-42 Third-party components in mission applications

A-43 Vendor update channels into the estate

A-44 The telemetry and analytics platform

A-45 Orchestration and response tooling

A-46 The rules of engagement and the cycle record

Each Mission, Written Out in Full.

The Model Promises the Trace Runs Both Ways. One Direction Is Stronger Than the Other.

A-01 ICAM identity provider and policy decision point

A-02 PKI and PIV credential service

A-03 External-user account directory

A-04 Privileged accounts and the access broker

A-05 Service and workload identities

A-06 Mission-staff laptops