Control Statement
Every element shall have a named accountable owner recorded against it.
Purpose. To attach every element to a person who can be asked to act, so that findings convert into work rather than accumulating.
Discussion
Ownership is what converts a finding into work. An unowned element cannot be remediated, re-scored or defended, because there is nobody the requirement attaches to. The acceptance requirement distinguishes this control from an org chart lookup: ownership assigned silently is routinely discovered, at the worst moment, to have been news to its holder.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Number of unowned elements
- Number of elements whose recorded owner has left the organization
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Informed | SOC / Defensive Operations: Informed | Hunt team: Informed | Platform and product owners: Consulted | Governance / RMF / ISSO: Responsible |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- InformedCyber Threat Intelligence cell
- InformedSOC / Defensive Operations
- InformedHunt team
- ConsultedPlatform and product owners
- ResponsibleGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- TM-1 Terrain Inventory and OverlayElement list requiring ownership
- WF-5 Separation and Revocation TempoSeparation events invalidating a recorded owner
- WF-2 Privileged Human RegisterOwnership verification for terrain elements
Produces
- CG-4 Findings DispositionOwnership routing for findings disposition
- KT-5 Barrier SufficiencyNamed owner for each barrier requiring enforcement
Activities
- L2Record a named individual — not a team, distribution list or vacant post — as accountable for each element.
- L2Flag unowned elements automatically.
- L2Raise a finding for each unowned element.
- L3Obtain explicit acceptance of accountability from each named owner rather than assigning it silently.
- L3Confirm owners hold the authority and budget to act on findings against their elements, and escalate where they do not.
- L3Reconcile ownership against the personnel record each cycle so departures surface as unowned elements.
- L3Define the interim owner for an element whose owner has departed, so accountability never falls to nobody.
- L4Trend ownership gap duration and set a disposition period beyond which gaps escalate.
- L4Measure remediation velocity per owner, since an owner with no closures is a different problem from an element with no owner.
- L5Adjust ownership assignment where velocity data shows accountability sitting persistently away from the authority to act.
Measurement
Percentage of elements with an accepted named owner.
Median duration of an ownership gap.
Evidence and Assessment
Asset Register owner column; open findings list; acceptance record.
Examine the register for unowned elements; interview a sample of named owners to confirm they accept accountability.
Related Guidance
- CM-8(4)
- PM-5
- GV.RR-02
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M1Screen / GuardGain early warning and buy reaction time before the adversary touches key terrain.2 of 15 techniques — M1.02, M1.09
- M3EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy.1 of 20 techniques — M3.06
- M8Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open.1 of 17 techniques — M8.17
Terrain It Is Named On
Applies to all ten layersNames an owner for the ground, so a coverage gap has somebody to be assigned to.
Artifacts It Stands On
- producesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
- consumesSeparation and revocation recordHow long it takes to remove everything an individual holds, per system, and which systems cannot be revoked in a single action. Feeds terrain ownership so revocation does not orphan an element.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsibleGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.
- ConsultedPlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.
- InformedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- InformedSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- InformedHunt teamCounterattack. Works the hypotheses that Fuse raises.