Control Statement
The organization shall maintain a documented estimate of adversary dwell time relevant to its threat profile, with a stated basis.
Purpose. To establish the denominator of temporal advantage with an explicit, challengeable basis, so the comparison the framework rests on can be argued with.
Discussion
This is the framework's most epistemically exposed control, and it should be stated plainly rather than buried. An agency can measure its own decision loop directly; it almost never measures adversary dwell against itself, because dwell is observable only in the intrusions that were eventually found — which is a biased sample by construction, and biased toward the slow adversaries. The estimate is therefore imported from external reporting and adjusted, and the signature metric consequently rests half on measurement and half on a cited assumption. The *stated basis* requirement exists so that this is visible to anyone reading the result rather than concealed inside a ratio.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Age of the dwell estimate and the date of its last revision
- Whether the basis is recorded — sector reporting, incident history, or intelligence assessment
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Responsible | SOC / Defensive Operations: Informed | Hunt team: Consulted | Platform and product owners: Informed | Governance / RMF / ISSO: Informed |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- ResponsibleCyber Threat Intelligence cell
- InformedSOC / Defensive Operations
- ConsultedHunt team
- InformedPlatform and product owners
- InformedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- Outside the frameworkSector threat reporting, incident history, partner and government intelligence
- CE-3 Fusion and ConfidenceConfidence discipline applied to the estimate
- EN-2 Engagement ReconstructionObserved dwell, correcting the estimate
Produces
- TA-3 Temporal Advantage ThresholdDwell estimate, the numerator of the temporal advantage ratio
- CE-7 Brief Generation and DistributionStated basis reported alongside the posture result
- EN-3 Evidence PreservationDwell estimate that sets the retention floor
- DV-3 Endpoint Sensor Coverage and LivenessDwell estimate that sets how long telemetry must survive
Activities
- L2Record a dwell time estimate applicable to the agency's threat profile.
- L2Record the source of the estimate.
- L2Carry the estimate into the temporal advantage computation.
- L3Select sources matched to the agency's sector, size and adversary set rather than adopting a global industry median.
- L3State the known bias in the estimate explicitly — that dwell is observed only in discovered intrusions — so the figure is read as a bound rather than a fact.
- L3Adjust the imported figure against any locally observed dwell from the agency's own incidents, and record the adjustment.
- L3Review the estimate each cycle and on material change to the threat assessment.
- L4Record a confidence level against the estimate, consistent with CE-3, and carry that confidence through to the temporal advantage result.
- L4Track divergence between the imported estimate and locally observed dwell as evidence about which is wrong.
- L5Build a local dwell series from the reconstructions required by
EN-2, and transition the estimate from imported to measured as the series matures.
Measurement
Currency of the dwell estimate in cycles since last review.
Divergence between imported estimate and locally observed dwell.
Evidence and Assessment
Dwell estimate with cited basis, stated bias and confidence level.
Examine the source; interview the intelligence function on its applicability; test whether the estimate has been adjusted against local observation where local observation exists.
Related Guidance
- RA-3
- PM-16
- ID.RA-02
- ID.RA-03
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M7CounterattackSeize the initiative and evict before the adversary reaches the objective.1 of 17 techniques — M7.12
Terrain It Is Named On
No layer names this control for a reason of its own, and it is not part of the common spine. It acts on the framework rather than on any particular ground.
Artifacts It Stands On
- producesAdversary dwell estimateThe estimated time an adversary could operate undetected in this estate, with its basis stated — measured dwell, sector reporting, or partner intelligence — and its bias acknowledged.
- producesTemporal advantage resultDefender decision loop against adversary dwell, reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met. The framework’s single honest scoreboard.
- consumesFused assessmentWhat the cycle’s intelligence requirements returned: each answer graded for confidence and showing its working, and each requirement left unanswered recorded against the collection gap responsible.
- consumesCyber Running EstimateThe living situational picture the SOC, hunt and intelligence cell share: current posture, current assessments and their confidence, open requirements, and what has moved since the last look.
- consumesIndicators and signpostsFor each surviving hypothesis, the observable events that would confirm or kill it, handed to collection. The mechanism that makes this cycle’s analysis into next cycle’s requirements.
- consumesHunt results, including negative resultsWhat was hunted, how, and what was not found. Negative results are the half most often discarded, and they are the half that says what has actually been cleared.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsibleCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- ConsultedHunt teamCounterattack. Works the hypotheses that Fuse raises.
- InformedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- InformedPlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- InformedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.