Control Statement
The organization shall measure the elapsed time from detection through decision to containment, and shall record it each cycle.
Purpose. To make the defender's tempo a measured quantity rather than an impression, so that the numerator of temporal advantage exists at all.
Discussion
The loop has three segments and they fail differently. Detection latency is a tooling and coverage problem; decision latency is an authority problem; containment latency is an execution problem. Reporting only the total hides which one is binding, and in most programs the binding constraint is the middle segment — which no amount of detection investment will shorten. Measuring the segments separately is what makes the metric actionable rather than merely honest.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Mean and worst-case elapsed time from detection to decision to containment
- Number of cycles with a recorded measurement
- Elapsed time in each segment — detect, decide, contain — so the slowest segment is identifiable
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Consulted | SOC / Defensive Operations: Responsible | Hunt team: Consulted | Platform and product owners: Informed | Governance / RMF / ISSO: Informed |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- ConsultedCyber Threat Intelligence cell
- ResponsibleSOC / Defensive Operations
- ConsultedHunt team
- InformedPlatform and product owners
- InformedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- Outside the frameworkIncident and alert timestamps from case management and response tooling
- CE-1 Cycle CadenceCycle cadence establishing the reporting period
- SM-7 Deception EmplacementDetection events contributing to the detect segment
- TA-4 Pre-authorized ResponseReduced decision segment in the measured loop
- ID-4 Identity Assertion ProtectionRevocation time as the containment segment of the decision loop
- EN-1 Event Declaration and TriageMeasured decide segment of the decision loop
- EN-4 Escalation and Engagement AuthorityAuthority response time within the decide segment
- DV-3 Endpoint Sensor Coverage and LivenessCoverage as the detect segment of the decision loop
Produces
- TA-3 Temporal Advantage ThresholdDefender loop time, the denominator of the temporal advantage ratio
- CE-6 Cycle Record and TrendLoop time recorded for trend across cycles
- TA-5 Tempo Degradation TriggerBaseline against which degradation is detected
- SM-7 Deception EmplacementDecide-segment measurement the response target is set against
- EN-1 Event Declaration and TriageDecide-segment target the triage period is set against
Activities
- L2Record, for each incident, the timestamps of detection, decision and containment.
- L2Compute elapsed time across the full loop and record it for the cycle.
- L2Report the cycle figure into the Brief.
- L3Define each timestamp against an observable event, so "decision" means a recorded authorization rather than the moment someone formed a view.
- L3Measure and report the three segments separately — detect, decide, contain — so the binding constraint is visible. The decide segment is constituted by
EN-1triage andEN-4escalation; attribute time between them, since a slow triage and an unreachable authority are different problems. - L3Derive the cycle figure from a stated statistic (median, or a named percentile) rather than from a mean, which a single outlier distorts.
- L3Exclude no incident from the population without a recorded justification.
- L4Trend each segment independently across cycles and set a threshold on the segment that is binding rather than on the total.
- L4Measure the spread as well as the central figure; a stable median with a widening tail is a degrading capability that the median conceals.
- L5Attribute segment improvement to the specific change that produced it, so tempo investment is directed by evidence rather than by assumption.
Measurement
Median detect-to-contain elapsed time for the cycle.
Percentage of incidents with all three timestamps recorded.
Evidence and Assessment
Temporal advantage assessment; supporting incident timing records; segment breakdown.
Examine the derivation from incident data; test against a sample of recorded incidents; examine whether timestamp definitions have changed between cycles being compared.
Related Guidance
- IR-4
- SI-4
- AU-6
- DE.AE-06
- RS.MA-01
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Fed By
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M1Screen / GuardGain early warning and buy reaction time before the adversary touches key terrain.2 of 15 techniques — M1.05, M1.08
- M5AmbushTrade space for information and time, and impose cost.2 of 13 techniques — M5.02, M5.05
- M3EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy.1 of 20 techniques — M3.11
- M6DelayBuy decision time and prevent the adversary culminating on the objective.1 of 10 techniques — M6.06
- M7CounterattackSeize the initiative and evict before the adversary reaches the objective.1 of 17 techniques — M7.04
- M8Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open.1 of 17 techniques — M8.14
Terrain It Is Named On
- T2DevicesEndpoint detection time is usually the first term in the decision loop measurement, so this layer sets the tempo the rest of the loop inherits.
- TXCross-CuttingDecision loop measurement is the mobility enabler’s primary metric.
Artifacts It Stands On
- producesDefender decision loop measurementDetect to decide to contain, measured per incident from the change record’s timestamps and reported as a distribution rather than as a mean.
- producesTemporal advantage resultDefender decision loop against adversary dwell, reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met. The framework’s single honest scoreboard.
- consumesCycle cadence and calendarThe declared length of a cycle, its close date, and the refresh intervals that inherit from it. Makes “per cycle” a measurable unit rather than a figure of speech.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsibleSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- ConsultedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- ConsultedHunt teamCounterattack. Works the hypotheses that Fuse raises.
- InformedPlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- InformedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.