The Ground
The high ground.
High ground is not valuable because it is tall. It is valuable because holding it lets you see and engage the whole of the ground below, while an opponent who wants it has to climb toward you under observation. Identity has exactly that property in a zero-trust estate: every access decision on every other layer is resolved by asking the identity plane a question, so whoever controls the answer controls movement everywhere.
The doctrinal consequence is not that identity is important — everything is important — it is that identity is where defensive mass belongs by default. A scheme of maneuver that designates something else as its main effort is making a deliberate claim that this estate is unusual, and should say why. In the Federal Reference Agency profile it almost never is: the adversary’s plan runs through a credential.
The inverse is the reason this layer is scored so severely. An identity plane that is compromised does not degrade the defense proportionally; it inverts it, because the controls on every layer below are now being operated by the adversary with the defender’s own authority.
A CISA Zero Trust Maturity Model pillar, carried with its name and boundary unchanged so an agency reporting maturity under OMB M-22-09 reports the same rung here.
- Identity assets — ICAM and identity provider, PKI and PIV, privileged accounts, service and workload identities, external-user and mission-staff identities
Key Terrain
Key terrain is what confers decisive advantage if you hold it. Everything else on this layer is defended in order to hold these.
- The ICAM policy decision pointEvery authorization on the estate resolves here. It is the one component whose failure is simultaneously a failure of five layers.
- Privileged accountsThe small set of identities that can change the rules rather than operate within them — including the accounts that administer the identity plane itself.
- External-user identitiesThe public-facing account population is the largest identity surface the agency runs and the one it controls least, because the credential lives on a citizen’s device.
- Mission-staff identitiesThe accounts that can reach non-public records in volume. No single one of them looks privileged; together they are the route to the crown jewels.
- Non-person entitiesService accounts, workload identities and pipeline credentials. Routinely over-permissioned, rarely recertified, and invisible to a joiner-mover-leaver process built for humans.
The Decisive Point
The conditional-access policy engine
The decisive point is the conditional-access policy engine, not the directory. The directory holds who exists; the policy engine decides what existing entitles you to, and it does so at the moment of access, which is where the adversary is standing.
Seizing it unhinges the plan in both directions. An adversary who can influence policy no longer needs to defeat any individual control — they can simply be authorized past it. A defender who genuinely holds it can make a stolen credential worthless without touching the application it was stolen to reach, which is the entire premise of envelopment (M3).
This is also why the policy engine, not the number of MFA licenses, is what a decisive-point protection floor (KT-2) should be written against.
Sub-Towers, Rung by Rung
Maturity is scored here, not on the layer. Each rung below is stated for this sub-tower specifically — “Advanced” means something testable on each one, and something different on each one. The rung marked current is the illustrative position on the Federal Reference Agency profile.
Authentication (phishing-resistant MFA)
Proving that a principal is who it claims to be, by a method whose strength is known.
- Criticality 5
- Exposure 5
- Weight 25
- Illustrative rung Advanced · 75%
Passwords with optional one-time codes or push approval. PIV is issued but accepted by only a subset of applications, and service accounts authenticate with static secrets held in configuration.
Phishing-resistant MFA (PIV or FIDO2) enforced for privileged and internal staff; external users on one-time codes. An exception list exists, with owners, and it is growing.
Phishing-resistant MFA enforced for every human identity including external users. Break-glass is the only standing exception and its use raises an alert. Machine identities use short-lived credentials rather than static secrets.
Authentication strength is a signal the policy engine evaluates per request rather than a setting configured per application: a weaker method does not fail the login, it narrows what the resulting session can reach.
ObservableShare of successful authentications to key terrain performed with a phishing-resistant method, measured at the policy engine rather than at the identity provider’s summary.
Authorization / PDP
Deciding what an authenticated principal may do, centrally, and enforcing it at the resource.
- Criticality 5
- Exposure 4
- Weight 20
- Illustrative rung Initial · 50%
Access decided inside each application from group membership resolved at login. There is no central decision point, so there is no single place to state or audit policy.
A policy decision point exists and fronts the main mission applications. Policy is coarse — role plus network location — and is evaluated once, at the start of a session.
Every application in the mission tier enforces at an enforcement point that calls the decision point. Policy takes device posture and resource sensitivity as inputs, and sessions are re-evaluated when either changes.
Authorization is continuous: policy is evaluated per request against live signals, denials are emitted as telemetry carrying the reason, and a policy change is reviewed, versioned and deployed like code.
ObservableShare of mission-tier requests decided by the policy decision point rather than by an application’s own logic — and, separately, whether denials are visible to the SOC at all.
Privileged Access (JIT/PAM)
The lifecycle of elevated rights: how they are obtained, how long they last, and what record they leave.
