Reference framework · teaching model

The Sovereign cATO Reference Framework

A continuous Authority to Operate is a fixed lifecycle spine with plug-and-play parts. Swap the tools and the classification; the ten-stage spine holds. Explode it to see how every adapter docks into the frame and evidences itself in OSCAL.

Deployment topology

Classification

Identity / access

SIEM / telemetry

ITSM change & release

CI/CD + supply chain

Policy-as-code

spacer

The spine is constant.
The tools above are adapters.

Maturity phase 2 · Instrument

Explode

Constant spine Live / active flow Swappable adapter OSCAL evidence / continuous Drift / gap

Controls continuously evidenced 745 / 1,035

Evidence cadence weekly

ISM–OSCAL profile ISM PROTECTED profile

Essential Eight target ML2

Adapters emitting evidence 4 / 5

Authorisation state Ongoing authorisation

Gate posture (release control) fail on high CVE (staging)

Illustrative. Synthetic data. A concept model of a sovereign cATO reference framework, not a live system and not real agency figures.

Colour code: amber spine holds, teal adapters swap, blue is live flow, red is drift.