The Ground
The physical boundary.
The physical boundary is the oldest terrain there is, and it is the only one in this model that an adversary can cross without a credential. A logical model scores an estate as though the ground it sits on were neutral; it is not. A wiring closet with a shared key, a public counter with an agency workstation on it, and a data hall with a vendor badge population are all crossings, and none of them appears on a network diagram.
The doctrinal reason for a separate layer rather than an assumption is that physical access defeats controls on other layers rather than being caught by them. Disk encryption fails to a device taken while running. Segmentation fails to a cable in the wrong port. Device posture fails to hardware added between the endpoint and the switch. In each case the compromise is invisible on the layer whose control was defeated.
The metaphor also sets the right scope, which is narrower than a facilities-security program. This layer is concerned with physical space in so far as it holds, transits or backs up production systems — not with the whole of physical security, which is a different discipline with a different owner.
Added by ASOM-Fed in v3.0. Not a CISA pillar — the justification is stated in full below.
- Facility assets — data centers and equipment rooms, wiring closets, laboratory and public-counter space, backup and offsite storage, environmental plant serving production
Key Terrain
Key terrain is what confers decisive advantage if you hold it. Everything else on this layer is defended in order to hold these.
- Data center and equipment roomsWhere losing the space means losing everything in it, in a way no logical control mitigates.
- Wiring closets and intermediate distributionNumerous, poorly inventoried, frequently on a shared key, and sufficient to insert a device into the corridor terrain of T3.
- Public-access areas holding agency devicesCounters, kiosks and lobbies: unsupervised physical access to a device that is inside the boundary.
- Backup and offsite storageThe place the recovery capability physically lives. Its compromise defeats reconstitution without touching production.
The Decisive Point
Vendor and maintenance access to space holding production systems
The decisive point is vendor and maintenance access to space holding production systems.
It is decisive because it is the highest-frequency, lowest-scrutiny crossing of the physical boundary, and because it is the one the agency has the clearest authority to control. Employees are badged, reviewed and known; maintenance access is scheduled by a facilities process against a contract, often outside working hours, and frequently escorted by convention rather than by requirement.
It is also where this layer joins T9. The supplier who holds a maintenance contract is a registered supplier with logical access somewhere else in the estate, and the two are usually tracked by different organizations that have never reconciled their lists. Reconciling them is one of the highest-yield findings available in the whole model, and it is only visible if physical access is on the map.
Sub-Towers, Rung by Rung
Maturity is scored here, not on the layer. Each rung below is stated for this sub-tower specifically — “Advanced” means something testable on each one, and something different on each one. The rung marked current is the illustrative position on the Federal Reference Agency profile.
Facility Inventory
Knowing which physical spaces hold, transit or back up production systems.
- Criticality 3
- Exposure 2
- Weight 6
- Illustrative rung Initial · 50%
Real-estate records describe space. Nothing records which space holds production systems, so the question can only be answered by walking the building.
Data centers and main equipment rooms are identified. Smaller closets, laboratory space, storage and interim locations are missing.
Every space that holds, transits or backs up production systems is in the overlay with an owner — closets, laboratory space and public counters hosting agency devices included.
The facility record is joined to the asset register, so relocating an asset changes its physical exposure score immediately rather than at the next survey.
ObservableShare of production assets with a resolved physical location, and the count of relevant spaces discovered outside the record per cycle.
Physical Zone Boundary
Which populations may enter which spaces, and how that maps to the logical trust zones.
- Criticality 4
- Exposure 3
- Weight 12
- Illustrative rung Initial · 50%
A badge opens most doors. Visitors are handled at reception, and there is no zone concept behind the front door.
Data-center access is separately controlled. Everything else sits on the general badge population, including the closets that terminate the data tier.
Physical zones are defined to match the logical trust zones, so the space holding the data tier does not share a badge population with the public counter. Per-zone access lists are reviewed like entitlements.
Physical access to zones holding key terrain is time-boxed and approved like privileged access, and physical and logical access are correlated — a credential used remotely while its holder is badged into a building is a detection rather than a coincidence.
ObservableNumber of badge holders entitled to the data-tier zone, and the interval since that list was last reviewed.
Maintenance Access
Vendor and maintenance entry to space holding production systems.
- Criticality 4
- Exposure 4
- Weight 16
- Illustrative rung Traditional · 25%
Vendors and maintenance staff are escorted by convention. Out-of-hours access is granted informally by whoever is available to open the door.
Vendor access requires a request. Escorting is policy, is generally done, and is not recorded in a way that could be reviewed afterwards.
Maintenance access to space holding production systems is scheduled, authorized against a named contract, escorted, and recorded. The escort requirement is enforced technically where the space permits.
