ASOM-Fedv6.1Open the explorer
Phase V of 6 · joint phase: Enable / Restore

Hand back to garrison

Objective

Recover, harden, and update the doctrine and the intelligence requirements.

Joint meaning. Enable / Restore.

Discussion

Phase V hands the campaign back to garrison, and it is the only phase whose output is a change to the framework itself. The exploited avenue is closed and re-tested, the overlay and the intelligence requirements are updated, indicators are converted into durable detections, and the rules of engagement are revised by the people who have just discovered which authority they did not have.

It is also the phase most often skipped, because it happens after the pressure is off and nothing is on fire. The cost of skipping it is specific and measurable: the same avenue of approach is available for the next campaign, and the framework has learned nothing that it can be held to next cycle.

The first framing after Phase V is the most valuable framing a program will run all year. It is the one Frame conducted with real evidence about how this estate is actually attacked, against this estate’s actual terrain, by people who have just watched their own assumptions fail.

What the Main Effort Typically Is

Exploitation and pursuit — converting contact into durable advantage.

The measurable claim is precise: the same avenue of approach is never successfully used twice. That is testable at the next reachability run, it is reportable in the brief, and it is the only form of maneuver whose value is realized entirely after the engagement is over.

Typical, not prescribed. The main effort is designated per campaign against the decisive points the terrain analysis produced; what this phase does is narrow the field of sensible answers.

Dominant Forms of Maneuver

  • M11 ReconstitutionRestore the mission on evidence, not on hope — and prove it before you need it. Indicator: Every recovery objective has been demonstrated within its stated period.
  • M10 Exploitation & PursuitConvert contact into durable advantage rather than closing the ticket. Indicator: The same avenue of approach is never successfully used twice.
  • M7 CounterattackSeize the initiative and evict before the adversary reaches the objective. Indicator: Mean time to evict is inside the adversary’s dwell budget.

Entry and Exit Conditions

A phase is declared on an observable condition and ended on one. Declaring on a feeling produces a phase nobody can argue with and nobody can end.

Declare This Phase When

  • Mission services are inside their recovery objectives and the incident is closed operationally.
  • The response team still exists as a team. Phase V run three months later by different people recovers the facts and loses the judgment.

Leave This Phase When

  • The exploited avenue is closed and the closure is verified by a fresh reachability run, not by the change ticket.
  • The terrain overlay and the intelligence requirements are updated to reflect what was learned.
  • Indicators observed during the campaign have become detections with owners.
  • The rules of engagement have been revised, or a deliberate decision not to revise them is recorded.
  • The reconstitution exercise schedule is re-based on the objectives that were actually missed.
  • The defensive intent has been reconsidered in light of the campaign — and either revised or explicitly reaffirmed.

What Changes in Cadence and Authority

These are the two operational consequences of the declaration. A phase change that moves neither has changed a word on a slide.

Cadence
Returns to the standing cadence, with one exception: the first cycle after the campaign should run at the compressed cadence, because the volume of change moving through the overlay, the requirements and the rules of engagement is higher than a standing cycle is sized for.
Authority
Back to garrison levels — but the rules of engagement themselves are now the agenda item rather than the constraint. Every authority exception logged during Dominate is evidence about whether the standing set was the right width, and Phase V is the only moment at which that evidence is both fresh and unpressured.

How It Differs from the Phases Beside It

Against Stabilize

Stabilize returns the service to trustworthy operation. Restore returns the organization to a better position than it held before the campaign. One is measured in recovery objectives met; the other in avenues closed and doctrine changed.

Against Shape

Phase V looks like Shape and is not: it is scoped by a specific campaign and it terminates. Rolling straight into Shape without completing it is the mechanism by which an organization fights the same intrusion twice.

The Controls Most Active in This Phase

The Failure Mode Particular to This Phase

The phase that gets skipped once the pressure is off.

The tell
The cycle record shows a campaign and the defensive intent’s revision date does not move.
The correction
Put Phase V exit criteria on the incident closure checklist rather than on the improvement backlog. An incident is not closed when service is restored; it is closed when the avenue is shut and the doctrine has changed.

Caveats That Hold Across Every Phase

  • A phase is declared against a scope, not against an agency. An estate can be in Dominate on one mission service and Shape on everything else. The phase declaration control is written to carry a scope for exactly this reason, and a declaration without one is a statement nobody can act on.
  • Phases are not maturity. Being in Phase III is not progress. It means an adversary is on or adjacent to key terrain. A program that reads the phase list as a ladder will start reporting phase advancement as achievement, which inverts the meaning of the entire model.
  • Regression must be declarable without embarrassment. Campaigns go backwards. An eviction that turns out to be incomplete returns the campaign to Dominate from Stabilize. If declaring that costs someone their credibility, it will not be declared, and the campaign will be fought in the wrong phase.