FAIR-CAM

FAIR Controls Analytics Model (FAIR-CAM™) v1.0 — how controls affect risk, by function, with a unit of measurement for each.

FAIR Controls Analytics Model (FAIR-CAM™) Standard Artifact v1.0, ©2025 FAIR Institute — licensed CC BY-NC-ND 4.0. FAIR-CAM names, definitions, units and relationships are quoted unmodified. Licence · Current guidance: fairinstitute.org/FAIR-CAM · Standard v1.0 (PDF)

Two kinds of content on this page

quotedour curation

The domains, function names, definitions, units and relationships are the FAIR Institute’s, quoted unmodified and shown in indented blocks. Everything else is this site’s: the explanations headed “On this site”, and the classification of D3FEND countermeasures and ATT&CK mitigations into FAIR-CAM functions at the bottom. FAIR-CAM maps no D3FEND or ATT&CK identifier itself, and no open mapping exists, so that classification is our judgement, with a reason for every row.

Three ways controls affect risk

Loss Event Controls (LEC)
“By directly affecting the frequency or magnitude of loss (Loss Event Control functions)”
Variance Management Controls (VMC)
“By affecting the reliability of controls (Variance Management Control functions)”
Decision Support Controls (DSC)
“By affecting decisions (Decision Support Control functions)”

Loss Event Control functions

“Loss Event Detection and Loss Event Response have a Boolean AND relationship to one another — i.e., both must exist in order to mitigate the effects of a loss event.” (§3)

Loss Event Prevention

Avoidance§3.1.1

“Reduce the frequency of contact between threat agents and the assets they could adversely affect.”

Unit“% reduction in contact frequency with threat agents”

Relationship“The Avoidance function has a Boolean OR relationship with the Deterrence and Resistance functions. In other words, if controls serving any of these functions are in place and operating as intended, the probability of a loss event occurring is reduced accordingly. If multiple controls serving any of these functions are in place and operating as intended, then the effect of these controls is cumulative.”

Deterrence§3.1.2

“Reduce the probability of potentially harmful actions after a threat agent has come into contact with an asset.”

Unit“% reduction in the probability that threat actors would choose to act in a way that could result in harm”

Relationship“The Deterrence function has a Boolean OR relationship with the Avoidance and Resistance functions. In other words, if controls serving any one of these functions are in place and operating as intended, the probability of a loss event occurring is reduced accordingly. If multiple controls serving any of these functions are in place and operating as intended, then the effect of these controls is cumulative.”

Resistance§3.1.3

“Reduce the likelihood that a threat agent’s action(s) will result in a loss event.”

Unit“% probability of resisting potentially harmful actions by threat actors”

Relationship“The Resistance function has a Boolean OR relationship with the Avoidance and Deterrence functions. In other words, if controls serving any one of these functions are in place and operating as intended, the probability of a loss event occurring is reduced accordingly. If multiple controls serving any of these functions are in place and operating as intended, then the effect of these controls is cumulative.”

Loss Event Detection

Visibility§3.2.1

“Provide evidence of activity that may be anomalous or illicit.”

Unit“% probability that the control provides access to the necessary information”

Relationship“The Visibility function has a Boolean AND relationship with the Monitoring and Recognition functions. In other words, if controls serving any of these functions are sufficiently deficient, detection won’t occur, and the organization cannot mount a timely response.”

Monitoring§3.2.2

“Review data provided by Visibility controls.”

Unit“Elapsed time between reviews”

Relationship“The Monitoring function has a Boolean AND relationship with the Visibility and Recognition functions. In other words, if controls serving any of these functions are sufficiently deficient, detection won’t occur, and the organization cannot mount a timely response.”

Recognition§3.2.3

“Enable differentiation of normal activity/conditions from abnormal activity/conditions that may indicate a loss event has occurred or is in progress.”

Unit“% probability that a loss event will be successfully differentiated from normal activities or conditions.”