Maintenance access is reconciled against the supplier register on T9 — the same vendor is not separately unknown in physical and logical terms — and out-of-window entry alarms to the SOC rather than appearing in a monthly report.
ObservableShare of maintenance entries with a matched work order and a recorded escort, and the count of out-of-window entries per cycle.
Environmental Continuity
Power, cooling and the physical conditions the availability floor depends on.
- Criticality 4
- Exposure 2
- Weight 8
- Illustrative rung Initial · 50%
Power and cooling are the landlord’s responsibility. Continuity is assumed from the building specification and has never been demonstrated.
Generators and cooling are maintained on a schedule. Failover is tested without load, which tests the equipment rather than the outcome.
Environmental dependencies of the systems carrying the statutory availability floor are enumerated and their failure modes stated. Failover is tested under representative load at a stated interval.
An environmental failure produces the same graceful degradation the cyber scheme calls for — services shed in the order the mission dictates rather than in the order they happen to fail — and that has been demonstrated within the current period.
ObservableInterval since the last tested failover for each space holding a floor-carrying service, and whether the degradation order is documented and exercised.
Weight, Coverage and Residual Risk
Weight is criticality × exposure, 1–25 per sub-tower. Coverage is the weighted mean of the sub-towers’ maturity coverage — never a flat average. Residual risk is reported both as the inverse percentage and in weight points, because the points are what rank a backlog.
- 42Layer weightSum of criticality × exposure across 4 sub-towers
- 40.5%Rolled-up coverageWeighted mean of the sub-tower maturity coverage
- 59.5%Residual riskThe inverse of coverage, before weight is considered
- 25Residual pointsWeight left uncovered — the figure that ranks against other layers
| Sub-tower | Criticality | Exposure | Weight | Illustrative rung | Coverage | Residual points |
|---|---|---|---|---|---|---|
| Facility Inventory | 3 | 2 | 6 | Initial | 50% | 3 |
| Physical Zone Boundary | 4 | 3 | 12 | Initial | 50% | 6 |
| Maintenance Access | 4 | 4 | 16 | Traditional | 25% | 12 |
| Environmental Continuity | 4 | 2 | 8 | Initial | 50% | 4 |
Facility Inventory
- Criticality
- 3
- Exposure
- 2
- Weight
- 6
- Illustrative rung
- Initial
- Coverage
- 50%
- Residual points
- 3
Physical Zone Boundary
- Criticality
- 4
- Exposure
- 3
- Weight
- 12
- Illustrative rung
- Initial
- Coverage
- 50%
- Residual points
- 6
Maintenance Access
- Criticality
- 4
- Exposure
- 4
- Weight
- 16
- Illustrative rung
- Traditional
- Coverage
- 25%
- Residual points
- 12
Environmental Continuity
- Criticality
- 4
- Exposure
- 2
- Weight
- 8
- Illustrative rung
- Initial
- Coverage
- 50%
- Residual points
- 4
Criticality on T8 is inherited from what the space contains: a room’s criticality is the highest criticality among the assets inside it. This is the only sound way to weight a space, and it has the useful side effect of making an unremarkable closet that terminates the data tier score correctly.
Exposure is about population and supervision rather than about locks — how many people can enter, how many of them are not agency staff, and whether entry is observed. A data hall with a strong door and a badge population of four hundred is high exposure.
This layer produces the lowest weights in the model in a cloud-forward estate, and that is the correct result rather than a reason to inflate it. The value of scoring it is not that it competes for the top of the backlog; it is that the two or three physical assets that genuinely matter — the closet, the backup location, the vendor’s standing access — become visible instead of being assumed away.
Maneuvers That Consume This Layer
The primary list is derived from each form’s own primary-terrain declaration in the maneuver catalog, so the two cannot disagree. The supporting list is authored: “consumes without being principally about” is a judgment, and deriving it would be a false claim of rigour.
Primary — Derived
No form of maneuver names this layer as its primary terrain. That is a real gap in the catalog rather than a property of the layer: the eleven forms were derived before T8 existed, and a form whose primary ground is this layer has not yet been added. Until it is, this layer is consumed only in support.
Supporting — Authored
- M1 Screen / GuardPhysical entry and badge telemetry are screening sensors; they provide warning of a class of approach that no network sensor sees.
- M2 Defense in DepthPhysical zoning is a genuinely independent layer in a depth calculation, and one an adversary operating remotely cannot defeat at all.
- M11 ReconstitutionReconstitution depends on physical access to a space and to media; whether that space survives the incident is a T8 property.
Controls That Apply
Two lists. The first is specific to this ground; the second is the spine every layer runs through, stated once here rather than repeated ten times across the reference.
Specific to T8
- FC-1 Facility Terrain IdentificationFacility terrain identification — the control that puts physical space on the overlay.
