Eighteen Months, Three Phases, and One of Them Needs No Money at All.

CG-2 Phase Declaration — Declared first, because cadence and authority both resolve against it. For nearly every adopter the first declaration is Phase 0, Shape — and saying so out loud is the point. A phase that is never declared can never be changed.

CG-1 Defensive Intent — One paragraph, signed. It has to name something that may be degraded; a paragraph that only protects has designated nothing, and the main effort control downstream then has nothing to consume.

CG-3 Rules of Engagement — Split by reversibility rather than by severity. The first version will be narrow; writing down how narrow is more useful than widening it before anyone has operated inside it.

CG-5 Control Inheritance Mapping — Inherit the assessments you already hold. Programs that re-test what 800-53 has already tested, out of caution, are the ones that conclude this framework is expensive.

FO-7 Obligation Profile Declaration — Declared before FO-5, because it is what makes FO-5 answerable: until the obligation profile names which instruments bind this agency, "statutory availability floor" has no denominator and the FO coverage figure means nothing. An hour of legal review, and every later FO number becomes comparable.

FO-5 Statutory Availability Floor — Traced to the instrument that creates the obligation, not to a service-level target somebody wrote into a contract. It bounds what the intent may offer up, so it has to land before the intent is signed rather than after.

FO-1 Privacy Terrain Identification — Which elements hold personally identifiable information. Asset weighting is dishonest without it, which is why it lands alongside TM-3 rather than in the federal-obligations sweep later.

CE-1 Cycle Cadence — A cadence and a close date on a calendar other people can see. Monthly is the honest starting point and the one most adopters should not beat.

CE-2 Priority Intelligence Requirements — Between three and seven requirements, each naming the decision it informs and carrying a named owner inside the cell. Twenty requirements is a wish list — a cycle closes a handful and the rest become permanent.

CE-3 Fusion and Confidence — The first fusion will be thin. Publishing a moderate or low confidence in cycle 1 is what sets the norm that makes the confidence field mean anything in cycle 12.

CE-6 Cycle Record and Trend — Opened in cycle 1 with a single row. Its entire value is in the series, and a record started in month nine has already lost the baseline it exists to establish.

CE-7 Brief Generation and Distribution — Cycle 1’s brief is short, and it should name what the cycle could not answer. A brief with no unanswered requirement in it means the requirements were written to be answerable.

TM-1 Terrain Inventory and Overlay — The highest-leverage control in the framework: 18 of the 78 name its output as a declared input, 1.5× the next. Scoped in Phase A to one mission service, deliberately.

TM-2 Defensive Layer Classification — Every element carries a defensive layer. An unlayered element cannot be counted, weighted, or covered — it is simply absent from every number the framework later produces.

TM-3 Asset Weighting — Criticality and exposure per element, set by the mission owner rather than by the security function. Weighting is the step at which an overlay stops being an inventory.

TM-7 Terrain Ownership — A named individual per element. A mailbox is not an owner, and a first overlay full of them is the most common way Phase A finishes looking complete while owning nothing.

TM-6 Terrain Currency — A refresh interval with an owner. The failure this prevents is silent by construction — a stale overlay produces confident decisions about ground that has moved.

TM-4 Trust Zone Definition — A trust zone is defined by the control that enforces it. Zones that exist only on a diagram get recorded as findings in Phase A, not as zones. That distinction is most of the value of doing this early.

TM-5 Connection and Denied-Path Register — Connections, and the paths deliberately blocked, each with the control that blocks it. This is the graph Phase B’s avenue and reachability analysis runs over; building it later means rebuilding it.

KT-1 Decisive Point Identification — Short enough to argue about. Phase A names what must not fall; the protection floor that goes with it is Phase B work. Naming and defending are different activities and conflating them stalls both.

RC-1 Recovery Objectives — Recovery time and recovery point per mission service, declared by the service owner. Cheap to argue about now, impossible to argue about during a recovery, and a precondition for the rebuild work in Phase B.

SM-1 Maneuver Catalog Adoption — Adopt the forms you will actually site, not all eleven. An adopted form with no assignment behind it is vocabulary, and vocabulary is the failure mode this whole phase exists to escape.

SM-2 Maneuver Assignment — Moves sited on named elements of the overlay. An assignment written against a product rather than against ground scores nothing, and expires the day the product is replaced.

SM-3 Implementation State Tracking — Operational, not purchased. This is the single control that decides whether the coverage figure computed downstream is a measurement or a fiction.

SM-4 Main Effort Designation — One designation. Naming a main effort is a decision to under-resource everything else, and that consequence is what makes it a decision rather than an announcement.

