ASOM-Fedv6.1Open the explorer
TA-3 · Tempo and Temporal Advantage

Temporal Advantage Threshold

Control Statement

The organization shall define the minimum acceptable ratio of adversary dwell to defender decision loop, and shall treat a deficit as a reportable condition.

Purpose. To convert the temporal advantage figure into a governed condition with an escalation consequence, so that being behind is a decision the organization has to make rather than a number it can note.

Discussion

The sequencing requirement is what makes this control real. A threshold set after the first measurement will be set wherever the organization already passes, which produces a governed-looking metric that has never once reported a problem. Approving the threshold before the figure is known — or at minimum recording that it was approved after, and by whom — is the difference between a risk appetite and a post-hoc justification.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

A threshold is declared and compared against every cycle.
  • The declared minimum ratio of adversary dwell to defender loop
  • Number of cycles in deficit against the threshold
Deficits are escalated, not absorbed.
  • Mean time from a recorded deficit to a documented decision by the accountable authority

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

AOCTISOCHUNTPLATISSO
Authorizing Official / CISO: AccountableCyber Threat Intelligence cell: ConsultedSOC / Defensive Operations: ConsultedHunt team: InformedPlatform and product owners: InformedGovernance / RMF / ISSO: Responsible

AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO

  • AccountableAuthorizing Official / CISO
  • ConsultedCyber Threat Intelligence cell
  • ConsultedSOC / Defensive Operations
  • InformedHunt team
  • InformedPlatform and product owners
  • ResponsibleGovernance / RMF / ISSO

Inputs and Outputs

Consumes

Produces

Activities

  1. L2Define the minimum acceptable ratio of adversary dwell to defender loop.
  2. L2Compare the measured result to the threshold each cycle.
  3. L2Report the result as advantage or deficit.
  4. L3Obtain the accountable authority's approval of the threshold, recording the date of approval relative to the date of first measurement.
  5. L3Define the escalation path a deficit triggers, including who is informed and within what period.
  6. L3Carry the confidence level from TA-2 into the reported result, so a deficit at low confidence is distinguishable from one at high confidence.
  7. L3Re-approve the threshold on material change to the mission or threat picture, rather than treating it as permanent.
  8. L4Trend the result against the threshold across cycles and measure the duration of any sustained deficit.
  9. L4Test the escalation path on a recorded deficit rather than assuming it fires.
  10. L5Re-base the threshold against demonstrated containment outcomes — whether incidents at a given ratio were in fact contained before loss.

Measurement

Outcome

Measured ratio against approved threshold, with confidence.

Performance

Elapsed time from recorded deficit to escalation.

Evidence and Assessment

Evidence expected

Declared threshold with approval date; scoreboard result per cycle; escalation records.

Assessment procedure

Examine the threshold and its approval; test the escalation path on a recorded deficit; examine whether the threshold was approved before or after the first measurement.

Related Guidance

Inherits
  • IR-4
  • PM-6
Satisfies
  • GV.RM-02
  • GV.OV-03

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.

Forms of Maneuver It Assesses

  • M7CounterattackSeize the initiative and evict before the adversary reaches the objective.1 of 17 techniques — M7.11

Terrain It Is Named On

  • TXCross-CuttingThe temporal advantage threshold states what the loop has to beat, without which the measurement has no verdict.

Artifacts It Stands On

  • producesTemporal advantage thresholdThe number the cycle will be judged against: defender decision loop versus adversary dwell, stated with units before the cycle runs.
  • producesTemporal advantage resultDefender decision loop against adversary dwell, reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met. The framework’s single honest scoreboard.
  • consumesDefensive intent paragraphOne signed paragraph stating what the defense exists to protect, what may be degraded to protect it, and the acceptable risk. The commander’s-intent analog, and the citation every downstream designation rests on.
  • consumesDefender decision loop measurementDetect to decide to contain, measured per incident from the change record’s timestamps and reported as a distribution rather than as a mean.
  • consumesAdversary dwell estimateThe estimated time an adversary could operate undetected in this estate, with its basis stated — measured dwell, sector reporting, or partner intelligence — and its bias acknowledged.

Roles It Puts to Work