Relationship“The Recognition function has a Boolean AND relationship with the Visibility and Monitoring functions. In other words, if controls serving any of these functions are sufficiently deficient, detection won’t occur, and the organization cannot mount a timely response.”

Loss Event Response

Event Termination§3.3.1

“Enable termination of threat agent activities that could continue to be harmful.”

Unit“The amount of time that expires between recognition that a loss event has occurred and the point at which control over the event has been achieved.”

Relationship“Event Termination has a “weak” Boolean AND relationship with Resilience and Loss Reduction. In other words, deficiencies in one of these sub-functions will diminish overall Response efficacy but won’t necessarily inhibit it entirely.”

Resilience§3.3.2

“Maintain or restore normal operations.”

Unit“The amount of time operating in a degraded mode.”

Relationship“Resilience has a “weak” Boolean AND relationship with Event Termination and Loss Reduction. In other words, deficiencies in one of these sub-functions will diminish overall Response efficacy but won’t necessarily inhibit it entirely.”

Loss Reduction§3.3.3

“Reduce the amount of realized losses from an event.”

Unit“Reduction of lost economic value (e.g., dollars, Euros, etc.).”

Relationship“Loss Reduction has a “weak” Boolean AND relationship with Event Termination and Resilience. In other words, deficiencies in one of these sub-functions will diminish overall Response efficacy but won’t necessarily inhibit it entirely.”

Variance Management Control functions

“Variance Identification and Variance Correction have a Boolean AND relationship to one another — i.e., both must exist in order to mitigate the effects of a loss event.” (§4)

Variance Prevention

Reduce Change Frequency§4.1.1

“Reduce the frequency of changes.”

Unit“Forecast or measured % reduction in the frequency of changes that could introduce variance”

Relationship“Reducing Change Frequency has a Boolean OR relationship with Reducing Variance Probability based on the fact that reducing either will reduce the frequency of variance.”

Reduce Variance Probability§4.1.2

“Reduce the probability that changes will result in control degradation or failure.”

Unit“Forecast or measured % reduction in variance”

Relationship“Reduce Variance Probability has a Boolean OR relationship with Reduce Change Frequency because variance can be independently reduced with either one.”

Variance Identification

Threat Intelligence§4.2.1

“Identify changes in the threat landscape that diminish the efficacy of controls.”

Unit“Elapsed time between changes in the threat landscape and awareness of those changes.”

Relationship“Threat Intelligence has a Boolean AND relationship with Variance Correction, given that you can’t account for changes in the threat landscape that you aren’t aware of.”

Control Monitoring§4.2.2

“Identify variance in control conditions.”

Unit“Elapsed time between changes in control conditions and the recognition of those changes.”

Relationship“Controls Monitoring has a Boolean AND relationship with Variance Correction, given that you can’t correct variant conditions that you aren’t aware of. Consequently, if either one is deficient, the duration of variant conditions will persist.”

Variance Correction

Treatment Selection and Prioritization§4.3.1

“Select and prioritize control variance corrections.”

Unit“Elapsed time from the identification of a variant condition until corrective actions begin.”

Relationship“Boolean AND with Implementation”

Implementation§4.3.2

“Correct variant conditions.”

Unit“Elapsed time from initiation of corrective actions until their completion.”

Relationship“Boolean AND with Treatment Selection and Prioritization”

Decision Support Control functions

“Misaligned Decision Identification and Misaligned Decision Correction have a Boolean AND relationship to one another — i.e., both must exist in order to mitigate the risk of poor decisions.” (§5)

Preventing Misaligned Decisions

Defined Expectations§5.1.1

“Clearly define expectations and/or objectives.”

Unit“The probability that clear expectations and objectives have been defined.”

Relationship“This has a Boolean AND relationship with the other DSC/Prevention control functions — i.e., even if the other functions are operating well, deficiencies in this function will increase the probability of misaligned decisions.”

Communication of Expectations§5.1.2

“Communicate expectations to responsible personnel.”

Unit“The probability that expectations and objectives have been clearly communicated to decision-makers.”