SM-5 Branches and Sequels — Pre-planned responses to the threat courses of action. The branch nobody planned is the branch that gets improvised under contact, at the worst possible tempo.

SM-7 Deception Emplacement — Deception emplaced on the approaches to decisive points. It belongs with the other scheme controls because it is a placement decision, and it is the one detection in the framework with no false-positive budget — so the response path matters as much as the emplacement.

KT-3 Avenue of Approach Analysis — A graph problem over the connection register built in Phase A. This is the first control that pays the terrain work back, and the first place a thin Phase A shows up as an unanswerable question.

KT-4 Adversary Reachability Assessment — Recorded whichever way it comes out. Publish only the comfortable answers and the number survives while the trend behind it quietly stops meaning anything.

KT-2 Decisive Point Protection Floor — The minimum protection each decisive point carries, and the breach of that floor as a finding. Phase A named the points; this is where they acquire a defense.

KT-5 Barrier Sufficiency — For each load-bearing barrier, the question is how you would know it had changed. An unmonitored barrier fails silently and every reachability answer that depended on it moves with it.

ID-1 Identity Plane Definition — The identity plane drawn as ground rather than assumed as a service. It sits at the head of Phase B because ID-2 through ID-5, both device gates and KT-4 reachability all name its output as an input — the same position TM-1 holds in Phase A.

ID-2 Credential Strength and Binding — Credential strength matched to the access behind it. The finding that motivates it is usually the non-human secret inventory, which most adopters have never assembled and which is where the long-lived credentials turn out to be.

ID-3 Authentication Assurance — Assurance that varies with the terrain being reached. The exit test is concrete: take a captured credential to decisive-point terrain and confirm it is not enough on its own.

ID-4 Identity Assertion Protection — Assertion lifetimes and revocation. Measured, not configured — the number that matters is how long estate-wide revocation actually takes when it is tried, and it is always longer than the documentation says.

ID-5 Authorization Decision Integrity — Every access path consulting the decision point, and policy changes leaving a trace. This is the control that converts identity from a login into an enforcement plane.

DV-1 Device Terrain Identification — Devices discovered from the identity plane outward. The console can only report what it already manages, so the unmanaged population is by definition invisible to it — and that population is the finding.

DV-2 Device Posture as an Access Precondition — Posture as a precondition of access. This closes the gap M3 Envelopment leaves when identity is enforced alone: a valid credential on a compromised device still spends.

DV-3 Endpoint Sensor Coverage and Liveness — Sensor coverage reconciled to the device inventory, and silent sensors detected as events. Placed here rather than in Phase C because EN-1 and EN-2 in the next phase cannot run on telemetry that was never collected.

DV-4 Execution Control — Execution control on the ground the adversary crosses into — the cheapest point at which most engagements stop. Scoped to designated terrain first; estate-wide allow-listing is a Phase C ambition at best.

DV-5 Device Lifecycle and Sanitization — Both ends of the device lifecycle. The metric that moves is the count of devices holding estate trust with no current holder, which is never zero on first measurement.

TA-4 Pre-authorized Response — The orchestration wiring is the procurement item of this roadmap. No fire enters the pre-authorized set without a named reverse action, an owner and a time bound — because it will execute with no human present.

TA-1 Decision Loop Measurement — Three timestamps, all taken by the party they judge. Sample the raw incident records behind them, or the figure measures how the SOC reports rather than how fast it decides.

CE-4 Coverage and Residual Risk Computation — The first honest coverage figure lands here and it will be low. It is a model to argue with, and the argument — not the percentage — is the deliverable.

CE-5 Remediation Backlog Prioritization — Ranked against residual risk, not against severity labels inherited from a scanner. A backlog ordered by someone else’s CVSS is not a defensive priority.

CG-4 Findings Disposition — Three dispositions: remediated, accepted with a signature, transferred. A finding left to age has not reached a fourth outcome — it has reached none.

RC-2 Isolated Recovery Capability — A recovery path that does not share a failure domain with the thing it recovers. Most estates discover they do not have one at the moment they need it.

RC-3 Trusted Rebuild Path — Walked, not documented. The objectives declared in Phase A become testable here, and the first walk usually falsifies at least one of them.

FO-2 Controlled Unclassified Information Handling — Controlled unclassified information located on the overlay, with its handling constraint attached to the element rather than to a policy document.

FO-3 Tenancy and Inheritance Boundary — Where the agency’s responsibility begins inside a shared service. Getting this boundary wrong produces a coverage figure that quietly counts somebody else’s controls as your own.

