Map Before You Maneuver.
A terrain overlay is not an asset register. A register says what you own; terrain says where it sits relative to a boundary and to everything else — because position is what determines how an adversary moves. Every other ASOM-Fed product is derived from this one artifact.
The Ten Terrain Layers
The high ground
CISA ZTMM pillarThe entry fords
CISA ZTMM pillarThe corridors
CISA ZTMM pillarThe urban terrain
CISA ZTMM pillarThe objective
CISA ZTMM pillarGround you cannot maneuver freely on
Added in v2.0Terrain that is also the force
Added in v3.0The physical boundary
Added in v3.0The lines of communication
Added in v3.0Spans every layer above
- Visibility & Analytics
- Automation & Orchestration
- Governance
Five Pillars Were Inherited. Four Had to Be Added.
Extending someone else’s taxonomy demands a reason for each addition, and the reason cannot be completeness for its own sake. Each of the four below was added because a measurable part of a real federal estate was being scored as though it were not there.
Operational Technology
Ground you cannot maneuver freely on. Scored separately because the moves available here are narrower and the consequence of loss is physical. Treating an OT estate as ordinary network terrain overstates the defender’s options.
Workforce
Terrain that is also the force. The only layer that is simultaneously the ground being defended and the force doing the defending. Insider risk and analyst saturation are the same measurement problem seen from two directions.
Facilities
The physical boundary. A federal estate with data centers, laboratories and public counters has physical ground that a purely logical model scores as though it were not there.
Supply Chain
The lines of communication. Doctrinally, an army’s lines of communication are terrain an enemy attacks precisely because they are not defended like the front. Software supply chain is the same idea with a different noun.
The five inherited pillars — Identity, Devices, Networks, Applications and Workloads, Data — keep the CISA Zero Trust Maturity Model’s names and boundaries exactly, so an agency already reporting maturity under OMB M-22-09 reports the same numbers here.
What Is Key Terrain, and Where It Is Decided.
Key terrain is what confers decisive advantage if you hold it. A decisive point is narrower and more useful: the place where seizing control unhinges the adversary’s plan. Most estates have only a handful, and naming them is the whole of prioritization.
In zero trust, whoever controls identity controls movement. Every other layer is downstream of this one, which is why it is almost always the main effort.
Key terrainThe ICAM policy decision point, privileged accounts, external-user and mission-staff identitiesDecisive pointThe conditional-access policy engine- Authentication (phishing-resistant MFA)
- Authorization / PDP
- Privileged Access (JIT/PAM)
- Identity Governance (ICAM)
Where an adversary crosses from outside to inside. Managed and unmanaged endpoints are not the same ground, and a framework that scores them together hides the crossing.
Key terrainMission-staff laptops, contractor devices, the server and VM fleetDecisive pointThe device-posture signal the policy engine trusts- Endpoint Protection (EDR)
- Device Compliance / Posture
- Mobile & BYOD
- Server / Workload Hardening
Movement corridors and the obstacles that canalize them. This is the layer where you decide which ground the adversary is allowed to walk on.
Key terrainTIC 3.0 access points, segment boundaries, cloud VPC peeringDecisive pointThe east-west boundary between the public tier and the mission tier- Perimeter / TIC 3.0
- Microsegmentation
- Egress & DNS Control
- WAF & DDoS
Dense, complex, and hard to clear — the layer where defenders lose track of what they own. It also holds the single most leveraged decisive point in a modern estate.
Key terrainThe public service portal, the case processing system, public APIsDecisive pointThe CI/CD pipeline — poisoning it envelops everything downstream- AppSec (SAST / DAST)
- API Security
- Pipeline Security (CI/CD)
- Runtime & Container
The reason the campaign exists. Every other layer is defended in order to hold this one, and a scheme that cannot say which records it is protecting is not a scheme.
Key terrainSensitive mission records, PII stores, fee and financial dataDecisive pointThe data-access governance boundary around the crown-jewel record set- Classification
- Encryption & Key Management
- DLP
- Data Access Governance
Scored separately because the moves available here are narrower and the consequence of loss is physical. Treating an OT estate as ordinary network terrain overstates the defender’s options.
Key terrainBuilding control systems, laboratory and facility instrumentation, engineering workstationsDecisive pointThe OT/IT boundary and the accounts permitted to cross it- OT Asset Inventory
- OT / IT Boundary
- Engineering Access
- Passive OT Monitoring
The only layer that is simultaneously the ground being defended and the force doing the defending. Insider risk and analyst saturation are the same measurement problem seen from two directions.