Provide Asset Data§5.1.3.1.1

“Provide data regarding the assets that are relevant to or affected by decisions.”

Unit“Probability that asset data used to support a decision is accurate.”

Provide Threat Data§5.1.3.1.2

“Provide data regarding relevant threats.”

Unit“Probability that threat data used to support a decision is accurate.”

Provide Controls Data§5.1.3.1.3

“Provide data regarding the condition of controls that are relevant to decisions.”

Unit“Probability that controls-related data used to support a decision is accurate.”

Analysis§5.1.3.2

“Synthesize asset, threat, and controls data and generate accurate results.”

Unit“Probability that an analysis model will generate accurate results provided that it has accurate data.”

Reporting§5.1.3.3

“Provide decision-makers with analysis results.”

Unit“Probability that useful analysis results are provided to decision-makers in time to support their decisions.”

Ensure Capability§5.1.4

“Ensure that the decision-maker has the necessary skills, authority, and resources to make decisions that are aligned with the organization’s expectations and objectives.”

Unit“The probability that responsible persons will have the skills and resources necessary to act in a manner that is aligned with expectations.”

Incentives§5.1.5

“Motivate personnel to make decisions that are aligned with the organization’s expectations and objectives.”

Unit“The probability that appropriate incentives are in place to encourage well-aligned decisions.”

Identifying Misaligned Decisions

Identifying Misaligned Decisions§5.2

“Enable the identification of decisions that were not aligned with the expectations and objectives of the organization.”

Unit“The amount of elapsed time from when a misaligned decision was made and its identification.”

Relationship“This has a Boolean AND relationship with the Defined Expectations function, which provides the baseline for comparing a current state versus a desired state.”

Correcting Misaligned Decisions

Correcting Misaligned Decisions§5.3

“Correct the causes and outcomes of misaligned decisions.”

Unit“The amount of elapsed time between when a misaligned decision was recognized and corrected.”

Relationship“Because this function is fulfilled by controls within other functions, it is wholly dependent upon those other functions.”

Operational effectiveness

“Capability, Coverage, and Reliability are the critical attributes for evaluating the Operational Effectiveness of controls (i.e., Control Maturity), particularly in the context of the FAIR Controls Analytics Model (FAIR-CAM).”

Capability
“A control’s inherent ability to perform its intended function in addressing specific aspects of risk.”
Coverage
“Measures the extent to which a control or set of controls applies to the assets, threats, or risk scenarios within the organization.”
Reliability
“Refers to the likelihood that a control will perform its intended function consistently and without failure when needed.”

“The formula below provides the percentage of time a control is in its intended state given VF and VD values (i.e., its “reliability”)”
Reliability = (1 − (VF/365))^VD · OpEff = IntEff * Reliability
“A binary control with a VF of once per year, and a VD of 36 days has an operational efficacy of roughly 91%.”
— An Overview of FAIR-CAM (FAIR Institute)

On this site

This site can say which candidate controls exist in public knowledge bases for a technique — never whether an organisation has them, how well they work, how much of the estate they cover, or how often they drift. Those are FAIR-CAM’s measurements, and they need your data. So the FAIR-CAM card on a technique’s 360 view, and the coverage panels on a threat profile or a group, show availability: for prevention, evidence (Visibility), recognition and response, whether at least one candidate exists. Where none exists the card says none found only if every source that could supply one is loaded for that ATT&CK domain; otherwise it says not covered by loaded sources — for example, Sigma rules are loaded for Enterprise only. Monitoring (time between reviews) is always yours to measure, and Deterrence and Loss Reduction are barely modelled by these sources, so neither counts as a gap. A parent technique includes its sub-techniques’ controls.

In FAIR-CAM’s own terms, a site like this one is itself a control: it provides threat data and controls data to decisions (Decision Support) and helps notice changes in the threat landscape (Variance Management: Threat Intelligence). See a technique’s 360 view, for example PowerShell (T1059.001).

