Operational Technology

The Ground

Ground you cannot maneuver freely on.

Some ground permits movement but not maneuver: a force can be there, but it cannot reposition freely, cannot be resupplied quickly, and cannot fall back without giving up something that does not come back. Operational technology is that ground. The moves available on it are narrower than on any IT layer, and the consequence of loss is physical rather than informational.

The narrowness is the doctrinal point, and it is what a general-purpose maturity model gets wrong. Standard advice on an IT layer — patch promptly, deploy an agent, isolate on detection — ranges from unavailable to actively dangerous here. A building control system cannot be patched on the vendor’s absence, an agent cannot be installed on a controller with no operating system to host one, and isolating a segment mid-process can cause the physical outcome the defense exists to prevent.

The correct posture follows from the constraint rather than from ambition: know exactly what is there, control the boundary and the accounts that cross it, watch passively, and write down in advance which responses are forbidden. That is a smaller set of moves than any other layer offers, and pretending otherwise produces a score that overstates the defender’s options.

Key Terrain

Key terrain is what confers decisive advantage if you hold it. Everything else on this layer is defended in order to hold these.

• Building control systemsPower, cooling and access control. Their failure takes the data center with them, which makes them an IT dependency wearing an OT interface.
• Laboratory and facility instrumentationMission-supporting equipment sitting on ordinary networks, bought through program offices, and routinely missing from the security register.
• Engineering workstationsThe devices that can change a process. The one place on this layer where a conventional endpoint compromise converts directly into physical consequence.
• Vendor remote-access pathsMaintained by contract rather than by architecture, and the most common way the OT/IT boundary is crossed in practice.

The Decisive Point

The OT/IT boundary and the accounts permitted to cross it

The decisive point is the OT/IT boundary and the accounts permitted to cross it — the two together, because a boundary with permitted crossings is only as strong as the identities holding them.

It is decisive because it is the only place on this layer where a defender has both freedom of action and leverage. Inside the OT segment, options are constrained by the process; at the boundary, ordinary network and identity controls apply and can be exercised without physical consequence.

It is also the correct place to state what happens under compromise. A boundary designed so that loss of the IT side does not require the OT side to stop is what makes graceful degradation real on this layer. Where the two are coupled, an IT incident forces a choice between defending the estate and continuing a physical process — and that choice will be made badly, under time pressure, by whoever is on the call.

Sub-Towers, Rung by Rung

Maturity is scored here, not on the layer. Each rung below is stated for this sub-tower specifically — “Advanced” means something testable on each one, and something different on each one. The rung marked current is the illustrative position on the Federal Reference Agency profile.

Weight, Coverage and Residual Risk

Weight is criticality × exposure, 1–25 per sub-tower. Coverage is the weighted mean of the sub-towers’ maturity coverage — never a flat average. Residual risk is reported both as the inverse percentage and in weight points, because the points are what rank a backlog.

• 59Layer weightSum of criticality × exposure across 4 sub-towers
• 33.5%Rolled-up coverageWeighted mean of the sub-tower maturity coverage
• 66.5%Residual riskThe inverse of coverage, before weight is considered
• 39.3Residual pointsWeight left uncovered — the figure that ranks against other layers

Criticality on T6 is measured in physical and mission consequence rather than in records exposed. A building control system carries no records at all and can still take a data center off the air: scored from data exposure it rates a 1, and it is weighted at 4.

Exposure is usually lower than on any IT layer and should be scored honestly rather than defensively. Most OT in a civilian agency is not internet-reachable; its exposure comes almost entirely from the boundary and from vendor access, which is precisely why those two are separate sub-towers and carry the layer’s weight.

The layer’s coverage number should be read alongside a note that its ceiling is lower. Several sub-towers cannot reach Optimal without a vendor change the agency does not control, and a program that scores T6 as though it could is either going to report a permanent failure or quietly stop reporting it. The honest treatment is to record the constraint against the asset and let the residual risk stand as accepted rather than as outstanding.

Maneuvers That Consume This Layer

The primary list is derived from each form’s own primary-terrain declaration in the maneuver catalog, so the two cannot disagree. The supporting list is authored: “consumes without being principally about” is a judgment, and deriving it would be a false claim of rigour.

Controls That Apply

Two lists. The first is specific to this ground; the second is the spine every layer runs through, stated once here rather than repeated ten times across the reference.