Key terrainPrivileged humans, the roles that can approve a change, the separation pipelineDecisive pointThe register of who holds privilege, and how fast it is revoked when they leave- Privileged Human Register
- Role-Based Readiness
- Insider Risk Position
- Separation Tempo
A federal estate with data centers, laboratories and public counters has physical ground that a purely logical model scores as though it were not there.
Key terrainData center and wiring closet boundaries, public-access areas, maintenance routesDecisive pointVendor and maintenance access to space holding production systems- Facility Inventory
- Physical Zone Boundary
- Maintenance Access
- Environmental Continuity
Doctrinally, an army’s lines of communication are terrain an enemy attacks precisely because they are not defended like the front. Software supply chain is the same idea with a different noun.
Key terrainSuppliers with production access, component provenance, the update path into the estateDecisive pointThe staging gate an untrusted update must pass before it reaches production- Supplier Register
- Component Provenance
- Access Constraint
- Update Staging
Not ground, but what makes maneuver on the other nine possible: reconnaissance, mobility, and command authority. Scored as enablers rather than as terrain with a coverage gap.
Key terrainThe telemetry pipeline, the orchestration layer, the rules of engagementDecisive pointWhich defensive fires are pre-authorized without escalation- Visibility & Analytics (ISR)
- Automation & Orchestration (mobility)
- Governance (command authority)
The Defense Tower Model.
Technology Business Management lets a CFO trace a dollar from a cost pool to the business unit that consumed it. The Defense Tower Model does the same for defensive coverage — and, more usefully, for the residual risk left over.
Asset Pools
Assets grouped by nature — identities, devices, network gear, applications, data stores, cloud. Each carries a defensive weight of criticality times exposure.
Defense Towers
The terrain layers as towers, each with control sub-towers scored by zero-trust maturity: traditional, initial, advanced, optimal.
Maneuver Solutions
Each form of maneuver consumes a defined set of towers. A scheme is a bundle of them serving one mission.
Mission Consumers
Each mission service receives a Bill of Defense: what protects it, its rolled-up coverage, and its residual risk — the direct analog of a Bill of IT.
Weight allocates upward the way cost drivers allocate spend, which means gaps surface the way cost overruns do in TBM: visibly, with a traceable path from the mission that is exposed back to the asset that exposes it. Defensive weight multiplied by coverage gap is a ranked remediation backlog — an answer to where the next control dollar goes.
Each Layer Has Its Own Reference Entry.
This page states what the ten layers are. Each entry below states what maturity means on that specific ground — a four-rung ladder per sub-tower, the weight and coverage arithmetic worked end to end, the controls that apply, and the forms of maneuver that consume it.
Identity
The high ground. Decisive point: The conditional-access policy engine.
T2 · 4 sub-towersDevices
The entry fords. Decisive point: The device-posture signal the policy engine trusts.
T3 · 4 sub-towersNetworks
The corridors. Decisive point: The east-west boundary between the public tier and the mission tier.
T4 · 4 sub-towersApplications and Workloads
The urban terrain. Decisive point: The CI/CD pipeline — poisoning it envelops everything downstream.
T5 · 4 sub-towersData
The objective. Decisive point: The data-access governance boundary around the crown-jewel record set.
T6 · 4 sub-towersOperational Technology
Ground you cannot maneuver freely on. Decisive point: The OT/IT boundary and the accounts permitted to cross it.
T7 · 4 sub-towersWorkforce
Terrain that is also the force. Decisive point: The register of who holds privilege, and how fast it is revoked when they leave.
T8 · 4 sub-towersFacilities
The physical boundary. Decisive point: Vendor and maintenance access to space holding production systems.
T9 · 4 sub-towersSupply Chain
The lines of communication. Decisive point: The staging gate an untrusted update must pass before it reaches production.
TX · 3 sub-towersCross-Cutting
The enablers of movement. Decisive point: Which defensive fires are pre-authorized without escalation.
A rebuilt studio is in beta at studio.threatdefendr.com. It keeps your diagram across a reload and exports it to a file; the published studio below still carries the brief, the image export and the control catalog.
New to this vocabulary? Terrain layer, tower and tier are different classes of thing, and swapping two of them produces work that looks correct and decides nothing. The object model states each one with the question it answers and the class it is most often mistaken for.
Terrain Is Only Half of It. the Other Half Is What You Do on It.
Eleven forms of defensive maneuver, each stated intent-first, each consuming a defined set of terrain, and each with an observable that says whether it worked.