Control Statement
The organization shall maintain a current graphical overlay of all systems, data stores, and external actors within the authorization boundary, including the trust zones in which they reside.
Purpose. To establish one authoritative positional picture of the estate, so that every later judgment about priority, reachability and risk is made against the same ground.
Discussion
A register in a spreadsheet is not terrain. Terrain is positional: it records where an element sits relative to boundaries and to other elements, because position determines how an adversary moves. The overlay is the single artifact from which every other ASOM product is derived, which means an error introduced here propagates to reachability, coverage, backlog ranking and the Brief without being independently detectable in any of them.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Percentage of inventoried systems present on the overlay
- Number of elements discovered during a cycle that were absent from the overlay
- Percentage of elements placed inside a declared trust zone
- Number of elements with no recorded connections
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Consulted | SOC / Defensive Operations: Consulted | Hunt team: Informed | Platform and product owners: Responsible | Governance / RMF / ISSO: Informed |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- ConsultedCyber Threat Intelligence cell
- ConsultedSOC / Defensive Operations
- InformedHunt team
- ResponsiblePlatform and product owners
- InformedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- Outside the frameworkNetwork and cloud architecture diagrams
- TM-6 Terrain CurrencyRefresh trigger from the currency cadence or a material architectural change
Produces
- TM-2 Defensive Layer ClassificationElement list awaiting defensive-layer classification
- KT-1 Decisive Point IdentificationCandidate elements for decisive-point designation
- KT-3 Avenue of Approach AnalysisPositional map used to enumerate avenues of approach
- CE-4 Coverage and Residual Risk ComputationThe population over which coverage and residual risk are computed
- TM-3 Asset WeightingElement list and position
- TM-4 Trust Zone DefinitionOverlay elements requiring containment
- TM-7 Terrain OwnershipElement list requiring ownership
- CE-7 Brief Generation and DistributionTerrain overlay
- RC-1 Recovery ObjectivesMission services represented on the terrain overlay
- FO-1 Privacy Terrain IdentificationTerrain overlay
- FO-2 Controlled Unclassified Information HandlingTerrain overlay
- FO-3 Tenancy and Inheritance BoundaryHosted elements on the overlay
- FO-4 Operational Technology TerrainTerrain overlay
- FO-5 Statutory Availability FloorMission services on the overlay
- FO-6 Supply Chain ObligationTerrain overlay
- WF-1 Workforce Terrain IdentificationTerrain overlay
- FC-1 Facility Terrain IdentificationTerrain overlay elements requiring a physical location
- ID-1 Identity Plane DefinitionTerrain overlay the identity planes are drawn onto
- EN-2 Engagement ReconstructionTerrain overlay the movement is traced across
- DV-1 Device Terrain IdentificationTerrain overlay the device layer is placed on
Activities
- L2Establish the authorization boundary as the overlay's outer edge, and record what was deliberately excluded and on whose authority.
- L2Populate the overlay from the authoritative asset inventory.
- L2Represent external actors — public users, partner agencies, suppliers, unauthenticated internet — as first-class elements rather than as an arrow at the boundary.
- L3Reconcile count and identity against the inventory rather than transcribing a subset, so completeness is a property of the method.
- L3Group every element into the trust zone that actually contains it, taken from enforced configuration rather than architectural intent.
- L3Record the derivation of each element: system of record, date, and who confirmed it.
- L3Publish the overlay in a form readable without the tool that produced it, so the artifact survives a change of platform.
- L4Measure reconciliation variance between overlay and inventory each cycle and set a threshold above which the overlay is not fit to plan from.
- L4Trend the age of the overlay at the moment it is used for a decision, not at the moment it was refreshed.
- L5Feed elements discovered during engagements — which the inventory did not contain — back into the inventory process, not only onto the overlay.
Measurement
Percentage of inventory elements present on the overlay.
Median age of the overlay at time of use.
Evidence and Assessment
Cyber Terrain Overlay (Figure 1 of the Brief); exported diagram source; derivation and reconciliation record.
Examine the overlay; interview the architecture owner; compare against the authoritative asset inventory for completeness.
Related Guidance
- CM-8
- PM-5
- RA-9
- ID.AM-01
- ID.AM-03
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Fed By
Feeds
- TM-2 Defensive Layer Classification
- TM-3 Asset Weighting
- TM-4 Trust Zone Definition
- TM-7 Terrain Ownership
- KT-1 Decisive Point Identification
- CE-7 Brief Generation and Distribution
- RC-1 Recovery Objectives
- FO-1 Privacy Terrain Identification
- FO-2 Controlled Unclassified Information Handling
- FO-3 Tenancy and Inheritance Boundary
- FO-4 Operational Technology Terrain
- FO-5 Statutory Availability Floor
- FO-6 Supply Chain Obligation
- WF-1 Workforce Terrain Identification
- FC-1 Facility Terrain Identification
- ID-1 Identity Plane Definition
- EN-2 Engagement Reconstruction
- DV-1 Device Terrain Identification
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M1Screen / GuardGain early warning and buy reaction time before the adversary touches key terrain.5 of 15 techniques — M1.01, M1.02, M1.03, M1.11, M1.15
- M10Exploitation & PursuitConvert contact into durable advantage rather than closing the ticket.2 of 7 techniques — M10.03, M10.07
Terrain It Is Named On
Applies to all ten layersPuts the layer’s elements on the overlay in the first place. Nothing below can be computed for terrain that is not inventoried.
Artifacts It Stands On
- producesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
- consumesChange recordEvery defensive action carried out, stamped twice — at the decision and at the effect. A thin, unglamorous table, and the one the headline metric is computed from.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsiblePlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- ConsultedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- ConsultedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- InformedHunt teamCounterattack. Works the hypotheses that Fuse raises.
- InformedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.