Six Phases, Each with a Main Effort, a Cadence and a Width of Authority.
Phasing lets leadership see network defense as a campaign with a designated main effort per phase rather than as an undifferentiated round-the-clock grind. A phase declaration is not a label: it moves how fast the operating loop is expected to turn, which forms of maneuver dominate, and how much the SOC may do without asking. Each phase below is set out with the conditions that justify declaring it, the conditions that end it, and how it differs from the phases on either side.
Three Things That Stop This List Being Misread.
Every one of these has been got wrong in practice, and each mistake produces a specific, predictable distortion in how the campaign is run.
A phase is declared against a scope, not against an agency.
An estate can be in Dominate on one mission service and Shape on everything else. The phase declaration control is written to carry a scope for exactly this reason, and a declaration without one is a statement nobody can act on.
Phases are not maturity.
Being in Phase III is not progress. It means an adversary is on or adjacent to key terrain. A program that reads the phase list as a ladder will start reporting phase advancement as achievement, which inverts the meaning of the entire model.
Regression must be declarable without embarrassment.
Campaigns go backwards. An eviction that turns out to be incomplete returns the campaign to Dominate from Stabilize. If declaring that costs someone their credibility, it will not be declared, and the campaign will be fought in the wrong phase.
What Each Declaration Actually Changes.
Cadence and authority are the two operational consequences of a phase declaration. A phase change that moves neither has changed a word on a slide.
| Phase | Objective | Typical main effort | Cadence | Authority |
|---|---|---|---|---|
| 0 — ShapeSet conditions | Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence. | The identity plane, in most federal estates. | The slowest cadence the campaign will run. | The widest deliberation and the narrowest pre-authorization. |
| I — DeterRaise adversary cost | Visible hardening, a deception grid, and a stated attribution posture. | The deception grid across the data terrain. | Compressed from the standing cadence, typically monthly to fortnightly. | Pre-authorization begins to widen, and it widens along one axis: reversibility. |
| II — Seize InitiativeContest first contact | Detect early, canalize movement, and buy decision time. | The decisive point at the end of the avenue the adversary is on. | The cycle stops being periodic and becomes event-driven. | The pre-authorized set is the phase. |
| III — DominateDefeat the attempt | Hunt, contain, evict. | Eviction — and uniquely, the main effort here is a time rather than a place. | Continuous. | Broadest of any phase. |
| IV — StabilizeRestore secure operations | Eradicate, verify, and preserve availability through the recovery. | Verification. | Daily, driven by the recovery sequence rather than by the analytic cycle. | Narrows, deliberately. |
| V — Enable / RestoreHand back to garrison | Recover, harden, and update the doctrine and the intelligence requirements. | Exploitation and pursuit — converting contact into durable advantage. | Returns to the standing cadence, with one exception: the first cycle after the campaign should run at the compressed cadence, because the volume of change moving through the overlay, the requirements and the rules of engagement is higher than a standing cycle is sized for.. | Back to garrison levels — but the rules of engagement themselves are now the agenda item rather than the constraint. |
0 — Shape
Set conditions
- Objective
- Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
- Typical main effort
- The identity plane, in most federal estates.
- Cadence
- The slowest cadence the campaign will run.
- Authority
- The widest deliberation and the narrowest pre-authorization.
I — Deter
Raise adversary cost
- Objective
- Visible hardening, a deception grid, and a stated attribution posture.
- Typical main effort
- The deception grid across the data terrain.
- Cadence
- Compressed from the standing cadence, typically monthly to fortnightly.
- Authority
- Pre-authorization begins to widen, and it widens along one axis: reversibility.
II — Seize Initiative
Contest first contact
- Objective
- Detect early, canalize movement, and buy decision time.
- Typical main effort
- The decisive point at the end of the avenue the adversary is on.
- Cadence
- The cycle stops being periodic and becomes event-driven.
- Authority
- The pre-authorized set is the phase.
III — Dominate
Defeat the attempt
- Objective
- Hunt, contain, evict.
- Typical main effort
- Eviction — and uniquely, the main effort here is a time rather than a place.
- Cadence
- Continuous.
- Authority
- Broadest of any phase.
IV — Stabilize
Restore secure operations
- Objective
- Eradicate, verify, and preserve availability through the recovery.
- Typical main effort
- Verification.
- Cadence
- Daily, driven by the recovery sequence rather than by the analytic cycle.
- Authority
- Narrows, deliberately.
V — Enable / Restore
Hand back to garrison
- Objective
- Recover, harden, and update the doctrine and the intelligence requirements.
- Typical main effort
- Exploitation and pursuit — converting contact into durable advantage.
- Cadence
- Returns to the standing cadence, with one exception: the first cycle after the campaign should run at the compressed cadence, because the volume of change moving through the overlay, the requirements and the rules of engagement is higher than a standing cycle is sized for..
- Authority
- Back to garrison levels — but the rules of engagement themselves are now the agenda item rather than the constraint.
Each Phase, and the Forms That Dominate It.
Dominant forms come from the framework’s own phasing table. A scheme still names a sequence and one main effort inside the phase — the dominant forms say which parts of the catalog the phase draws on, not which ones to deploy at once.
Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
Main effortThe identity plane, in most federal estates.Ends whenSector or partner reporting names a campaign targeting this kind of estate, and hardening becomes worth advertising — declare Deter.Visible hardening, a deception grid, and a stated attribution posture.
Main effortThe deception grid across the data terrain.Ends whenFirst observed activity against a declared avenue of approach — declare Seize Initiative.Detect early, canalize movement, and buy decision time.
Main effortThe decisive point at the end of the avenue the adversary is on.Ends whenThe attempt is defeated without the adversary reaching key terrain — return to Deter or Shape, and run an exploitation pass to close the avenue.Hunt, contain, evict.
Main effortEviction — and uniquely, the main effort here is a time rather than a place.Ends whenEviction is verified by hunt rather than inferred from the absence of alerts. No adversary-controlled access remains, and that is a positive finding by someone who went looking.Eradicate, verify, and preserve availability through the recovery.
Main effortVerification.Ends whenEvery affected mission service is back inside its declared recovery objective, and restored data has been verified against an independent integrity record.Recover, harden, and update the doctrine and the intelligence requirements.
Main effortExploitation and pursuit — converting contact into durable advantage.Ends whenThe exploited avenue is closed and the closure is verified by a fresh reachability run, not by the change ticket.The Campaign Moves over Months. the Loop Turns Inside It.
A phase sets the tempo the loop is expected to hold. The loop is what actually holds it. The operating loop, step by step →