ASOM-Fedv6.1Open the explorer
SM-3 · Scheme of Maneuver

Implementation State Tracking

Control Statement

Each assigned move shall carry an implementation state of planned, partial, or operational, and only operational moves shall count in full toward risk reduction.

Purpose. To make the coverage figure reflect what is defending the estate rather than what is intended to, by weighting mitigation by implementation state.

Discussion

This is the honesty control, and the entire posture computation rests on it. An adversary is not slowed by a planned maneuver, so a framework that counts one is producing a number about ambition rather than about defense. The control is also the framework's most fragile, because it can be defeated without any technical failure: if "operational" becomes the state recorded to avoid a finding, no assessment procedure downstream can recover. That is why the assessment tests production reality rather than the field.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Implementation state is recorded honestly.
  • Distribution of assignments across planned, partial and operational
  • Number of assignments recorded as operational that failed validation under SM-6

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

AOCTISOCHUNTPLATISSO
Authorizing Official / CISO: AccountableCyber Threat Intelligence cell: InformedSOC / Defensive Operations: ConsultedHunt team: InformedPlatform and product owners: ResponsibleGovernance / RMF / ISSO: Consulted

AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO

  • AccountableAuthorizing Official / CISO
  • InformedCyber Threat Intelligence cell
  • ConsultedSOC / Defensive Operations
  • InformedHunt team
  • ResponsiblePlatform and product owners
  • ConsultedGovernance / RMF / ISSO

Inputs and Outputs

Consumes

Produces

Activities

  1. L2Record an implementation state of planned, partial or operational against every assigned move.
  2. L2Weight mitigation by state so that planned and partial do not count in full.
  3. L2Report coverage separately at full weight and at state-weighted value.
  4. L3Define each state against an observable condition, so the distinction between partial and operational is testable rather than a matter of judgment. Record a fourth state, **constrained**, where a terrain constraint recorded under FO-4 makes the move genuinely unavailable, and exclude constrained assignments from the coverage denominator rather than carrying them indefinitely as planned.
  5. L3Require evidence for any transition to operational, rather than allowing the state to be self-declared.
  6. L3Sample states each cycle and test against production, prioritizing moves on decisive points.
  7. L3Record the date of each state transition, so the age of an operational claim is visible.
  8. L4Measure the false-operational rate found by sampling, and treat a rising rate as a governance finding rather than a data quality one.
  9. L4Trend the duration moves spend in planned and partial, since a move that has been planned for four cycles is not a plan.
  10. L5Automate state derivation from telemetry where the observable condition permits, replacing declaration with detection.

Measurement

Outcome

State-weighted effective coverage against full-weight coverage.

Performance

False-operational rate found by sampling.

Evidence and Assessment

Evidence expected

Implementation state per assignment with transition dates; effective coverage computation; sampling record.

Assessment procedure

Test a sample of moves recorded as operational to confirm they are in production and effective; examine the false-operational rate trend.

Related Guidance

Inherits
  • CA-5
  • PM-4
Satisfies
  • ID.IM-02

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.

Forms of Maneuver It Assesses

  • M3EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy.5 of 20 techniques — M3.06, M3.07, M3.08, M3.12, M3.14
  • M2Defense in DepthEnsure no single failure is decisive.2 of 18 techniques — M2.12, M2.14

Terrain It Is Named On

  • T2DevicesImplementation-state tracking is what distinguishes "EDR purchased" from "EDR enforcing", which on this layer is the whole distinction.

Artifacts It Stands On

  • producesScheme of maneuverOne graphic and one narrative: which forms of maneuver are sited where, in what sequence. The assignment record behind it carries the element, the avenue and the implementation state for every move.
  • producesChange recordEvery defensive action carried out, stamped twice — at the decision and at the effect. A thin, unglamorous table, and the one the headline metric is computed from.
  • producesImplementation state recordPlanned, partial or operational, per maneuver assignment. The mechanism that stops intended work being counted as deployed protection.

Roles It Puts to Work