Our classification of controls into FAIR-CAM functions

our curation

156 D3FEND countermeasures and 97 ATT&CK Enterprise and ICS mitigations, each assigned the FAIR-CAM functions it can serve, with the reason. Mobile and ATLAS mitigations are not classified yet. Not reviewed or endorsed by the FAIR Institute.

Avoidance 12 D3FEND · 12 mitigations

D3-DRARemoves the remote path entirely, so the threat never makes contact through it (Avoidance, §3.1.1).
D3-CFKeeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
D3-CQKeeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
D3-DNLOne-way link (data diode) — traffic from the outside physically cannot reach the protected side (Avoidance).
D3-DNSALKeeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
D3-DNSDLKeeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
D3-EFKeeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
D3-FRDDLKeeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
D3-ITFKeeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
D3-NTFKeeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
D3-RRIDKeeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
D3-DEA decoy environment both reveals the intruder and draws contact away from real assets. (also: Recognition)
M1021Keeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
M1030Segmentation keeps threats in outer zones from reaching inner assets — the Overview’s architectural defence-in-depth, which it names as Avoidance.
M1035Keeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
M1037Keeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
M1042Removing the feature removes the path — the threat has nothing to make contact with (Avoidance).
M0806Less wireless reach means fewer places a threat can make contact from (Avoidance).
M0807Keeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
M0921Keeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
M0930Segmentation keeps threats in outer zones from reaching inner assets — the Overview’s architectural defence-in-depth, which it names as Avoidance.
M0935Keeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
M0937Keeps the threat from reaching the asset at all, like the boundary filtering the Standard gives for Avoidance (§3.1.1).
M0942Removing the feature removes the path — the threat has nothing to make contact with (Avoidance).

Deterrence 0 D3FEND · 1 mitigations

M0809Withholding operational detail obscures what an asset is worth and how to attack it — the Standard lists "Obfuscation of asset value" under Deterrence (§3.1.2). (also: Resistance)

Resistance 50 D3FEND · 62 mitigations

D3-AAHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-ACHHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-BAHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-CBANHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-CDPHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-CEROLimits how long a stolen secret remains usable — the attempt with it fails (Resistance).
D3-CHHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-CPHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-CROLimits how long a stolen secret remains usable — the attempt with it fails (Resistance).
D3-CSRemoves credentials an intruder could harvest, so the attempt finds nothing to use (Resistance).
D3-DENCRHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-DLVHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-FEHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-HBWPHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-MANHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-MENCRHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-MFAHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-OTPHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-PRLimits how long a stolen secret remains usable — the attempt with it fails (Resistance).
D3-PSEPHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-PWAHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-RHPhysical hardening of electronics against radiation-induced faults (Resistance).
D3-SAORHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-SCPHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-SFCVHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-SPPHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-SUPatching is the Standard’s own example for Implementation (§4.3.2); the patched system is what then resists (§3.1.3). (also: Implementation)
D3-TBHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-TBAHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-TLHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-VIHardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
D3-ABPIConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-CMRewrites risky content (e.g. disarming active elements) so it is delivered but cannot act (Resistance).
D3-CTSConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-DTPConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-EALConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-EDLConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-FFVConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-HBPIConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-IOPRConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-KBPIConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-LFPConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-NRAMConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-OPRConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-OTFBlocks outbound connections such as command-and-control or exfiltration — the action is attempted and fails (Resistance).
D3-OVARConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-RFAMConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-SCFConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-UAPConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
D3-WSAMConstrains what an action can do once attempted — the attempt is made but fails (Resistance).
M1015Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1017Training gives people the skills to act as intended (Decision Support: Ensure Capability); a trained user is the Standard’s example of a human Resistance control (§3.1.3). (also: Ensure Capability)
M1018Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1022Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M1024Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M1025Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1026Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1027Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1028Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1031Intrusion prevention recognises malicious traffic and blocks it (Recognition, Resistance). (also: Recognition)
M1032Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1033Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M1034Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M1036Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1038Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M1039Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M1040Recognises malicious behaviour on the endpoint and blocks it (Recognition, Resistance). (also: Recognition)
M1041Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1043Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1044Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M1045Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1046Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1048Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M1049The Standard lists anti-malware under Visibility and its signatures under Recognition; it also blocks (Resistance). (also: Visibility, Recognition)
M1050Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1051Patching is the Standard’s own example for Implementation (§4.3.2); the patched system is what then resists (§3.1.3). (also: Implementation)
M1052Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1054Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1057Recognises sensitive data leaving and blocks it (Recognition, Resistance). (also: Recognition)
M0800Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0801Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0802Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0803Recognises sensitive data leaving and blocks it (Recognition, Resistance). (also: Recognition)
M0804Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0808Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0809Withholding operational detail obscures what an asset is worth and how to attack it — the Standard lists "Obfuscation of asset value" under Deterrence (§3.1.2). (also: Deterrence)
M0813Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0814Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0818Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M1061Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M0915Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0917Training gives people the skills to act as intended (Decision Support: Ensure Capability); a trained user is the Standard’s example of a human Resistance control (§3.1.3). (also: Ensure Capability)
M0918Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0922Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M0924Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M0926Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0927Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0928Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0931Intrusion prevention recognises malicious traffic and blocks it (Recognition, Resistance). (also: Recognition)
M0932Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0934Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M0936Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0938Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M0941Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0944Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M0945Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0946Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0948Constrains what an action can do once attempted — the attempt is made but fails (Resistance).
M0949The Standard lists anti-malware under Visibility and its signatures under Recognition; it also blocks (Resistance). (also: Visibility, Recognition)
M0950Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).
M0951Patching is the Standard’s own example for Implementation (§4.3.2); the patched system is what then resists (§3.1.3). (also: Implementation)
M0954Hardens the asset so a threat action is less likely to succeed (Resistance; §3.1.3 lists authentication, privilege restrictions and encryption).

