Devices

The Ground

The entry fords.

A ford is where a force can cross an obstacle it otherwise cannot. Fords are few, they are known, and they are where a defender concentrates observation, because crossing is the moment the crossing force is most exposed and most predictable. Devices are the fords of a federal estate: the point at which an adversary transitions from operating outside the boundary to operating inside it, with a session, a token and a legitimate-looking process behind them.

The metaphor carries a warning about aggregation. Fords are not interchangeable — a managed laptop with a healthy agent and a contractor’s unmanaged machine are two different crossings with different depths, and a maturity score that averages them together reports a river that is passable nowhere and impassable nowhere. This is why device compliance and BYOD are separate sub-towers rather than one "endpoint" score.

It also explains the layer’s peculiar role: T2 rarely holds anything an adversary wants. Its value is almost entirely as the ground on which a crossing can be observed and denied — which is why its most consequential output is not protection but a signal the policy engine on T1 is willing to trust.

Key Terrain

Key terrain is what confers decisive advantage if you hold it. Everything else on this layer is defended in order to hold these.

• Mission-staff laptopsThe devices that hold sessions to the case-processing systems. Compromising one is the cheapest route to mission-record access that does not require defeating the identity plane directly.
• Contractor and vendor devicesDevices with legitimate access and an unmanaged posture, present in the estate because the contract required access, not because the security program approved the endpoint.
• The server and VM fleetNumerically the largest device population, routinely exempted from endpoint tooling for performance reasons, and the ground lateral movement actually crosses.
• Build agentsDevices with credentials to production and, in many estates, no endpoint agent at all — the intersection of this layer with the decisive point on T4.

The Decisive Point

The device-posture signal the policy engine trusts

The decisive point is the device-posture signal the policy engine trusts — not the endpoint tool that produces it.

This is a deliberately awkward answer, and it is the right one. Posture only changes an outcome at the moment it is consumed as an input to an authorization decision. Posture that is collected, dashboarded and reported monthly has produced a report; posture that denies a non-compliant device access to the mission tier has produced a defense. The point where that conversion happens is the point worth holding.

It is decisive in the adversary’s direction too. An adversary on a compromised endpoint is in a position to lie about its health, so the integrity of the posture signal — not its existence — is what an attack on this layer is actually aimed at. An estate whose posture signal cannot be forged has genuinely closed the ford; one that trusts a self-reported attribute has drawn a ford on the map where there is none.

Sub-Towers, Rung by Rung

Maturity is scored here, not on the layer. Each rung below is stated for this sub-tower specifically — “Advanced” means something testable on each one, and something different on each one. The rung marked current is the illustrative position on the Federal Reference Agency profile.

Weight, Coverage and Residual Risk

Weight is criticality × exposure, 1–25 per sub-tower. Coverage is the weighted mean of the sub-towers’ maturity coverage — never a flat average. Residual risk is reported both as the inverse percentage and in weight points, because the points are what rank a backlog.

• 63Layer weightSum of criticality × exposure across 4 sub-towers
• 57.9%Rolled-up coverageWeighted mean of the sub-tower maturity coverage
• 42.1%Residual riskThe inverse of coverage, before weight is considered
• 26.5Residual pointsWeight left uncovered — the figure that ranks against other layers

Exposure dominates criticality on this layer, which inverts the T1 pattern. A single staff laptop is not critical — losing it costs the mission almost nothing directly — but its exposure is maximal, because it is operated by a human, reads external mail, and holds a live session to the mission tier.

That means the useful weighting on T2 is per device population rather than per device: the managed staff fleet as one asset, contractor devices as another, the server fleet as a third. Weighting individual endpoints produces thousands of low-weight rows that sum to a number nobody acts on, and hides the fact that the contractor population is a single high-exposure asset with no owner.

Residual risk on this layer is usually understated for a specific and detectable reason: coverage is computed from the endpoint tool’s own console, which by construction can only count devices it is installed on. Computing the same figure against the terrain overlay typically moves it several points, and the difference between the two numbers is a better finding than either number alone.

