Maneuver doctrine, applied to federal network defense.

Why this exists

Federal cyber defense is well served at two levels and unserved between them. Above, maturity and outcome models — ZTMM, CSF 2.0 — say what should be true. Below, control catalogs — SP 800-53, with roughly 1,196 of them — say what must be present. Neither expresses the thing that decides an engagement: how a defence is arrayed, what it does first, what it gives up, and whether it can act faster than the adversary can adapt.

That gap is not theoretical. Doctrine on cyber manoeuvre argues persuasively that defenders should think in terms of terrain, position and tempo, and then stops short of stating anything an assessor could examine, interview against, or test. ASOM-Fed is the missing specification: the manoeuvre layer, written so it can be assessed and so performing it produces the evidence as a by-product.

We scored ten representative federal agency architectures — benefits administration, a regulator, a research laboratory, law enforcement, health services, a financial regulator, land management, a defense-adjacent civilian agency, a small independent agency, and a shared service provider — against the whole framework. Coverage is measured as ground held: the framework is 75 terrain×form cells, and an estate scores by how many it can actually operate on, not by how many technique rows a single tag happens to light up.

These are illustrative reference architectures, not audits of named agencies. The point is not the scores; it is that the questions are answerable at all, and that the answers are uncomfortable in the same places across very different agency shapes. An eleventh reference estate — the target state — holds all 75 cells and every one of the 150 techniques. It is an exemplar rather than an agency: no real federal estate looks like that, and it exists so a remediation plan has a destination instead of a slogan.

• Direct a defence, not just inventory one. State an intent, declare a campaign phase, designate a main effort, and have subordinate decisions follow from it without referral.
• Find what you cannot do — which is different from what you have not bought. Reading the matrix by column tells you which forms of manoeuvre your architecture cannot perform at any price.
• Earn the compliance rather than perform it. Every control cites the SP 800-53 controls it inherits from and the CSF 2.0 outcomes it supports, and produces its evidence by being done. The 60 controls now inherit from all twenty 800-53 families.
• Compare estates on the same map. A shared service provider and a research laboratory defend different ground; scoring both against one framework is what makes the difference legible.

It is not a replacement for SP 800-53 — it inherits from it and says so in every control. It is not a threat-intelligence source, it names no vendors, and nothing in it contemplates action outside an agency's own boundary. It is unclassified, agency-agnostic, free to use, free to extend, and built to be argued with.