Visibility 4 D3FEND · 5 mitigations

D3-EHBEndpoints report their state — it produces the evidence that recognition then reviews (Visibility, §3.2.1).
D3-FCExtracts files from traffic or storage — produces evidence and enables its analysis. (also: Recognition)
D3-FEMCMonitoring code inside firmware — captures activity no host agent sees, and flags deviations. (also: Recognition)
D3-VSCameras — the Standard’s own Visibility example (CCTV, §3.2.1).
M1020Decrypts traffic for inspection — evidence that would otherwise be unreadable (Visibility).
M1029Data and logs kept off-host survive deletion on the host — evidence remains (Visibility) and data can be restored (Resilience). (also: Resilience)
M1049The Standard lists anti-malware under Visibility and its signatures under Recognition; it also blocks (Resistance). (also: Resistance, Recognition)
M0920Decrypts traffic for inspection — evidence that would otherwise be unreadable (Visibility).
M0949The Standard lists anti-malware under Visibility and its signatures under Recognition; it also blocks (Resistance). (also: Resistance, Recognition)

Recognition 58 D3FEND · 7 mitigations

D3-AEMAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-ANAAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-APCAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-CAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-CAAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-CCSAScopes what a compromised credential reached — recognises the extent of the event and directs its termination. (also: Event Termination)
D3-CSPPAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-DAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-DAMAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-DNSTAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-DQSAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-EFAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-FAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-FBAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-FCExtracts files from traffic or storage — produces evidence and enables its analysis. (also: Visibility)
D3-FCAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-FEMCMonitoring code inside firmware — captures activity no host agent sees, and flags deviations. (also: Visibility)
D3-FIMAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-FVAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-HDAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-IAAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-IDAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-IPCTAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-ISVAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-LAMAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-MBTAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-NTCDAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-NTSAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-OMMAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-OPMAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-PCSVAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-PHDURAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-PLAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-PMADAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-PSAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-PSMDAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-RFUMAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-RPAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-RTAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-RTSDAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SBVAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SCAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SDMAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SFAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SFVAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SICAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SJAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SMRAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SRAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-SSCAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-UAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-UGLPAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-URAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-USICAAnalyses activity or artefacts to tell malicious from normal (Recognition; §3.2.3 lists signatures, baselines and checksums).