Specific to T6

• FO-4 Operational Technology TerrainThe control that requires operational technology to be identified and treated as terrain in the first place. T6 is its scoring surface.
• TM-5 Connection and Denied-Path RegisterThe connection and denied-path register is where OT crossings are stated; the OT boundary is the register’s hardest case and its most valuable one.
• KT-5 Barrier SufficiencyBarrier sufficiency on the OT boundary is testable in a way most of this layer is not, which makes it the highest-yield assessment available here.
• CG-3 Rules of EngagementRules of engagement must state which responses are forbidden on OT. This is the only layer where the ROE’s prohibitions matter more than its authorizations.
• FC-4 Environmental ContinuityEnvironmental continuity and building control are the same systems seen from the facilities side; scoring them twice is a modeling error, ignoring the overlap is worse.
• FO-5 Statutory Availability FloorWhere OT carries a mission process, the statutory availability floor constrains what may be done to defend it.

The Common Spine

• TM-1 Terrain Inventory and OverlayPuts the layer’s elements on the overlay in the first place. Nothing below can be computed for terrain that is not inventoried.
• TM-2 Defensive Layer ClassificationAssigns each element to a layer. This is the control that decides whether a thing is scored here or somewhere else.
• TM-3 Asset WeightingSets criticality and exposure per asset, which is the allocation driver every coverage and residual-risk number on the layer is weighted by.
• TM-6 Terrain CurrencyAges the overlay. A layer’s coverage figure inherits the staleness of the inventory it was computed from.
• TM-7 Terrain OwnershipNames an owner for the ground, so a coverage gap has somebody to be assigned to.
• KT-1 Decisive Point IdentificationIdentifies the decisive point on this layer rather than accepting the one this page names by default.
• KT-2 Decisive Point Protection FloorSets the minimum protection the layer’s decisive point must hold regardless of its rolled-up coverage.
• FO-7 Obligation Profile DeclarationDeclares which federal obligations bind the estate, which is what makes any FO coverage figure on this layer comparable to another agency’s.
• EN-1 Event Declaration and TriageAn engagement on this layer starts by being declared. Until it is, nothing below this line is running.
• EN-2 Engagement ReconstructionReconstruction is what establishes how far the adversary actually got across this layer, and it is what corrects the dwell estimate the layer’s tempo figures use.
• EN-3 Evidence PreservationSets how long this layer’s telemetry must survive — measured against estimated dwell, not against a retention default.
• EN-4 Escalation and Engagement AuthorityNames who may authorize action on this layer out of hours, which is where the decide segment is usually spent.
• EN-5 Eradication and Transition to RecoveryVerifies the adversary is off this layer before the mission is restored onto it.
• EN-6 Engagement CommunicationReports what happened on this layer to those who must know, inside and outside the agency.
• SM-7 Deception EmplacementDeception is emplaced per layer, on the approaches to that layer’s decisive point — the one detection here with no false-positive budget.
• CE-4 Coverage and Residual Risk ComputationPerforms the coverage and residual-risk computation described below, on the cycle cadence.
• CE-5 Remediation Backlog PrioritizationTurns weight multiplied by coverage gap into a ranked backlog, which is what the layer’s numbers are for.

Why ASOM-Fed Adds This Layer

T6 is not a CISA pillar. Extending someone else’s taxonomy requires a reason per addition, and the reason cannot be completeness. The objection is stated first, at its strongest.

1. Comparability is preserved by construction: T1–T5 keep the ZTMM names, boundaries and maturity rungs exactly, and an agency’s reported ZTMM figures drop into this model unchanged. T6–T9 are scored alongside them, not blended into them. Removing the four added layers reproduces the ZTMM result exactly, which is the test the separation is designed to pass.
2. The substantive objection is the interesting one, and it fails on the moves available rather than on the assets present. A maturity model is a statement about what good looks like. Scored as T2 devices, an OT estate is assessed against endpoint protection, posture-based access and rebuild-from-image — three practices that are respectively unavailable, unavailable and dangerous on a process controller. The estate scores Traditional forever, and the score carries no information because it was never achievable.
3. Scoring OT separately changes what the number means. The four sub-towers here are the moves that are actually available on this ground — inventory, boundary, engineering access, passive monitoring — so a Traditional score is a finding somebody can act on and an Advanced score is a claim that can be tested.
4. There is a second-order reason that matters in a federal estate specifically. OT is procured by program and facilities offices under different authorities, so it is systematically absent from an IT-derived asset register. A layer with its own inventory sub-tower forces the discovery; a sub-heading under Devices inherits the register that already does not contain it.

What it does not fixThis layer does not make an agency competent at OT security, and its four sub-towers are a floor rather than a program — an agency running genuine industrial control should be working to a sector-specific standard, with this layer serving only to place OT on the same map as everything else. It also overlaps deliberately with T8 Facilities on building systems; the overlap is resolved by ownership, not by cloning the asset into both layers.