ASOM-Fedv6.1Open the explorer
WF-1 · Workforce Terrain

Workforce Terrain Identification

Control Statement

The organization shall identify on the terrain overlay the roles whose compromise would materially advance an adversary, and record the population holding each.

Purpose. To make the workforce positional, so that defensive effort concentrates on the roles an adversary would actually target.

Discussion

Identifying roles rather than individuals is what makes this terrain defensible without becoming personnel monitoring. A role is a standing property of the estate; the people in it change, and defending the role survives that change. Population size is the second half of the picture and is routinely omitted: a privileged role held by three named engineers can be defended by measures that are absurd for a role held by four hundred caseworkers, and a program that records only the role list will apply the wrong move to one or the other.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

High-consequence roles are identified with their populations.
  • Number of identified roles and the population holding each
  • Proportion of identified roles with a named accountable owner

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

AOCTISOCHUNTPLATISSO
Authorizing Official / CISO: AccountableCyber Threat Intelligence cell: ConsultedSOC / Defensive Operations: InformedHunt team: InformedPlatform and product owners: ResponsibleGovernance / RMF / ISSO: Consulted

AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO

  • AccountableAuthorizing Official / CISO
  • ConsultedCyber Threat Intelligence cell
  • InformedSOC / Defensive Operations
  • InformedHunt team
  • ResponsiblePlatform and product owners
  • ConsultedGovernance / RMF / ISSO

Inputs and Outputs

Consumes

Produces

Activities

  1. L2Mark on the terrain overlay the roles whose compromise would materially advance an adversary.
  2. L2Record the population currently holding each marked role.
  3. L2Flag privileged roles that are unmarked.
  4. L3Define the marking criterion in terms of what an adversary gains, not in terms of seniority or job title.
  5. L3Include roles whose access is indirect — helpdesk, delegated administration, approval authorities, and contractor roles with equivalent reach.
  6. L3Record the accountable owner for each marked role, reconciled against terrain ownership (TM-7).
  7. L3Justify the exclusion of privileged roles that were considered and not marked, so the boundary is a recorded judgment.
  8. L4Trend population size per marked role; growth in a high-value role's population is an expansion of terrain that no asset inventory will report.
  9. L4Measure the interval between a role's creation or reclassification and its appearance on the overlay.
  10. L5Re-derive the marking criterion from roles actually targeted in engagements and in sector reporting, rather than from assumed adversary preference.

Measurement

Outcome

Percentage of privileged roles marked or explicitly excluded with justification.

Performance

Trend in population size across marked high-value roles.

Evidence and Assessment

Evidence expected

Workforce terrain section of the Brief; role-to-population record; exclusion justifications; ownership record.

Assessment procedure

Examine the marked roles against the privileged-access record; interview the accountable owner on why unmarked roles were excluded; test whether indirect-access roles were considered.

Related Guidance

Inherits
  • AT-2
  • PS-2
  • PM-12
Satisfies
  • GV.RR-04
  • ID.AM-03

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Fed By

Nothing upstream — this control starts a chain.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.

Forms of Maneuver It Assesses

  • M1Screen / GuardGain early warning and buy reaction time before the adversary touches key terrain.1 of 15 techniques — M1.12
  • M11ReconstitutionRestore the mission on evidence, not on hope — and prove it before you need it.1 of 11 techniques — M11.08

Terrain It Is Named On

  • T7WorkforceWorkforce terrain identification is the control that puts this population on the overlay at all.

Artifacts It Stands On

  • producesWorkforce terrain registerThe roles whose compromise is equivalent to compromising a decisive point — the operators of decisive points, and the roles with standing access to them.
  • consumesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
  • consumesDecisive point registerThe elements whose control confers decisive advantage — each carrying the evidence that raised it above merely important, and the protection floor it owes as a result.

Roles It Puts to Work