- Criticality 5
- Exposure 4
- Weight 20
- Illustrative rung Initial · 50%
Standing domain and cloud administrator rights held by named individuals and by shared accounts. Privileged sessions are not recorded, so a privileged action cannot be attributed after the fact.
Privileged accounts are vaulted, separated from their holders’ ordinary accounts, and rotated. Standing rights remain the norm for platform and cloud teams because removing them would break routine work.
Privilege is requested, approved, time-boxed and expires automatically. Standing privilege survives only where a documented technical constraint prevents just-in-time issue, and each such case carries an owner and a review date. Sessions are recorded.
No standing privilege anywhere in the identity plane, including break-glass, which is sealed and alarmed. Elevation requires a second party and a work item, and time-to-revoke is measured continuously against the observed adversary dwell budget for stolen-credential use.
ObservableCount of identities holding standing privilege over key terrain, and the median lifetime of an elevated session. Both should be falling; neither should be zero-by-definition.
Identity Governance (ICAM)
The authoritative record of which identities exist, who owns them, and what they are entitled to.
- Criticality 4
- Exposure 3
- Weight 12
- Illustrative rung Initial · 50%
Joiner, mover and leaver run on email and manual tickets. Entitlement review is annual, by spreadsheet, and its output is a signature rather than a revocation.
An authoritative HR source drives provisioning for employees. Contractors and machine accounts are handled by exception. Recertification is annual and completing it is treated as the outcome.
One authoritative source per identity type, including contractors and non-person entities. Movers lose their previous entitlements automatically. Anything touching key terrain is recertified quarterly, and revocation is the default when a reviewer does not respond.
Entitlement drift is detected continuously against a declared model. Orphaned and dormant identities are disabled automatically inside a stated interval. The governance record is the same record the coverage computation reads, so the two cannot disagree.
ObservableAge of the oldest un-recertified entitlement on key terrain, and the number of active identities with no resolvable owner.
Weight, Coverage and Residual Risk
Weight is criticality × exposure, 1–25 per sub-tower. Coverage is the weighted mean of the sub-towers’ maturity coverage — never a flat average. Residual risk is reported both as the inverse percentage and in weight points, because the points are what rank a backlog.
- 77Layer weightSum of criticality × exposure across 4 sub-towers
- 58.1%Rolled-up coverageWeighted mean of the sub-tower maturity coverage
- 41.9%Residual riskThe inverse of coverage, before weight is considered
- 32.3Residual pointsWeight left uncovered — the figure that ranks against other layers
| Sub-tower | Criticality | Exposure | Weight | Illustrative rung | Coverage | Residual points |
|---|---|---|---|---|---|---|
| Authentication (phishing-resistant MFA) | 5 | 5 | 25 | Advanced | 75% | 6.3 |
| Authorization / PDP | 5 | 4 | 20 | Initial | 50% | 10 |
| Privileged Access (JIT/PAM) | 5 | 4 | 20 | Initial | 50% | 10 |
| Identity Governance (ICAM) | 4 | 3 | 12 | Initial | 50% | 6 |
Authentication (phishing-resistant MFA)
- Criticality
- 5
- Exposure
- 5
- Weight
- 25
- Illustrative rung
- Advanced
- Coverage
- 75%
- Residual points
- 6.3
Authorization / PDP
- Criticality
- 5
- Exposure
- 4
- Weight
- 20
- Illustrative rung
- Initial
- Coverage
- 50%
- Residual points
- 10
Privileged Access (JIT/PAM)
- Criticality
- 5
- Exposure
- 4
- Weight
- 20
- Illustrative rung
- Initial
- Coverage
- 50%
- Residual points
- 10
Identity Governance (ICAM)
- Criticality
- 4
- Exposure
- 3
- Weight
- 12
- Illustrative rung
- Initial
- Coverage
- 50%
- Residual points
- 6
Criticality on this layer is nearly always 5, because the identity plane serves every mission consumer at once — there is no mission whose loss of identity is partial. Exposure is what actually varies: an internet-reachable policy engine with external-user self-service is a 5; an identity plane reachable only from an administrative network is a 3.
That combination is why T1 dominates a first ranked backlog. With most sub-towers at criticality 5, weight lands between 15 and 25 per sub-tower, so a single rung of maturity on Privileged Access moves more residual risk than a full rung on an entire smaller layer. That is not a bug in the arithmetic — it is the model saying what doctrine already said.
The trap on this layer is coverage that averages away the sub-tower that matters. Authentication at Optimal and Privileged Access at Traditional averages to a respectable number and describes an estate that will be lost through standing administrator rights. This is precisely what the decisive-point protection floor (KT-2) exists to prevent: the floor is asserted per sub-tower, and it is not satisfiable by a good average.