WF-1 Workforce Terrain Identification — People as terrain, identified the same way systems were: enumerated, weighted, owned. The workforce family exists because the five zero-trust pillars do not cover it.

WF-2 Privileged Human Register — Who actually holds privilege, as opposed to who is entitled to it. The register is almost always longer than the entitlement list, and the difference is the finding.

WF-4 Insider Risk Position — A stated position, including a deliberate decision not to run a program. Silence here reads to an assessor as absence, which is a worse answer than a bounded one.

WF-5 Separation and Revocation Tempo — Measured in hours from the human-resources event. It is the one workforce number that shows up unaltered in a real incident timeline.

TA-2 Adversary Dwell Estimation — An estimate with a stated basis and a confidence level. It is the budget an eviction is racing, and a program that cannot state it is measuring only half of temporal advantage.

TA-3 Temporal Advantage Threshold — A number with units, set before the data arrives. This is the one Frame exit criterion Phase A knowingly cannot meet, and back-filling it later is how a program discovers it was always meeting its target.

TA-5 Tempo Degradation Trigger — What gives way when the loop stops closing — cadence, scope, or authority. Deciding which, in advance, is the difference between a degraded program and a collapsed one.

SM-6 Maneuver Effectiveness Validation — Executed tradecraft against the maneuver that claims to stop it. Its entire value is its capacity to come back negative, which is why the reporting line matters more than the tooling.

EN-1 Event Declaration and Triage — Declaration criteria and a triage clock. Phase C because the decide segment can only be targeted once TA-1 has measured it and DV-3 has established that the telemetry exists.

EN-2 Engagement Reconstruction — Reconstruction before closure. The discipline this imposes is uncomfortable and it is the point: an incident closed without a reconstruction has taught the agency nothing and corrected no estimate.

EN-3 Evidence Preservation — Evidence preserved against the dwell estimate rather than against a retention default. Where those two disagree — and they usually do — the dwell estimate wins.

EN-4 Escalation and Engagement Authority — Named authorities, verified reachable out of hours. The cheapest control in the family and the one that most often turns out to be untrue when tested.

EN-5 Eradication and Transition to Recovery — Eradication verified before recovery begins. Recurrence through a previously used avenue is the metric, and it is the one an Authorizing Official will actually ask about.

EN-6 Engagement Communication — Communication inside the agency, to the federal community, and to those the mission serves — each against the window that binds it, which FO-7 is what determines.

RC-4 Recovery Integrity Verification — Verified against an independently held integrity record. If that record shares a failure domain with what it verifies, the verification is decorative.

RC-5 Reconstitution Exercise — Run against the objectives declared in Phase A, on the rebuild path built in Phase B, with the vendor out of the room. It is the exercise that tells you which of the three was optimistic.

WF-3 Role-Based Readiness — Readiness per role rather than training hours per person. It feeds the tempo degradation trigger, which is why it lands in the same phase as it.

FO-4 Operational Technology Terrain — Operational technology as terrain in its own right. Agencies with dispersed sites usually find this is the largest unmapped surface they own.

FO-6 Supply Chain Obligation — Supply chain as terrain, which is the entry condition for the whole lines-of-communication family beneath it.

FC-1 Facility Terrain Identification — Facilities enumerated the way systems were. The overlay has been logical up to this point; this is where it acquires a physical dimension.

FC-2 Physical Zone Boundary — Physical zone boundaries, expressed the same way trust zones were — by the control that enforces them.

FC-3 Maintenance Access Control — Maintenance access is the path most often left out of an avenue-of-approach analysis, because it belongs to somebody who does not attend security meetings.

FC-4 Environmental Continuity — Environmental endurance becomes a live constraint the first time a recovery runs long, which is exactly when nobody has time to establish it.

LC-1 Supplier Terrain Register — The supplier register, and the entry point for the four controls beneath it. Everything in this family fails if the register is a procurement extract rather than an access-truth statement.

LC-2 Component Provenance — Provenance for the components that reach production. It is slow because it depends on other people’s disclosure, not because it is technically hard.

LC-3 Supplier Access Constraint — Supplier access constrained to the terrain the supplier actually needs. The constraint is usually available and simply never applied.

LC-4 Update Integrity and Staging — Update integrity and staging — the control that stands between a trusted supplier and an untrusted change arriving under its name.

LC-5 Supplier Severance Capability — Severance demonstrated rather than contracted. The demonstration has a commercial consequence, which is why it needs the Authorizing Official rather than the ISSO.