- FC-2 Physical Zone BoundaryPhysical zone boundary, including the requirement that physical zones correspond to logical trust zones.
- FC-3 Maintenance Access ControlMaintenance access control, which is this layer’s decisive point stated as a control.
- FC-4 Environmental ContinuityEnvironmental continuity, and its dependency on the availability floor rather than on a building specification.
- TM-4 Trust Zone DefinitionTrust-zone definition is the control physical zones are aligned to; misalignment between the two is the finding.
- RC-2 Isolated Recovery CapabilityIsolated recovery capability has a physical location, and its separation from production is partly a facilities property.
- LC-3 Supplier Access ConstraintSupplier access constraint governs the same vendors from the logical side; reconciling the two lists is where this layer pays for itself.
The Common Spine
- TM-1 Terrain Inventory and OverlayPuts the layer’s elements on the overlay in the first place. Nothing below can be computed for terrain that is not inventoried.
- TM-2 Defensive Layer ClassificationAssigns each element to a layer. This is the control that decides whether a thing is scored here or somewhere else.
- TM-3 Asset WeightingSets criticality and exposure per asset, which is the allocation driver every coverage and residual-risk number on the layer is weighted by.
- TM-6 Terrain CurrencyAges the overlay. A layer’s coverage figure inherits the staleness of the inventory it was computed from.
- TM-7 Terrain OwnershipNames an owner for the ground, so a coverage gap has somebody to be assigned to.
- KT-1 Decisive Point IdentificationIdentifies the decisive point on this layer rather than accepting the one this page names by default.
- KT-2 Decisive Point Protection FloorSets the minimum protection the layer’s decisive point must hold regardless of its rolled-up coverage.
- FO-7 Obligation Profile DeclarationDeclares which federal obligations bind the estate, which is what makes any FO coverage figure on this layer comparable to another agency’s.
- EN-1 Event Declaration and TriageAn engagement on this layer starts by being declared. Until it is, nothing below this line is running.
- EN-2 Engagement ReconstructionReconstruction is what establishes how far the adversary actually got across this layer, and it is what corrects the dwell estimate the layer’s tempo figures use.
- EN-3 Evidence PreservationSets how long this layer’s telemetry must survive — measured against estimated dwell, not against a retention default.
- EN-4 Escalation and Engagement AuthorityNames who may authorize action on this layer out of hours, which is where the decide segment is usually spent.
- EN-5 Eradication and Transition to RecoveryVerifies the adversary is off this layer before the mission is restored onto it.
- EN-6 Engagement CommunicationReports what happened on this layer to those who must know, inside and outside the agency.
- SM-7 Deception EmplacementDeception is emplaced per layer, on the approaches to that layer’s decisive point — the one detection here with no false-positive budget.
- CE-4 Coverage and Residual Risk ComputationPerforms the coverage and residual-risk computation described below, on the cycle cadence.
- CE-5 Remediation Backlog PrioritizationTurns weight multiplied by coverage gap into a ranked backlog, which is what the layer’s numbers are for.
Why ASOM-Fed Adds This Layer
T8 is not a CISA pillar. Extending someone else’s taxonomy requires a reason per addition, and the reason cannot be completeness. The objection is stated first, at its strongest.
Physical security is covered by the PE family in NIST 800-53 and is already assessed under FISMA. In a cloud-forward agency the data center belongs to the provider and is inherited. A physical layer in a zero-trust maturity model measures the provider’s controls and the agency’s empty offices.
- The inheritance argument is correct for the provider’s data centers and is exactly why this layer scores what is not inherited. A cloud-forward agency still operates equipment rooms, wiring closets, laboratory space, public counters with agency devices, and offsite backup — none of which appears in a provider’s attestation, and all of which sits inside the agency’s own boundary.
- The 800-53 argument confuses a control family with a terrain layer. The PE family states what shall be done; it does not produce a weighted coverage figure that rolls up to a mission consumer, and it is assessed on a three-year authorization cycle rather than on the defensive cycle. This layer’s job is to place physical space in the same rollup as everything else so that a mission’s residual risk includes the closet.
- The operational reason is that physical access defeats controls scored on other layers, invisibly to those layers. If physical is not a layer, the estate’s coverage figure silently assumes physical integrity — an assumption it has made no measurement of and cannot see when it fails.
- The specific finding this layer exists to produce is the vendor reconciliation: the maintenance supplier with standing physical access to a space holding production systems, who is also a registered supplier with logical access, tracked by two organizations that have never compared lists. That finding is not reachable from any other layer in the model.
What it does not fixThis layer is not a physical-security program and does not attempt to be one. It scores four properties of the spaces that hold production systems, and it defers to the agency’s physical-security function on everything else. In an estate that is genuinely fully cloud-hosted with no agency-operated space, this layer will be small and should be — the model is not improved by inventing weight for it.