Tempo and Temporal Advantage
Making speed of decision measurable, governed and pre-authorized
TA-1
Decision Loop MeasurementAccountable: Authorizing Official / CISO
The organization shall measure the elapsed time from detection through decision to containment, and shall record it each cycle.
PurposeTo make the defender's tempo a measured quantity rather than an impression, so that the numerator of temporal advantage exists at all.Activities10 · Metrics3TA-2
Adversary Dwell EstimationAccountable: Authorizing Official / CISO
The organization shall maintain a documented estimate of adversary dwell time relevant to its threat profile, with a stated basis.
PurposeTo establish the denominator of temporal advantage with an explicit, challengeable basis, so the comparison the framework rests on can be argued with.Activities10 · Metrics2TA-3
Temporal Advantage ThresholdAccountable: Authorizing Official / CISO
The organization shall define the minimum acceptable ratio of adversary dwell to defender decision loop, and shall treat a deficit as a reportable condition.
PurposeTo convert the temporal advantage figure into a governed condition with an escalation consequence, so that being behind is a decision the organization has to make rather than a number it can note.Activities10 · Metrics3TA-4
Pre-authorized ResponseAccountable: Authorizing Official / CISO
Defensive actions that may be executed without escalation shall be defined in advance and approved by the accountable authority.
PurposeTo remove authority latency from the decision loop, so that the segment most programs cannot shorten with tooling is shortened by governance.Activities10 · Metrics2TA-5
Tempo Degradation TriggerAccountable: Authorizing Official / CISO
Conditions under which the defender decision loop is expected to degrade shall be identified, with compensating measures defined.
PurposeTo plan for the periods in which tempo predictably falls, so that the measured advantage is not a statement about the organization's best hours only.Activities10 · Metrics2