Skip to content
cairnenclaveIL5 and below · National security
Menu
HomeMethodWorkbench

How the kit thinks

Four lenses on one map. Scores locate. The AO decides.

This is the logic the workbench runs — the same research these vignettes are drawn from. Invariance is the trust argument. A map that changes per engagement is an opinion. Your evidence becomes confirmed markers on lanes that already exist.

One road

Standards. Mission / ATO. OEM practice. Peer North Stars.

Four lenses. Do not invent a fifth.
standardsDoD standardsPrescriptive gates: Cloud SRG, FedRAMP High on the IL5 path, IL, SCCA, CUI, NSS, RMF, OSCAL. Minimums, not a shopping list.
requirementsMission / ATO requirementsWhat occupancy actually requires: named AO, inheritance, IATT then ATO, residual controls still yours.
practiceProvider practiceOEM well-architected (AWS, Azure, Google, Oracle) for GovCloud tenancy, identity, reliability, ops. Guidance, not an ATO.
peersPeer North StarsPast performance. Programs that already walked this road. Proof the pattern exists — not a mandate to join them.
One base map with three overlays drawn on top of itA base plate showing the researched road, with three translucent planes stacked above it: your current position, the transformation workstreams, and day-two operations.Base · the known roadResearched lanes. Does not change per client.Overlay 1 · Current positionConfirmed markers. Derived, never asserted.Overlay 2 · Transformation workstreamsBuild · contract · acquire · joinOverlay 3 · Day-two operationsShared and mission services. Who runs it, and whose it is.

Base established first. Each overlay is drawn on the same map — not a new assessment.

The map

Ten domains. Fifty-one artifacts. Fifty-three streams. Twenty-three launch at M0.

Ten domains. Fifty-one artifacts. The map does not change per client.
mandatoryGovernanceWho, by name, can accept residual risk for this mission — and have they been in the room?Peer: Army ECMA / cARMY inheritable common services across IL2/4/5.
mandatoryPlatformIs the landing zone inheritable at the impact level you actually need, or is it a drawing?Peer: Army ECMA / cARMY (AWS+Azure, 31 CSS); DAF Cloud One / C1N for multi-CSP hosting. DISA Thunderdome for the access plane — not the LZ.
mandatoryOperationsWho sees drift at 2 a.m., and does that signal ever reach the AO's risk picture?Peer: Flank Speed Zero Trust operations; Platform One telemetry as evidence.
practiceService mgmtCan change keep up with pipeline speed, or will CAB become the place modernization goes to die?Peer: Platform One change evidence via pipeline, not a weekly CAB packet.
mandatoryDevSecOpsDoes a release produce authorization evidence, or does someone assemble a package after the fact?Peer: Platform One / Iron Bank; Navy Black Pearl (Lighthouse + Party Barge).
mandatoryAuthorizationWhat evidence would you hand an AO this week that is current, attributable, and not a reconstructed binder?Peer: DoD CISO Feb 2022 cATO memo; Platform One continuous-delivery ATO practice; Black Pearl Navy ATO.
mandatoryInheritanceWhich controls does the platform actually give you — and which ones are still yours on the day of the ATO?Peer: Navy Black Pearl inherited platform ATO (RAISE pattern); ECMA common services. Thunderdome ICAM/SASE as access-plane common controls — residual still named.
mandatoryApplicationsIf a workload went dark tonight, could you name what else dies with it?Peer: DoD Zero Trust treats live dependency visibility as a prerequisite, not a byproduct.
mandatoryMigrationIf wave one fails on a Friday, is rollback a tested action or a slide?Peer: Wave-entry criteria as authorization and recovery evidence, not a slide of dates.
practiceFinOpsCan you actually order the IL you scored — this fiscal year — on a vehicle that can pay a consumption bill?Peer: Army CAMO / CloudTracker consumption analytics.

What a number means

0 is the floor. 4 is evidence quality. Neither is an ATO.

Scores locate. They are not a grade, a phase gate, or an authorization.
  1. 0ReactiveEstablish the floor.
  2. 1–2Inconsistent / DefinedAdvance toward the North Star.
  3. 3ConsistentAutomate and reuse evidence.
  4. 4AutomatedLeverage — cATO-quality evidence, not an ATO.

Not this

Evidence informs. Named individuals with authority decide.

  • Not an ATOEvidence informs. Named individuals with authority decide.
  • Not a shopping listPeers prove the pattern exists. They are not a mandate to join them.
  • Not a new map per clientA map that changes per engagement is an opinion.
  • Not a fifth lensStandards, mission/ATO, OEM practice, peer North Stars. Stop.

JSON plus the consultant is the product. Ollama on loopback is a second set of eyes. The kit does not certify compliance or replace an Authorizing Official.

Open the workbenchAll vignettesThe forkSponsor briefing