Control Statement
Each assigned move shall carry an implementation state of planned, partial, or operational, and only operational moves shall count in full toward risk reduction.
Purpose. To make the coverage figure reflect what is defending the estate rather than what is intended to, by weighting mitigation by implementation state.
Discussion
This is the honesty control, and the entire posture computation rests on it. An adversary is not slowed by a planned maneuver, so a framework that counts one is producing a number about ambition rather than about defense. The control is also the framework's most fragile, because it can be defeated without any technical failure: if "operational" becomes the state recorded to avoid a finding, no assessment procedure downstream can recover. That is why the assessment tests production reality rather than the field.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Distribution of assignments across planned, partial and operational
- Number of assignments recorded as operational that failed validation under SM-6
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Informed | SOC / Defensive Operations: Consulted | Hunt team: Informed | Platform and product owners: Responsible | Governance / RMF / ISSO: Consulted |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- InformedCyber Threat Intelligence cell
- ConsultedSOC / Defensive Operations
- InformedHunt team
- ResponsiblePlatform and product owners
- ConsultedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- SM-2 Maneuver AssignmentManeuver assignments requiring a state
Produces
- CE-4 Coverage and Residual Risk ComputationState weighting — only operational moves count in full toward risk reduction
- CE-5 Remediation Backlog PrioritizationPlanned and partial assignments forming remediation candidates
- SM-6 Maneuver Effectiveness ValidationMoves recorded as operational and therefore claiming full credit
Activities
- L2Record an implementation state of planned, partial or operational against every assigned move.
- L2Weight mitigation by state so that planned and partial do not count in full.
- L2Report coverage separately at full weight and at state-weighted value.
- L3Define each state against an observable condition, so the distinction between partial and operational is testable rather than a matter of judgment. Record a fourth state, **constrained**, where a terrain constraint recorded under FO-4 makes the move genuinely unavailable, and exclude constrained assignments from the coverage denominator rather than carrying them indefinitely as planned.
- L3Require evidence for any transition to operational, rather than allowing the state to be self-declared.
- L3Sample states each cycle and test against production, prioritizing moves on decisive points.
- L3Record the date of each state transition, so the age of an operational claim is visible.
- L4Measure the false-operational rate found by sampling, and treat a rising rate as a governance finding rather than a data quality one.
- L4Trend the duration moves spend in planned and partial, since a move that has been planned for four cycles is not a plan.
- L5Automate state derivation from telemetry where the observable condition permits, replacing declaration with detection.
Measurement
State-weighted effective coverage against full-weight coverage.
False-operational rate found by sampling.
Evidence and Assessment
Implementation state per assignment with transition dates; effective coverage computation; sampling record.
Test a sample of moves recorded as operational to confirm they are in production and effective; examine the false-operational rate trend.
Related Guidance
- CA-5
- PM-4
- ID.IM-02
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M3EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy.5 of 20 techniques — M3.06, M3.07, M3.08, M3.12, M3.14
- M2Defense in DepthEnsure no single failure is decisive.2 of 18 techniques — M2.12, M2.14
Terrain It Is Named On
- T2DevicesImplementation-state tracking is what distinguishes "EDR purchased" from "EDR enforcing", which on this layer is the whole distinction.
Artifacts It Stands On
- producesScheme of maneuverOne graphic and one narrative: which forms of maneuver are sited where, in what sequence. The assignment record behind it carries the element, the avenue and the implementation state for every move.
- producesChange recordEvery defensive action carried out, stamped twice — at the decision and at the effect. A thin, unglamorous table, and the one the headline metric is computed from.
- producesImplementation state recordPlanned, partial or operational, per maneuver assignment. The mechanism that stops intended work being counted as deployed protection.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsiblePlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- ConsultedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- ConsultedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.
- InformedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- InformedHunt teamCounterattack. Works the hypotheses that Fuse raises.