D3-DEA decoy environment both reveals the intruder and draws contact away from real assets. (also: Avoidance)
D3-DFDecoys produce a signal only an intruder triggers (Recognition).
D3-DNRDecoys produce a signal only an intruder triggers (Recognition).
D3-DUCDecoys produce a signal only an intruder triggers (Recognition).
M1031Intrusion prevention recognises malicious traffic and blocks it (Recognition, Resistance). (also: Resistance)
M1040Recognises malicious behaviour on the endpoint and blocks it (Recognition, Resistance). (also: Resistance)
M1049The Standard lists anti-malware under Visibility and its signatures under Recognition; it also blocks (Resistance). (also: Resistance, Visibility)
M1057Recognises sensitive data leaving and blocks it (Recognition, Resistance). (also: Resistance)
M0803Recognises sensitive data leaving and blocks it (Recognition, Resistance). (also: Resistance)
M0931Intrusion prevention recognises malicious traffic and blocks it (Recognition, Resistance). (also: Resistance)
M0949The Standard lists anti-malware under Visibility and its signatures under Recognition; it also blocks (Resistance). (also: Resistance, Visibility)

Event Termination 15 D3FEND · 0 mitigations

D3-CCSAScopes what a compromised credential reached — recognises the extent of the event and directs its termination. (also: Recognition)
D3-ALRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-ANCIRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-CRRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-DKERemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-DKFRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-DKPRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-ERRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-FEVRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-HRRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-HSRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-PSRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-PTRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-RKDRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).
D3-STRemoves the adversary’s foothold or access, ending the activity (Event Termination, §3.3.1).

Resilience 9 D3FEND · 7 mitigations

D3-RCReturns systems, data or access to normal operation (Resilience, §3.3.2).
D3-RDReturns systems, data or access to normal operation (Resilience, §3.3.2).
D3-REReturns systems, data or access to normal operation (Resilience, §3.3.2).
D3-RFReturns systems, data or access to normal operation (Resilience, §3.3.2).
D3-RICReturns systems, data or access to normal operation (Resilience, §3.3.2).
D3-RNAReturns systems, data or access to normal operation (Resilience, §3.3.2).
D3-RSReturns systems, data or access to normal operation (Resilience, §3.3.2).
D3-RUAAReturns systems, data or access to normal operation (Resilience, §3.3.2).
D3-ULAReturns systems, data or access to normal operation (Resilience, §3.3.2).
M1029Data and logs kept off-host survive deletion on the host — evidence remains (Visibility) and data can be restored (Resilience). (also: Visibility)
M1053Backups restore data after an event — the Standard’s Resilience example (§3.3.2).
M1060Keeps operations communicating when primary channels are compromised (Resilience).
M0810Keeps operations communicating when primary channels are compromised (Resilience).
M0811Redundant services keep the process running through a failure (Resilience).
M0815Watchdogs restart hung components to restore normal operation (Resilience).
M0953Backups restore data after an event — the Standard’s Resilience example (§3.3.2).

Loss Reduction 0 D3FEND · 2 mitigations

M0805Mechanical safety layers limit the physical damage when control is lost (Loss Reduction).
M0812Safety instrumented systems drive the process to a safe state, limiting the harm an event causes (Loss Reduction).

Reduce Variance Probability 0 D3FEND · 3 mitigations

M1013Guidance to developers lowers the chance that a change introduces a weakness (Variance Management: Reduce Variance Probability).
M0817Vetting suppliers lowers the chance that new components arrive weakened or compromised (Reduce Variance Probability).
M0913Guidance to developers lowers the chance that a change introduces a weakness (Variance Management: Reduce Variance Probability).

