Objective
Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
Joint meaning. Shape.
Discussion
Shape is the default. A program is in Phase 0 whenever it is not in contact and not recovering, which for a well-run federal estate is most of the time. Everything in it is preparation: terrain mapped and kept current, zero-trust hardening advanced, partnerships in place, threat intelligence flowing.
The distinguishing feature of Shape is that none of its work is meant to be visible to an adversary. That is what separates it from Deter, which is preparation performed where it can be seen. Confusing the two produces a program that advertises hardening it has not finished.
Shape is also where the framework itself gets built: the rules of engagement written, the pre-authorization set argued out, the recovery objectives declared, the reconstitution paths walked. All of it is cheap here and expensive in any other phase.
What the Main Effort Typically Is
Envelopment is the only form of maneuver that changes what a stolen credential is worth, and a stolen credential is the entry condition for most of the paths the other phases exist to fight. Making identity rather than network location the decisive plane is the single change that most reduces what a later phase has to deal with.
Typical, not prescribed. The main effort is designated per campaign against the decisive points the terrain analysis produced; what this phase does is narrow the field of sensible answers.
Dominant Forms of Maneuver
- M1 Screen / GuardGain early warning and buy reaction time before the adversary touches key terrain. Indicator: Threats are detected before they reach key terrain.
- M2 Defense in DepthEnsure no single failure is decisive. Indicator: An adversary must defeat three or more independent controls to reach data terrain.
- M3 EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy. Indicator: A stolen credential, on its own, yields no movement.
- M9 Spoiling AttackDisrupt adversary staging before the attack is launched. Indicator: A named campaign never reaches the avenue of approach.
Entry and Exit Conditions
A phase is declared on an observable condition and ended on one. Declaring on a feeling produces a phase nobody can argue with and nobody can end.
Declare This Phase When
- No confirmed adversary contact on a declared avenue of approach, and no open recovery.
- The previous campaign, if there was one, has completed its Phase V — the exploited avenue closed, the overlay and requirements updated. Returning to Shape before that is returning to a state that no longer exists.
Leave This Phase When
- Sector or partner reporting names a campaign targeting this kind of estate, and hardening becomes worth advertising — declare Deter.
- An indicator on the most-dangerous course of action fires — declare Seize Initiative, without passing through Deter. Deterrence has no role once contact is made.
What Changes in Cadence and Authority
These are the two operational consequences of the declaration. A phase change that moves neither has changed a word on a slide.
- Cadence
- The slowest cadence the campaign will run. Monthly is defensible and is where most programs start. Quarterly is where terrain currency begins to fail — the overlay ages past the rate at which a cloud estate changes, and every number derived from it ages with it.
- Authority
- The widest deliberation and the narrowest pre-authorization. Shape is where the rules of engagement are written, not where they are exercised. Actions are deliberate, reversible, and taken during change windows. Pre-authorization exists but should be small — a set widened in Phase 0 has been widened without the situation that would justify it.
How It Differs from the Phases Beside It
Against Deter
Nothing in Shape is meant to be seen by an adversary. Deter is the same preparation performed where it will be observed, plus a stated attribution posture. A program that has never declared Deter is not necessarily wrong; a program that treats Shape as if it deters is.
The Controls Most Active in This Phase
- TM-1 Terrain Inventory and OverlayThe overlay is built and kept current here, at the cadence that governs every downstream number.
- TM-6 Terrain CurrencyTerrain currency is a Phase 0 discipline; every other phase inherits its result.
- CG-3 Rules of EngagementThe rules of engagement are written in this phase, by people who are not under pressure.
- RC-1 Recovery ObjectivesRecovery objectives are declared while they can still be argued about on the merits.
- RC-5 Reconstitution ExerciseReconstitution is exercised here or it is improvised in Phase IV.
- CE-1 Cycle CadenceThe standing cadence is set, and it is the baseline every phase change adjusts from.
The Failure Mode Particular to This Phase
The phase a program never leaves and never declares.
- The tell
- The phase declaration control has never been exercised, so every incident is fought at Shape cadence and Shape authority.
- The correction
- Declare a phase, out loud, at every Frame — including declaring Shape. A phase that is never declared cannot be changed, and the cadence and authority that depend on it never move.
Caveats That Hold Across Every Phase
- A phase is declared against a scope, not against an agency. An estate can be in Dominate on one mission service and Shape on everything else. The phase declaration control is written to carry a scope for exactly this reason, and a declaration without one is a statement nobody can act on.
- Phases are not maturity. Being in Phase III is not progress. It means an adversary is on or adjacent to key terrain. A program that reads the phase list as a ladder will start reporting phase advancement as achievement, which inverts the meaning of the entire model.
- Regression must be declarable without embarrassment. Campaigns go backwards. An eviction that turns out to be incomplete returns the campaign to Dominate from Stabilize. If declaring that costs someone their credibility, it will not be declared, and the campaign will be fought in the wrong phase.