Skip to main content

6. Phasing Outline

Intent

Phasing converts the plan into controlled execution by organizing TOs and TTs into deliberate phases, aligning LOEs, sequencing dependencies, and exposing manpower requirements.

Phasing is where planning LOEs integrate their outputs into a synchronized execution model.

6.1. Define Execution Phases​

Purpose

Execution phases organize TOs and TTs into logical segments that:

  • Sequence tasks in the correct order
  • Allocate personnel efficiently
  • Prevent resource conflicts
  • Enable parallel execution where possible
  • Ensure actions occur at the right time

Phasing ensures the right tasks are executed by the right personnel under the right conditions.

Each phase must:

  • Have a clearly defined Purpose
  • Directly support one or more TO conditions
  • Identify which LOEs have TTs executing during the phase
  • Define phase activation trigger(s)
  • Define measurable phase exit criteria (condition for phase end)

NOTE: Phases segment execution for control and prioritization. They do not automatically terminate LOEs or TTs.

Example
## EXECUTION PHASES
- DEPLOYMENT: Deploy CVA/H on the approved terrain
- BASELINE: Define normal system and network behavior
- HUNT: Analyze for presence or absence of MCA activity
- CLEAR: Remove confirmed MCA presence
- ASSESS: Validate adversary removal and residual risk
- HARDEN: Implement mitigations to strengthen controls
- BACKOUT: Remove CPT-installed tooling and system configurations
- REPORTING: Deliver mission updates and outcomes

6.2. Identify Phase Triggers​

Purpose

Each phase must define exactly when it begins and under what condition it transitions.

Every phase requires a trigger. Triggers may be:

Time-Based

  • Use time-based triggers when execution authority is tied to a fixed window
  • Examples:
    • STARTEX
    • Specific Zulu time
    • Start of maintenance window
    • End of approved operational window

Event-Based

  • Event-driven triggers are preferred when execution depends on conditions
  • Examples:
    • MCA Identified
    • Host access granted
    • Sensor data validated
    • Assumption invalidated
    • ATC approval received
    • MRT-C impact detected

For each phase, document:

  • Primary Trigger
  • Secondary Trigger (if required)
  • Exit Criteria (when the phase is considered done/complete)
  • Decision Authority (if phase transition requires approval)

NOTE: Decision Authority defines who authorizes phase transition when exit criteria are met or waived.

Example
## EXECUTION PHASES

### DEPLOYMENT
Deploy CVA/H on the approved terrain
- PRIMARY TRIGGER: STARTEX
- SECONDARY TRIGGER: ATC approval received  
- EXIT CRITERIA: Sensors operational and data flow validated  
- DECISION AUTHORITY: Mission Commander

### BASELINE
Define normal system and network behavior
- PRIMARY TRIGGER: Deployment complete  
- SECONDARY TRIGGER: Stable telemetry confirmed  
- EXIT CRITERIA: Required baseline data collected and reconciled  
- DECISION AUTHORITY: Mission Element Lead

### HUNT
Analyze for presence or absence of MCA activity
- PRIMARY TRIGGER: Baseline complete  
- SECONDARY TRIGGER: Intel reprioritization  
- EXIT CRITERIA: All priority hypotheses executed and adjudicated  
- DECISION AUTHORITY: Mission Element Lead

### CLEAR
Remove confirmed MCA presence
- PRIMARY TRIGGER: MCA identified  
- SECONDARY TRIGGER: Remediation authorization granted  
- EXIT CRITERIA: Persistence removed and risk within ALR  
- DECISION AUTHORITY: Mission Element Lead

6.3. Define Execution LOEs​

Purpose

Execution LOEs organize TTs into functional groupings that can operate in parallel while maintaining accountability.

LOEs are functional groupings of personnel. They may operate across multiple phases, and their assigned TTs may span phase boundaries.

