---
type: "term"
title: "System-Risk Layer"
description: "The layer of the Cyber Bow Tie at which cluster steps are prevented, detected, and contained before a compromise matures into data level and business level consequences — the control placement layer around the System Risk Event (SRE), between the cause side (threat clusters 1– 10) and the consequence chain (DRE → BRE\\ )."
resource: "tlctc:term:system-risk-layer"
tags:
  - "glossary"
---
# System-Risk Layer

The layer of the Cyber Bow-Tie at which cluster steps are prevented, detected, and contained before a compromise matures into data-level and business-level consequences — the control-placement layer around the System Risk Event (SRE), between the cause side (threat clusters #1–#10) and the consequence chain (DRE → BRE\*). Its baseline concept is the **TLCTC × NIST CSF control matrix**: ten clusters crossed with six CSF functions yield **at minimum 60 distinct control objectives**; organization-specific refinements may subdivide cells but never merge them below the 10 × 6 grid. This fixed floor enables two strategic integrations. **Metrics:** every cell is a named objective to which Key Control Indicators attach — technical KCIs measure the cell's state and coverage, procedural KCIs (KPIs) its process performance — with targets derived from risk appetite. **Security architecture:** the umbrella-control column, read down all ten rows, defines the enterprise's shared security architecture and connects the matrix to secure development through the Programmer role, which sets the architectural frame and secure-coding standards under which the Coder implements.

The system-risk layer is a control-placement concept, not a taxonomy layer: it is distinct from the Strategic/Operational two-layer naming model (Axiom VIII) and does not alter any cluster definition or classification rule.

**Reference:** Application paper §8–§10, §15 (Part B/C)

See also: System Risk Event (SRE), Control Objective, Umbrella Controls, Local Controls, KCI (Key Control Indicator), Programmer