Control Statement
Trust zones shall be defined with explicit boundaries, and every element shall reside within a declared zone.
Purpose. To establish boundaries that something enforces, so that reachability and denied-path analysis rest on configuration rather than on design intent.
Discussion
A zone that exists only on a diagram is a description of intent. Everything downstream — KT-3 avenues, KT-4 reachability, M4 canalization — computes over zone boundaries, so an unenforced zone does not merely fail to protect: it produces confident false negatives in the analysis that depends on it.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Number of elements outside any zone
- Number of zones whose boundary is not technically enforced
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Informed | SOC / Defensive Operations: Consulted | Hunt team: Informed | Platform and product owners: Responsible | Governance / RMF / ISSO: Informed |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- InformedCyber Threat Intelligence cell
- ConsultedSOC / Defensive Operations
- InformedHunt team
- ResponsiblePlatform and product owners
- InformedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- TM-1 Terrain Inventory and OverlayOverlay elements requiring containment
- Outside the frameworkSegmentation, trust-zone and network boundary configuration
Produces
- TM-5 Connection and Denied-Path RegisterZone boundaries against which permitted and denied paths are recorded
- KT-3 Avenue of Approach AnalysisBoundary set an avenue of approach must cross
- FC-2 Physical Zone BoundaryLogical zones to be reconciled against physical zone boundaries
- RC-2 Isolated Recovery CapabilityTrust zone boundaries defining what production credentials can reach
- FO-2 Controlled Unclassified Information HandlingTrust zone boundaries
Activities
- L2Draw zones on the overlay and place every element inside one.
- L2Raise a finding for any element sitting outside every declared zone.
- L2Identify, for each zone, the mechanism intended to enforce its boundary.
- L3Define each zone by the trust assumption that holds inside it, and state what must be true for an element to belong.
- L3Name the owner of each enforcing mechanism.
- L3Test a sample of boundaries against enforcing configuration each cycle rather than accepting the design.
- L3Record zones enforced by convention rather than configuration, and treat each as an open finding.
- L3Review zone membership when an element changes function or hosting.
- L4Trend boundary test pass rate and the count of convention-enforced zones, driving the latter toward zero.
- L5Revise zone design where repeated membership exceptions show the boundary is drawn in the wrong place.
Measurement
Percentage of elements inside a declared zone.
Boundary sample test pass rate.
Evidence and Assessment
Terrain overlay showing zone membership; boundary enforcement record.
Examine the overlay for elements outside declared zones; test boundary enforcement against network configuration.
Related Guidance
- SC-7
- AC-4
- PR.IR-01
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Fed By
Nothing upstream — this control starts a chain.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M4Obstacle / CanalizationForce the adversary onto ground you own and watch.3 of 17 techniques — M4.01, M4.07, M4.13
- M2Defense in DepthEnsure no single failure is decisive.2 of 18 techniques — M2.01, M2.02
- M8Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open.1 of 17 techniques — M8.06
Terrain It Is Named On
- T1IdentityThe identity plane is its own trust zone. If it is not defined as one, its administrative path inherits whatever zone it happens to sit in.
- T3NetworksTrust-zone definition is the control that turns a network diagram into terrain with declared boundaries.
- T8FacilitiesTrust-zone definition is the control physical zones are aligned to; misalignment between the two is the finding.
Artifacts It Stands On
- producesTrust zones and the connection registerThe zone boundaries and the permitted- and denied-path register — the graph reachability is actually walked over, reconciled against observed flow telemetry rather than against intended configuration.
- consumesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsiblePlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- ConsultedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- InformedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- InformedHunt teamCounterattack. Works the hypotheses that Fuse raises.
- InformedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.