Reference manual · object model

Ten Nouns, Three Kinds.

A tower is not a terrain layer. A tier is neither. An asset is not the ground it stands on, and a form of maneuver is not a technique. These are the framework’s ten object classes, and confusing two of them is the fastest way to produce an overlay that looks correct and scores nothing — so each entry below leads with the question its class answers, and names the class it is most often mistaken for.

10Object classesEvery noun the framework defines

6Fixed by the frameworkIdentical at every agency

3Authored by youDifferent at every agency

1On the seamWhere the two halves meet and produce a number

Which half of the framework is this?

One Is a Rule You Inherit. the Other Is a Fact About Your Own Ground.

One framework, one version, one platform. The distinction that matters is not where a page is served from — it is whether you are reading a rule you inherit or filling in a fact about your own ground. Every object class below is sorted by that question, and towers are on the seam because they are where the two meet.

Fixed

The reference manual

identical at every agency — read it, cite it, be assessed against it

Ten terrain layers, eleven forms of maneuver, 154 techniques and the full treatment of all 78 controls. Nobody adopts this half. It is the fixed rule two agencies can be compared against, and an assessment means nothing if each side brought its own copy.

Open the reference manual →

Yours

The applied surface

different at every agency — the half that produces a score

Your assets, your tiers, your missions, and the towers where they roll up through the framework’s layers. The Diagram Studio, the clearing drill and the worked example all operate here. Nothing in this half is prescribed, and everything in it is measured.

Put your estate on the map →

Where the two meet is a tower: your assets rolling up through the framework’s layers, which is the only place coverage becomes a number.

How They Fit

Two Sentences Hold the Whole Model.

Ten definitions do not tell you how the ten relate. These do. Everything else on this page is one of these nouns, expanded.

Assetsits in aTieron aTerrain layerand rolls up through itsTowerto aMission

Form of maneuveris realized by aTechniqueon one layer, and made assessable by aControl

A green edge marks a class you author; a heavy edge marks the one on the seam; a plain edge is fixed by the framework. Read the two sentences together and the claim is visible in one line: the second is the same for every agency in the country, and the first is yours.

The Classes

Each with the Question It Answers, and Its Impostor.

The last field is the one that earns the table. Most misuse here is not ignorance of a term — it is confident substitution of a near neighbor that behaves differently.

Fixed by the framework

6 of 10 classesReference · asom-fed.threatdefendr.com

The same for every agency in the country. You do not author these — you read them, cite them, and are assessed against them.

T1 – T10

Terrain layer

10 layers

What kind of ground is this?

The ten kinds of ground a federal estate is defended on — identity, devices, networks, applications, data, operational technology, workforce, facilities, supply chain, and the cross-cutting layer. Five are the CISA zero-trust pillars carried verbatim; four are ASOM-Fed’s own.

Often mistaken forA tier, which is a band you drew on your own diagram. A terrain layer is a category the framework fixes for every agency in the country, so one laptop sits on T2 Devices whichever tier you happen to have drawn around it.

The ten layers, with the justification for each

M1 – M11

Form of maneuver

11 forms

What am I going to do?

The eleven durable moves a defender can make. A form names an intent — deny movement, trade space for information, hand the ground back deliberately — at the level a commander can direct without knowing which product implements it.

Often mistaken forA technique, or a control. The form is the intent; a technique is one way of carrying that intent out on one layer; a control is what an assessor tests to find out whether you could.

Every form, with its mechanism and its indicator

M5.03

Technique

154 techniques

How, exactly, on this ground?

One form of maneuver realized on one terrain layer, with a falsifiable indicator. The ID names its parent form, so M5.03 is the third cataloged way to perform M5 Ambush.

Often mistaken forA control, or a product. A technique is something a defense can be observed doing; a control is the obligation to be capable of it. Neither one names a vendor.

The whole catalog as a matrix

KT-4

Control

78 controls · 14 families

What will an assessor test?

The assessable requirement — statement, activities, one accountable role, the evidence it produces and the procedure an assessor follows. Each inherits from NIST SP 800-53 and maps onto CSF 2.0.

Often mistaken forA technique. The technique is the move itself; the control is the requirement that the move be available, written so that doing it leaves the evidence behind.

All 78, with their inheritance

Passive · Active · Reactive · Directing

Posture

4 postures

Does it still hold when nobody is watching?

Whether a control keeps working unattended. It is an axis across the whole catalog rather than a group of controls, so every control has one.

Often mistaken forA campaign phase. Posture is a property a control carries at all times; a phase is where the campaign stands this month.

The posture model

Phase 0 – 5

Campaign phase

6 phases

Where are we in the campaign?

Six phases, each with a declared main effort and stated conditions for moving to the next. Declaring one is what makes a scheme of maneuver a plan rather than a list of capabilities.

Often mistaken forThe six steps of the operating cycle. The cycle — Frame, Map, Array, Maneuver, Fuse, Assess — turns continuously inside whichever phase you have declared.

The six phases and their entry conditions

Yours

3 of 10 classesApply · threatdefendr.com/asom/

Different at every agency. These are authored, not consulted — you draw them, weight them, and they are what makes a score yours rather than the archetype’s.

Asset

Per estate

What do I actually own?

The concrete things on your estate — a directory, a boundary device, a records store. Each lands on exactly one terrain layer, sits inside one tier, carries a weight, and serves at least one mission.

Often mistaken forThe terrain it stands on. The ten layers are the map; assets are what stands on it. Two agencies can share the entire map and not a single asset.

The reference archetype’s register

Public · Mission · Data · Support

Tier

Per estate

Where does this sit on my diagram?

The bands you draw across your own overlay to separate exposure from consequence. They belong to one estate’s architecture, and a differently shaped agency may reasonably draw different ones.

Often mistaken forA terrain layer, or a maturity level. A tier is a line on your own drawing, and a differently shaped agency may reasonably draw it somewhere else. In most estates the decisive point is a crossing between two tiers.

Draw them in the studio

Mission service

Mission

Per estate

Why is any of this defended?

The service the agency exists to deliver. Every asset serves one, and the Bill of Defense states — per mission — what protects it, how much coverage rolls up, and what risk is left over.

Often mistaken forA system, or a business unit. A mission is whatever would be missed if it stopped, which is why coverage is reported against it rather than against a server.

The mission services, each with a worked Bill of Defense

The join

1 of 10 classesWhere they meet · Both

One class sits on the seam. It is the framework’s map used as an accounting bucket for your estate’s assets, which is the moment coverage stops being a diagram and becomes a number.

T1 – T10

Tower

10 towers

How much cover does this ground carry?

The same ten layers used as accounting buckets. Coverage and residual risk roll up through a tower to the missions that consume it, the way a cost-transparency model rolls spend up from a pool to a consumer.

Often mistaken forTerrain, whose IDs it shares on purpose — a canvas node, a control and a rollup line all say T3 and mean the same ground. What separates them is the question: terrain asks where you are standing, a tower asks how much weight rests there and which missions it carries.

The Defense Tower Model

Alongside

Where Each of These Is Defined at Depth.

This page separates the classes. The glossary defines the terms used inside them — key terrain, main effort, decisive point, avenue of approach — with the same impostor treatment.