Maneuvers That Consume This Layer
The primary list is derived from each form’s own primary-terrain declaration in the maneuver catalog, so the two cannot disagree. The supporting list is authored: “consumes without being principally about” is a judgment, and deriving it would be a false claim of rigour.
Primary — Derived
- M3 EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy.
Supporting — Authored
- M6 DelayStep-up authentication and session throttling are identity mechanisms. Delay is bought on this layer even though it is spent on the application layer.
- M8 Isolation / RetrogradeCredential and session revocation is the fastest retrograde available in a modern estate — it gives ground without moving a firewall rule.
- M11 ReconstitutionA rebuild that restores the identity plane from itself restores the adversary with it. Reconstitution consumes this layer before it consumes any other.
Controls That Apply
Two lists. The first is specific to this ground; the second is the spine every layer runs through, stated once here rather than repeated ten times across the reference.
Specific to T1
- ID-1 Identity Plane DefinitionDraws the identity plane as ground: which planes exist, where their trust edges run, and which enforcement points stand on them. Every other control on this layer resolves against it.
- ID-2 Credential Strength and BindingBinds credential strength to the access it confers. This layer is where the mismatch between a weak credential and decisive-point access is actually visible.
- ID-3 Authentication AssuranceVaries authentication assurance with the terrain being reached, and makes the level achieved available to the decision that relies on it.
- ID-4 Identity Assertion ProtectionBounds how long an assertion is useful and how fast it can be withdrawn — the difference between a contained credential theft and an uncontained one.
- ID-5 Authorization Decision IntegrityEnsures the policy decision point is actually consulted on every path, which is the property that makes this layer an enforcement plane rather than a login service.
- TM-4 Trust Zone DefinitionThe identity plane is its own trust zone. If it is not defined as one, its administrative path inherits whatever zone it happens to sit in.
- KT-4 Adversary Reachability AssessmentReachability of the policy decision point from the public tier is the single most consequential reachability question in the estate.
- TA-4 Pre-authorized ResponseSession and credential revocation is the archetypal pre-authorized response — its value is entirely in whether it can be executed without an escalation.
- RC-3 Trusted Rebuild PathA trusted rebuild path has to include the identity plane, or recovery re-admits whoever compromised it.
- WF-2 Privileged Human RegisterThe privileged human register on T7 and the privileged account inventory here are two views of one population; reconciling them is what finds the accounts with no human behind them.
- CG-5 Control Inheritance MappingIdentity controls carry the heaviest 800-53 inheritance (AC, IA), so the inheritance mapping matters most here.
The Common Spine
- TM-1 Terrain Inventory and OverlayPuts the layer’s elements on the overlay in the first place. Nothing below can be computed for terrain that is not inventoried.
- TM-2 Defensive Layer ClassificationAssigns each element to a layer. This is the control that decides whether a thing is scored here or somewhere else.
- TM-3 Asset WeightingSets criticality and exposure per asset, which is the allocation driver every coverage and residual-risk number on the layer is weighted by.
- TM-6 Terrain CurrencyAges the overlay. A layer’s coverage figure inherits the staleness of the inventory it was computed from.
- TM-7 Terrain OwnershipNames an owner for the ground, so a coverage gap has somebody to be assigned to.
- KT-1 Decisive Point IdentificationIdentifies the decisive point on this layer rather than accepting the one this page names by default.
- KT-2 Decisive Point Protection FloorSets the minimum protection the layer’s decisive point must hold regardless of its rolled-up coverage.
- FO-7 Obligation Profile DeclarationDeclares which federal obligations bind the estate, which is what makes any FO coverage figure on this layer comparable to another agency’s.
- EN-1 Event Declaration and TriageAn engagement on this layer starts by being declared. Until it is, nothing below this line is running.
- EN-2 Engagement ReconstructionReconstruction is what establishes how far the adversary actually got across this layer, and it is what corrects the dwell estimate the layer’s tempo figures use.
- EN-3 Evidence PreservationSets how long this layer’s telemetry must survive — measured against estimated dwell, not against a retention default.
- EN-4 Escalation and Engagement AuthorityNames who may authorize action on this layer out of hours, which is where the decide segment is usually spent.
- EN-5 Eradication and Transition to RecoveryVerifies the adversary is off this layer before the mission is restored onto it.
- EN-6 Engagement CommunicationReports what happened on this layer to those who must know, inside and outside the agency.
- SM-7 Deception EmplacementDeception is emplaced per layer, on the approaches to that layer’s decisive point — the one detection here with no false-positive budget.
- CE-4 Coverage and Residual Risk ComputationPerforms the coverage and residual-risk computation described below, on the cycle cadence.
- CE-5 Remediation Backlog PrioritizationTurns weight multiplied by coverage gap into a ranked backlog, which is what the layer’s numbers are for.