Threat Intelligence 0 D3FEND · 2 mitigations

M1019Tracks changes in the threat landscape (Variance Management: Threat Intelligence, §4.2.1) and supplies threat data to decisions (§5.1.3.1.2). (also: Provide Threat Data)
M0919Tracks changes in the threat landscape (Variance Management: Threat Intelligence, §4.2.1) and supplies threat data to decisions (§5.1.3.1.2). (also: Provide Threat Data)

Control Monitoring 4 D3FEND · 4 mitigations

D3-AVEFinds variant conditions such as vulnerable software or weak configuration (Variance Management: Control Monitoring).
D3-CIRecords configurations — asset data, and the baseline against which configuration drift (variance) is found. (also: Provide Asset Data)
D3-CIAInspects container images for vulnerable or misconfigured contents before they run (Control Monitoring).
D3-SYSVAFinds variant conditions such as vulnerable software or weak configuration (Variance Management: Control Monitoring).
M1016Finds variant conditions such as vulnerable software or weak configuration (Variance Management: Control Monitoring).
M1047Audits find controls that have drifted from their intended state (Variance Management: Control Monitoring, §4.2.2).
M0916Finds variant conditions such as vulnerable software or weak configuration (Variance Management: Control Monitoring).
M0947Audits find controls that have drifted from their intended state (Variance Management: Control Monitoring, §4.2.2).

Implementation 1 D3FEND · 2 mitigations

D3-SUPatching is the Standard’s own example for Implementation (§4.3.2); the patched system is what then resists (§3.1.3). (also: Resistance)
M1051Patching is the Standard’s own example for Implementation (§4.3.2); the patched system is what then resists (§3.1.3). (also: Resistance)
M0951Patching is the Standard’s own example for Implementation (§4.3.2); the patched system is what then resists (§3.1.3). (also: Resistance)

Provide Asset Data 7 D3FEND · 0 mitigations

D3-CIRecords configurations — asset data, and the baseline against which configuration drift (variance) is found. (also: Control Monitoring)
D3-DIAn inventory or map — it informs decisions about controls rather than stopping or detecting an event (Decision Support: Provide Asset Data).
D3-HCIAn inventory or map — it informs decisions about controls rather than stopping or detecting an event (Decision Support: Provide Asset Data).
D3-LLMAn inventory or map — it informs decisions about controls rather than stopping or detecting an event (Decision Support: Provide Asset Data).
D3-NNIAn inventory or map — it informs decisions about controls rather than stopping or detecting an event (Decision Support: Provide Asset Data).
D3-PLMAn inventory or map — it informs decisions about controls rather than stopping or detecting an event (Decision Support: Provide Asset Data).
D3-SWIAn inventory or map — it informs decisions about controls rather than stopping or detecting an event (Decision Support: Provide Asset Data).

Provide Threat Data 0 D3FEND · 2 mitigations

M1019Tracks changes in the threat landscape (Variance Management: Threat Intelligence, §4.2.1) and supplies threat data to decisions (§5.1.3.1.2). (also: Threat Intelligence)
M0919Tracks changes in the threat landscape (Variance Management: Threat Intelligence, §4.2.1) and supplies threat data to decisions (§5.1.3.1.2). (also: Threat Intelligence)

Provide Controls Data 2 D3FEND · 0 mitigations

D3-AMModels who can access what — data about the state of access controls (Decision Support: Provide Controls Data).
D3-NTPMMaps network traffic policy — data about the filtering controls in place (Provide Controls Data).

Ensure Capability 0 D3FEND · 2 mitigations

M1017Training gives people the skills to act as intended (Decision Support: Ensure Capability); a trained user is the Standard’s example of a human Resistance control (§3.1.3). (also: Resistance)
M0917Training gives people the skills to act as intended (Decision Support: Ensure Capability); a trained user is the Standard’s example of a human Resistance control (§3.1.3). (also: Resistance)

Source

Not affiliated with or endorsed by the FAIR Institute. FAIR-CAM™ is a trademark of the FAIR Institute. D3FEND™ and ATT&CK® are trademarks of The MITRE Corporation.