Control Statement
The terrain overlay shall be refreshed at a defined cadence and upon any material architectural change.
Purpose. To keep the overlay current against both the clock and the change, so that planning is conducted against ground as it currently is.
Discussion
A stale overlay is more dangerous than no overlay, because it is trusted. Currency has two triggers, and a program honoring only the cadence will plan from a map that a deployment invalidated the week after it was drawn. Wiring the change trigger into change management is what stops the second trigger depending on someone remembering.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Age of the overlay against its declared refresh interval
- Number of material architectural changes that did not trigger a refresh
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Informed | SOC / Defensive Operations: Informed | Hunt team: Informed | Platform and product owners: Responsible | Governance / RMF / ISSO: Consulted |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- InformedCyber Threat Intelligence cell
- InformedSOC / Defensive Operations
- InformedHunt team
- ResponsiblePlatform and product owners
- ConsultedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- CE-1 Cycle CadenceCycle cadence establishing the baseline refresh interval
- Outside the frameworkChange management records identifying material architectural change
- LC-4 Update Integrity and StagingUpdate deployment as a material change triggering terrain refresh
- DV-5 Device Lifecycle and SanitizationRetirement events that keep the terrain overlay current
Produces
- TM-1 Terrain Inventory and OverlayRefresh trigger requiring the overlay to be rebuilt or amended
Activities
- L2Refresh the overlay at a stated interval.
- L2Record each refresh with its date and trigger.
- L2Retain superseded overlays rather than overwriting them.
- L3Define the refresh cadence and the rationale for its interval.
- L3Define what counts as a material architectural change, specifically enough for a change board to apply without judgment calls.
- L3Wire the change-triggered refresh into the change management process so it fires without depending on memory.
- L3Record a lapse in cadence as a finding with justification rather than allowing silent slippage.
- L4Trend overlay age at time of use and the elapsed time from material change to refresh.
- L4Measure drift per cycle as the delta between successive overlays, and escalate where drift exceeds the interval's assumption.
- L5Adjust the cadence from measured drift, shortening it where the estate moves faster than the interval assumed.
Measurement
Percentage of cycles meeting the defined cadence.
Median elapsed time from material change to overlay refresh.
Evidence and Assessment
Cycle history with dates; snapshot series; change-trigger record.
Examine cycle dates against the defined cadence; interview on the change-triggered refresh process; test that a recent material change produced a refresh.
Related Guidance
- CM-8(1)
- CA-7
- ID.AM-08
- ID.IM-03
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M1Screen / GuardGain early warning and buy reaction time before the adversary touches key terrain.5 of 15 techniques — M1.01, M1.02, M1.12, M1.14, M1.15
- M2Defense in DepthEnsure no single failure is decisive.2 of 18 techniques — M2.05, M2.11
- M3EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy.1 of 20 techniques — M3.08
- M10Exploitation & PursuitConvert contact into durable advantage rather than closing the ticket.1 of 7 techniques — M10.03
Terrain It Is Named On
Applies to all ten layersAges the overlay. A layer’s coverage figure inherits the staleness of the inventory it was computed from.
Artifacts It Stands On
- producesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
- producesChange recordEvery defensive action carried out, stamped twice — at the decision and at the effect. A thin, unglamorous table, and the one the headline metric is computed from.
- consumesCycle cadence and calendarThe declared length of a cycle, its close date, and the refresh intervals that inherit from it. Makes “per cycle” a measurable unit rather than a figure of speech.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsiblePlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- ConsultedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.
- InformedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- InformedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- InformedHunt teamCounterattack. Works the hypotheses that Fuse raises.