Maneuvers That Consume This Layer

The primary list is derived from each form’s own primary-terrain declaration in the maneuver catalog, so the two cannot disagree. The supporting list is authored: “consumes without being principally about” is a judgment, and deriving it would be a false claim of rigour.

Controls That Apply

Two lists. The first is specific to this ground; the second is the spine every layer runs through, stated once here rather than repeated ten times across the reference.

Specific to T2

• DV-1 Device Terrain IdentificationPuts devices on the overlay as terrain, discovered from the identity plane outward — the management console can only report the population it already holds.
• DV-2 Device Posture as an Access PreconditionMakes device posture a precondition of access, which is what stops a valid credential being spent from a compromised endpoint.
• DV-3 Endpoint Sensor Coverage and LivenessEstablishes what this layer can actually see, and turns the loss of that visibility into an event rather than an assessment finding.
• DV-4 Execution ControlConstrains what may execute on the ground the adversary crosses into — the cheapest point at which most engagements can be stopped.
• DV-5 Device Lifecycle and SanitizationCloses both ends of the lifecycle, where trust is granted and where it is most often left behind on a device nobody holds any more.
• TM-5 Connection and Denied-Path RegisterThe connection register is what makes an endpoint’s reachability a stated fact rather than an assumption about the network it is plugged into.
• KT-3 Avenue of Approach AnalysisA compromised endpoint is the most common first avenue of approach in the reference profile; the avenue analysis is where that gets written down.
• KT-5 Barrier SufficiencyBarrier sufficiency asks whether the endpoint controls actually stop the crossing they are credited with, rather than whether they are deployed.
• SM-3 Implementation State TrackingImplementation-state tracking is what distinguishes "EDR purchased" from "EDR enforcing", which on this layer is the whole distinction.
• TA-1 Decision Loop MeasurementEndpoint detection time is usually the first term in the decision loop measurement, so this layer sets the tempo the rest of the loop inherits.

The Common Spine

• TM-1 Terrain Inventory and OverlayPuts the layer’s elements on the overlay in the first place. Nothing below can be computed for terrain that is not inventoried.
• TM-2 Defensive Layer ClassificationAssigns each element to a layer. This is the control that decides whether a thing is scored here or somewhere else.
• TM-3 Asset WeightingSets criticality and exposure per asset, which is the allocation driver every coverage and residual-risk number on the layer is weighted by.
• TM-6 Terrain CurrencyAges the overlay. A layer’s coverage figure inherits the staleness of the inventory it was computed from.
• TM-7 Terrain OwnershipNames an owner for the ground, so a coverage gap has somebody to be assigned to.
• KT-1 Decisive Point IdentificationIdentifies the decisive point on this layer rather than accepting the one this page names by default.
• KT-2 Decisive Point Protection FloorSets the minimum protection the layer’s decisive point must hold regardless of its rolled-up coverage.
• FO-7 Obligation Profile DeclarationDeclares which federal obligations bind the estate, which is what makes any FO coverage figure on this layer comparable to another agency’s.
• EN-1 Event Declaration and TriageAn engagement on this layer starts by being declared. Until it is, nothing below this line is running.
• EN-2 Engagement ReconstructionReconstruction is what establishes how far the adversary actually got across this layer, and it is what corrects the dwell estimate the layer’s tempo figures use.
• EN-3 Evidence PreservationSets how long this layer’s telemetry must survive — measured against estimated dwell, not against a retention default.
• EN-4 Escalation and Engagement AuthorityNames who may authorize action on this layer out of hours, which is where the decide segment is usually spent.
• EN-5 Eradication and Transition to RecoveryVerifies the adversary is off this layer before the mission is restored onto it.
• EN-6 Engagement CommunicationReports what happened on this layer to those who must know, inside and outside the agency.
• SM-7 Deception EmplacementDeception is emplaced per layer, on the approaches to that layer’s decisive point — the one detection here with no false-positive budget.
• CE-4 Coverage and Residual Risk ComputationPerforms the coverage and residual-risk computation described below, on the cycle cadence.
• CE-5 Remediation Backlog PrioritizationTurns weight multiplied by coverage gap into a ranked backlog, which is what the layer’s numbers are for.