Terrain Management
Inventory, classification, weighting, zones, connections, currency, ownership
The organization shall maintain a current graphical overlay of all systems, data stores, and external actors within the authorization boundary, including the trust zones in which they reside.
PurposeTo establish one authoritative positional picture of the estate, so that every later judgment about priority, reachability and risk is made against the same ground.Activities10 · Metrics4Every element on the terrain shall be classified to exactly one defensive layer: identity, devices, networks, applications and workloads, data, operational technology, workforce, facilities, or supply chain. Elements that enable maneuver across layers rather than constituting ground — visibility and analytics, automation and orchestration, governance — shall be classified to the cross-cutting domain.
PurposeTo make posture summable and comparable by layer, and to force an explicit ownership decision for every element.Activities10 · Metrics2Each element shall carry a defensive weight derived from its criticality to the mission and its exposure to untrusted actors, on a defined and consistently applied scale.
PurposeTo convert an undifferentiated inventory into a priority order, so that coverage figures carry meaning and investment can be argued from mission consequence.Activities10 · Metrics3Trust zones shall be defined with explicit boundaries, and every element shall reside within a declared zone.
PurposeTo establish boundaries that something enforces, so that reachability and denied-path analysis rest on configuration rather than on design intent.Activities10 · Metrics2All permitted connections between elements shall be recorded, and paths that are deliberately blocked shall be recorded distinctly as denied paths.
PurposeTo record connectivity as three distinct states — permitted, denied, unknown — so that reachability conclusions rest on tested denials rather than on absence of evidence.Activities10 · Metrics3The terrain overlay shall be refreshed at a defined cadence and upon any material architectural change.
PurposeTo keep the overlay current against both the clock and the change, so that planning is conducted against ground as it currently is.Activities10 · Metrics2Every element shall have a named accountable owner recorded against it.
PurposeTo attach every element to a person who can be asked to act, so that findings convert into work rather than accumulating.Activities10 · Metrics2