Module 05 covers Function FIVE, Adversary Management. Below: where the learner begins (what F04 and earlier produced), the work this module performs, and where the learner ends.

Module 05 hands-on objectives. Each row maps a LABS component to its KSAT type, (L)EARN to Knowledge, (A)PPLY to Skill, (B)UILD to Ability, (S)IMULATE to Task, so the exam at the end of the module assesses the same competencies the labs build.

Function Five elements the only forward-looking analytic category: AN-RES. Each entry is a protective capability, enumerated prospectively, against one of the four NIST 800-160 v2 goals, Anticipate, Withstand, Recover, Adapt. AN-RES uses TRE (not TOE or TDM) and bridges operational defense and future engineering.

Function Five elements the only forward-looking analytic category: AN-RES. Each entry is a protective capability, enumerated prospectively, against one of the four NIST 800-160 v2 goals, Anticipate, Withstand, Recover, Adapt. AN-RES uses TRE (not TOE or TDM) and bridges operational defense and future engineering.

Function FIVE attaches its work to the structural decomposition produced upstream, the AN-THR catalogue (F02), AN-ATT attack-path map (F03), and AN-DET coverage (F04). Every AN-RES you enumerate in this module attaches via TRE to one or more structural elements. Quick recap of the four structural layers and the analytic overlay.

▷ THE FIVE LAYERS

▷ LAYER ROLE

PCEPrimary Capability Environment

Where the platform physically operates. Five environments: Terrestrial, Aquatic, Aerial, Orbital, Deep Space.

SEGSegment

Self-contained piece with a specific operational role. Ten segments including Launch, Link, Ground, User, Space, Deep Space.

SVCService

The functional plane, how a segment controls things or moves data. Three services: Control Plane, Data Plane, Hybrid.

ASTAsset

Concrete things that make a service work. Six asset classes: Hardware, Firmware, Software, Data, Signal, Hybrid.

ANAnalytic (this module's home)

A separate overlay layer. Carries what defenders observe and build. Six categories, AN-RES is the one this module produces.

PCE SEG SVC AST AN

PAUSE

Same AN-RES two ways. The taxonomy element is the abstract category, written hyphenated as AN-RES. The enumerated element is one specific instance on your platform, written with all five fields plus a description, e.g. AN: RES: Resilience Measure: 00. Use the hyphenated form when you mean “any Resilience Measure”; use the full form when you mean “this exact Resilience Measure on our platform.”

Each AN-RES enumerated element points back at the platform via the TRE (Target of Resilience Enhancement) field. TRE names the structural element the measure protects (or removes from play). Without TRE, resilience measures are free-floating noise, the structural anchor is what makes the resilience measure actionable, queryable, and shareable.

▷ ATTACHMENT VIEW

▷ ATTACHMENT DETAIL

DEFINITION TRE = Target of Resilience Enhancement

Each AN-RES element carries a TRE field that lists the structural element(s) the resilience measure structural element the measure protects (or removes from play). Format: TRE: structural element references.

EXAMPLE Real-world TRE attachment

AN: RES: 00, Hardened Boot for LEO Ground Software: TRE: TRE: AST: SW: Software: 03. Every structural anchor is a real enumerated element on the platform, never a hypothetical, never a sample.

DISCIPLINE No TRE, no entry

An AN-RES with no TRE attachment is free-floating noise. Every entry must point at one or more real structural elements on your platform. This is the discipline that keeps the analytic catalogue queryable, correlatable, and shareable.

DEFN EX RULE

PAUSE

Per-element enumeration procedure. The walk is the same for every AN-RES; only the inputs and the structural anchors change. Sources: the AN-THR catalogue (F02), AN-ATT attack-path map (F03), and AN-DET coverage (F04).

A real-world resilience measure for an orbital constellation, end-to-end, the enumerated element, the TRE attachment, the sourcing, and how it hands off to the next function.

An enumerated AN-RES carries five core fields plus the TRE (Target of Resilience Enhancement) attachment that makes it actionable. Cycle through each below to see what the field holds, what a real value looks like, and where learners typically slip.

▷ AN-RES VIEW

▷ FIELD DETAIL

LAYERField 1 of 5

Fixed for every analytic-layer entry.

EXAMPLE VALUE

AN

ELEMENTField 2 of 5

Two-letter taxonomy code identifying the resilience sub-category.

EXAMPLE VALUE

RES

LABELField 3 of 5

Plain-English name for the RES code.

EXAMPLE VALUE

Resilience Measure

ORDINALField 4 of 5

Two-digit serial; first measure designed is 00.

EXAMPLE VALUE

00

DESCRIPTIONField 5 of 5

Free-text scoping with NIST 800-160 v2 goal mapping and the threats / paths it mitigates.

EXAMPLE VALUE

"Hardened-boot + measured-launch on ground software; goal: Withstand; mitigates AN: ATT: 00 + AN: ATT: 01 entry vectors."

TRETRE attachment (AN-specific)

TRE (Target of Resilience Enhancement), the structural element the measure protects or removes from play. Distinct from TOE / TDM.

EXAMPLE ATTACHMENT

TRE: AST: SW: Software: 03

LAYER ELEMENT LABEL ORDINAL DESC. TRE

PAUSE

Four worked AN-RES enumerations spanning different scenarios on the same LEO platform, nation-state, supply chain, RF, insider. Each one is real-world validated, structurally anchored via TRE, and traceable to its source.

▷ SCENARIO IMAGE

EXAMPLE 01 OF 04 Hardened Boot for Ground Software (Withstand)

Hardened-boot + measured-launch removes the recurring entry point used by phishing and supply-chain attack paths.

ENUMERATED ELEMENT

AN: RES: Resilience Measure: 00 TRE: AST: SW: Software: 03

Sourcing: Justified by AN: ATT: 00 + AN: ATT: 01 recurrence; tested 2026-Q2

EXAMPLE 02 OF 04 Hot-Standby Ground Station (Recover)

Failover to geographically-separate ground site within RTO; restores command-and-control under physical or cyber denial.

ENUMERATED ELEMENT

AN: RES: Resilience Measure: 01 TRE: SEG: GR: Ground: 00

Sourcing: Justified by AN: ATT: 03 + denial-of-service threat profile; tested 2026-Q2

EXAMPLE 03 OF 04 RF Anti-Jam Polarization Diversity (Withstand)

Polarization-diverse uplink protects mission commanding from narrowband jamming during contested overflight.

ENUMERATED ELEMENT

AN: RES: Resilience Measure: 02 TRE: AST: SI: Signal: 00

Sourcing: Justified by AN: ATT: 02 (RF jamming chain); engineering review 2026-Q3

EXAMPLE 04 OF 04 Adaptive Trust Re-evaluation (Adapt)

Continuous re-evaluation of operator trust scores during sessions; auto-revokes elevated rights on anomaly.

ENUMERATED ELEMENT

AN: RES: Resilience Measure: 03 TRE: SVC: CP: Control Plane: 00

Sourcing: Justified by AN: ATT: 03 (insider path); inspired by NIST 800-160 v2 Adapt patterns

EX 01 EX 02 EX 03 EX 04

PAUSE

Protective capability ensuring resistance or recovery from threats, for either immediate implementation or as feedback for future platform engineering efforts.