Execution LOEs:

  • May execute across one or more phases
  • Have a single accountable lead
  • Contain clearly assigned personnel
  • Own defined TTs
  • Identify cross-LOE dependencies

NOTE: LOEs may change by phase. For example, an LOE active in Baselining may disband to form a Hunt LOE.

Example
## EXECUTION LOES
- DEPLOYMENT LOE: Execute CVA/H Deployment Plan
- HOST AGENT LOE: Deploy and validate host-based sensors  
- BASELINING LOE: Execute Data Collection Plan and establish normal system and network behavior  
- HUNT LOE: Execute Theat Hunt Plan and perform investigations  
- HARDENING LOE: Execute Risk Mitigation Plan and reduce attack surface
- REPORTING LOE: Produce required operational and risk reporting

6.4. Assign Tasks to LOEs​

Purpose

All TTs must be assigned to an execution LOE. If not assigned, it does not execute.

  1. Assign TTs to each execution LOE (who executes it)
  2. Identify the phase(s) during which each TT executes
  3. Confirm sequencing and dependencies across phase transitions
  4. Assess required crew positions per LOE required to execute assigned TTs
  5. Validate:
    • LOE/TT dependencies are resolved
    • Required upstream LOE/TT outputs exist
Example
DEPLOYMENT LOE: Deploys and configures CVA/H DIP and MIPs
- Assigned Personnel:
    - NT1
- Assigned Tasks:
    - TT-1.1: Deploy CVA/H DIP servers and network infrastructure
    - TT-1.2: Deploy CVA/H DIP sensors IAW Sensor Placement plan

HOST AGENT LOE: Deploys and configures CVA/H DIP and MIPs
- Assigned Personnel:
    - HA1
- Assigned Tasks:
    - TT-1.4: Deploy Winlogbeat IAW Host Agent Deployment plan
    - TT-1.5: Deploy Sysmon IAW Host Agent Deployment plan
    - TT-1.6: Deploy Endgame IAW Host Agent Deployment plan

BASELINE LOE: Performs initial data collection for baselining
- Assigned Personnel:
    - HA1, HA2
    - NA1, NA2
- Assigned Tasks:
    - TT-2.1: Execute network discovery scans IAW Data Collection plan
    - TT-2.2: Execute Metasponse collection jobs IAW Data Collection plan
    - TT-2.3: Execute vulnerability scans IAW Data Collection plan

HUNT LOE: Executes hunt plans
- Assigned Personnel:
    - HA1, HA2
    - NA1, NA2
- Assigned Tasks:
    - TT-4.1: Hunt for MCA persistence mechanisms
    - TT-4.3: Hunt for MCA execution evidence
    - TT-4.4: Hunt for MCA command & control evidence

6.5. Calculate MINFOR​

Purpose

Phasing must expose concurrent workload and confirm that execution is manpower-realistic.

MINFOR = Minimum personnel required to execute all concurrent LOEs within a phase.

For each phase:

  1. Identify all LOEs with TTs executing simultaneously
  2. List personnel roles and quantities assigned to each LOE
  3. Confirm:
    • No individual is double-tasked
    • Specialized roles are not overcommitted
    • Workload is realistic for the time window

If MINFOR exceeds available crew:

  • Re-sequence TTs
  • Collapse LOEs
  • Reduce scope
  • Extend timeline (if authorized)

6.6. Timeline Representation​

Purpose

Provide a visual representation of phasing to expose sequencing, concurrency, and trigger logic.

Timeline representation must show:

  • Phase sequencing
  • Phase triggers (time and event-based)
  • Parallel LOEs
  • Critical milestones (STARTMSN, STARTEX, ENDEX, ENDMSN)
  • Event-based markers (e.g., MCA Identified)
  • Hard stop points

Acceptable formats:

  • Mermaid Gantt
  • Slide diagram
  • Visio product
  • Integrated execution timeline

The timeline must align exactly with:

  • Phase definitions
  • LOE assignments
  • TT sequencing
  • MINFOR calculation
Example Timeline