Prologue / IoPE
The pre-existing condition and the execution authority it supplied.
ATTACK STORIES · THREAT-INFORMED DEFENSE
From adversary behavior to protection capability.
ATT&CK describes how adversaries operate. The Prologue reveals the authority-supplying conditions that make those behaviors possible. NIST SP 800-53 identifies where defenders can prevent, constrain, detect, or deny the conversion.
Research lineage
Built on an established threat-informed foundation.
The MITRE Center for Threat-Informed Defense Mappings Explorer connects security controls and capabilities to adversary behavior in MITRE ATT&CK®. Attack Stories extend that bridge upstream to determine whether those controls reach the Prologue.
ATT&CK behavior
The behavior that consumed, inherited, enabled, or propagated the condition.
NIST SP 800-53
The protection capability tested against the condition—not accepted by association alone.
Disruption point
Where defenders can govern, prevent, constrain, detect, or deny conversion.
“Taking a threat-informed defense approach that connects defender intelligence to protection capabilities codified the notion of building security in.”
Federal Cyber Defense Specialist
“Privilege management is no longer merely an administrative IT control. It is a construct for cyber defense, as these mappings demonstrate and as the prevalence of privilege across cyberattacks in the wild makes clear.”
Kevin E. Greene
Primary references: CTID Mappings Explorer · MITRE ATT&CK · NIST SP 800-53 Rev. 5
Eleven-story coverage register
Every published story is visible. Mapping status remains evidence-bound.
The collection contains eleven stories. Five have validated Prologue → ATT&CK → NIST relationships. The remaining six stay visible with their exact version or evidence boundary instead of disappearing from the mapping surface or receiving manufactured mappings.
Validated mappingVersion boundaryNot mapped / outside corpus
Validated five-case assessment
Alignment is strong—but not uniform.
Scores reflect how well the validated R2.3 mapping model reaches each story’s Prologue. They do not measure compliance or claim that a control was implemented. This five-story corpus uses ATT&CK v16.1. CP-005 is not silently back-mapped because its CISA source uses ATT&CK v19. CP-007–009 remain outside this mapping corpus; CP-010 and CP-011 retain source-record NOT MAPPED values. R2.6 does not manufacture mappings.
Cross-story control heat map
Which protection capabilities recur?
Cells count admitted Prologue conditions with a retained control relationship. Frequency is not importance, implementation, or compliance.
IoPE → ATT&CK → NIST