Control Statement
For each phase, the organization shall designate where defensive priority is concentrated.
Purpose. To concentrate defensive priority at a declared point, so that subordinate decisions follow from it without referral.
Discussion
Main effort is the concept a control catalog structurally cannot hold, because a catalog has no way to say that one requirement matters more this quarter. The designation is only real if resourcing moved: a main effort that changed no budget line, no staffing allocation and no queue priority is a label applied after the fact. The assessment procedure therefore examines resourcing rather than the declaration.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Number of designated main efforts per phase — more than one is a failure of the control
- Proportion of new defensive resourcing directed at the main effort
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Consulted | SOC / Defensive Operations: Consulted | Hunt team: Informed | Platform and product owners: Informed | Governance / RMF / ISSO: Consulted |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- ConsultedCyber Threat Intelligence cell
- ConsultedSOC / Defensive Operations
- InformedHunt team
- InformedPlatform and product owners
- ConsultedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- CG-2 Phase DeclarationDeclared campaign phase
- KT-1 Decisive Point IdentificationDecisive points as main-effort candidates
- CG-1 Defensive IntentDefensive intent identifying what must be protected
Produces
- CE-5 Remediation Backlog PrioritizationPrioritization weighting applied to the remediation backlog
- CE-7 Brief Generation and DistributionMain effort stated in the cycle brief
Activities
- L2Declare the current campaign phase.
- L2Designate where defensive priority is concentrated for that phase.
- L2Record the designation in the Brief.
- L3Derive the designation from the phase's dominant forms and from current threat courses of action, rather than from standing organizational preference.
- L3State what is being accepted as lower priority, since a main effort that subordinates nothing is not a main effort.
- L3Align resourcing — budget, staffing, queue priority — to the designation, and record the specific allocations that moved.
- L3Re-designate on phase transition and on material change in the threat picture.
- L4Measure the proportion of defensive effort actually expended on the designated main effort, and compare it against the designation.
- L4Trend the interval between phase transition and resourcing realignment.
- L5Review past designations against engagement outcomes, and adjust the derivation where the main effort was repeatedly designated away from where contact occurred.
Measurement
Proportion of defensive effort expended on the designated main effort.
Elapsed time from phase transition to resourcing realignment.
Evidence and Assessment
Phase declaration and main-effort statement in the Brief; subordination record; resourcing allocation record.
Examine the designation; interview on how resourcing followed it; test that at least one allocation demonstrably moved.
Related Guidance
- PM-11
- RA-2
- GV.RM-01
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M7CounterattackSeize the initiative and evict before the adversary reaches the objective.1 of 17 techniques — M7.04
Terrain It Is Named On
No layer names this control for a reason of its own, and it is not part of the common spine. It acts on the framework rather than on any particular ground.
Artifacts It Stands On
- producesMain effort designationThe single designated main effort for the cycle, and the sentence citing the decisive point that justifies it. The answer to which work wins when two things need the same engineer.
- consumesDefensive intent paragraphOne signed paragraph stating what the defense exists to protect, what may be degraded to protect it, and the acceptable risk. The commander’s-intent analog, and the citation every downstream designation rests on.
- consumesPhase declarationThe declared campaign phase and the scope it is declared against. Sets cadence, dominant forms of maneuver, and how wide the pre-authorization set runs.
- consumesDecisive point registerThe elements whose control confers decisive advantage — each carrying the evidence that raised it above merely important, and the protection floor it owes as a result.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ConsultedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- ConsultedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- ConsultedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.
- InformedHunt teamCounterattack. Works the hypotheses that Fuse raises.
- InformedPlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.