Scheme of Maneuver
Choosing moves, assigning them to ground, honest implementation states, deception emplacement
The organization shall adopt a defined catalog of defensive moves expressed as intent and mechanism rather than as product names.
PurposeTo fix a shared vocabulary of defensive moves stated as intent, so the plan survives replacement of the tools that implement it.Activities9 · Metrics2Defensive moves shall be assigned to specific elements of terrain rather than declared at program level.
PurposeTo bind defensive intent to specific ground, so that coverage reflects what protects which element rather than what the program has bought.Activities10 · Metrics3Each assigned move shall carry an implementation state of planned, partial, or operational, and only operational moves shall count in full toward risk reduction.
PurposeTo make the coverage figure reflect what is defending the estate rather than what is intended to, by weighting mitigation by implementation state.Activities10 · Metrics2For each phase, the organization shall designate where defensive priority is concentrated.
PurposeTo concentrate defensive priority at a declared point, so that subordinate decisions follow from it without referral.Activities10 · Metrics2Pre-planned contingency maneuvers shall be defined for the most likely and most dangerous adversary courses of action.
PurposeTo decide contingency responses before contact, so that the decision loop under pressure is a selection rather than a design exercise.Activities10 · Metrics2The assumed effectiveness of each move shall be validated through exercise, testing, or observed incident performance, and adjusted where evidence contradicts assumption.
PurposeTo replace assumed effectiveness with demonstrated effectiveness, so the coverage figure reflects what controls do rather than what was assumed of them.Activities10 · Metrics2Deception shall be emplaced across designated terrain, and every interaction with a deception element shall raise an alert that reaches a human within a defined period.
PurposeTo obtain detection with no false-positive budget, and to ensure that signal is acted on rather than queued.Activities11 · Metrics4