Control Statement
Each element shall carry a defensive weight derived from its criticality to the mission and its exposure to untrusted actors, on a defined and consistently applied scale.
Purpose. To convert an undifferentiated inventory into a priority order, so that coverage figures carry meaning and investment can be argued from mission consequence.
Discussion
Without weighting, coverage percentages are misleading: protecting fifty low-value assets and leaving one crown jewel exposed can still report high compliance. The scale's integrity depends on calibration rather than on definition — two assessors applying a well-written scale will still diverge until they have scored a reference set together and reconciled the disagreement.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Percentage of elements carrying both a criticality and an exposure score
- Variance in weighting for comparable elements across different owners
- Correlation between element weight and remediation order in the backlog
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Consulted | SOC / Defensive Operations: Informed | Hunt team: Informed | Platform and product owners: Responsible | Governance / RMF / ISSO: Consulted |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- ConsultedCyber Threat Intelligence cell
- InformedSOC / Defensive Operations
- InformedHunt team
- ResponsiblePlatform and product owners
- ConsultedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- TM-1 Terrain Inventory and OverlayElement list and position
- Outside the frameworkMission impact analysis and statutory obligations
- FO-1 Privacy Terrain IdentificationPrivacy sensitivity informing criticality scoring
- FC-1 Facility Terrain IdentificationPhysical exposure informing asset weighting
Produces
- CE-4 Coverage and Residual Risk ComputationDefensive weight used to compute weighted coverage and residual risk
- CE-5 Remediation Backlog PrioritizationWeight component of the ranked remediation backlog
- KT-1 Decisive Point IdentificationWeighting evidence supporting decisive-point designation
- EN-1 Event Declaration and TriageAsset weighting used to rank what was declared
Activities
- L2Score every element on criticality and on exposure.
- L2Compute weight as the product of the two scores.
- L2Record the scores against the element.
- L3Define both scales, including what distinguishes adjacent points, before any element is scored.
- L3Derive criticality from the mission the element serves, obtained from the mission owner rather than assigned by the security function.
- L3Derive exposure from reachability on permitted paths, not from network location alone.
- L3Calibrate by scoring a reference set collectively and reconciling divergence before scoring at scale.
- L3Re-score on mission change, on architectural change, and at cadence regardless of either.
- L4Measure inter-assessor variance on the calibration set and set a threshold above which the scale is not fit for trend use.
- L5Re-base the scales from observed incident consequence, so criticality reflects what loss actually cost rather than what it was assumed to cost.
Measurement
Share of total defensive weight held by designated key terrain.
Inter-assessor variance on the calibration set.
Evidence and Assessment
Asset Register weight column; total defensive weight in the Brief; calibration record.
Examine the weighting scale definition; interview owners on two high-weight and two low-weight assets to confirm consistent application.
Related Guidance
- RA-2
- RA-3
- ID.AM-05
- ID.RA-05
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M2Defense in DepthEnsure no single failure is decisive.1 of 18 techniques — M2.09
Terrain It Is Named On
Applies to all ten layersSets criticality and exposure per asset, which is the allocation driver every coverage and residual-risk number on the layer is weighted by.
Artifacts It Stands On
- producesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
- producesBill of DefensePer mission service: the maneuvers and assets protecting it, its rolled-up coverage, and its residual risk. The view that lets a mission owner see their own defense rather than the enterprise average.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsiblePlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- ConsultedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- ConsultedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.
- InformedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- InformedHunt teamCounterattack. Works the hypotheses that Fuse raises.