The FIR Framework
A systematic, measurable path from vulnerable to self-sustaining. Three resilience vectors. Six maturity levels. A days-of-supply modifier that rewards endurance. Built on proven methodology — enterprise transformation architecture applied to the one system that matters most: the infrastructure your community cannot survive without.
The Problem
Every emergency plan in America has a design assumption built into it: help arrives within 72 hours. FEMA deploys. The National Guard mobilizes. Mutual aid activates. Supplies flow from unaffected regions to affected regions. That assumption is valid for hurricanes, earthquakes, and ice storms — every disaster Americans have experienced in living memory.
It is catastrophically invalid for a Black Sky Event. In a BSE, there are no unaffected regions. The attack is against the grid itself — not a geography. Every community in the interconnected grid is affected simultaneously. On Day 4, the 72-hour plan has been executed, help has not arrived, and help is not coming. For the vast majority of American communities, there is nothing beyond that horizon. No plan. No supplies. No fallback.
The FIR Framework exists to close that gap.
Three Independent Resilience Vectors
Your community does not face one threat. It faces three categories of attack — each requiring different defenses, different expertise, and different funding. FIR scores each independently so that progress on one vector is real, measurable progress regardless of where the other two stand.
Cyber
Volt Typhoon is inside your utility’s control systems. CyberAv3ngers compromised water treatment PLCs using default passwords. Salt Typhoon accessed telecommunications metadata. The cyber vector scores your defenses against nation-state pre-positioned access: network segmentation, OT monitoring, credential management, incident response, and detection capability.
Physical
919+ documented physical attacks on the U.S. grid since 2010. The Metcalf sniper attack destroyed 17 transformers — never solved. Most substations are protected by chain-link fencing. The physical vector scores hardening against kinetic attack: ballistic protection, facility security, counter-UAS, surveillance, access control, and perimeter defense.
EMP / GMD
Russia is developing space-based EMP weapons. A Carrington-class geomagnetic storm has a 10–12% probability per decade. Both destroy the same target: large power transformers that take 18 months to replace. The EMP/GMD vector scores protection against electromagnetic environments: Faraday shielding, GIC blocking, surge protection, and hardened communications.
The Days-of-Supply Modifier
Each entity carries a single days-of-supply number representing its physical stockpile — water, food, fuel, medical supplies, treatment chemicals — that sustains operations without external resupply. Thirty days of stored water is thirty days whether the cause was a cyberattack, a rifle attack on transformers, or a geomagnetic storm. The stockpile supports all three vectors.
A community scored “Cyber Silver | Physical Bronze | EMP/GMD Bronze | 60-Day Supply” has early-stage hardening but two months of endurance. That endurance buys time — time to recover, adapt, and advance. FIR encourages communities to build stockpile depth early, even at Bronze, because endurance is a strategic asset that changes the outcome of every scenario.
How a Score Reads
A community assessed at “Cyber Gold | Physical Silver | EMP/GMD Bronze | 30-Day Supply” has strong cyber defenses, moderate physical hardening, early-stage electromagnetic protection, and one month of endurance across all three vectors. Each vector has its own champion, its own funding stream, and its own improvement roadmap. Progress is measured — not all-or-nothing.
This model eliminates the psychological barrier that stops most communities from starting. You do not need to achieve Diamond Blue on all three vectors simultaneously. You advance each vector at its own pace, funded by its own grant program, led by its own internal champion. Every step forward is documented, scored, and real.
Six Maturity Levels — Per Vector
Bronze
The decision to begin. Governance resolution adopted. Working group established. Initial infrastructure inventory complete. Threat posture documented. Bronze costs nothing beyond the decision to act. This is where every community starts — and it is available today.
Silver
Shadow Infrastructure inventory complete for the vector. Basic hardening actions implemented. Working group trained through BSE 099 and foundation courses. Documented plan and budget to advance to Gold. First tabletop exercise completed. The community knows what it has, knows what it lacks, and has a funded plan to close the gap.
Gold
Vector-specific hardening standards substantially implemented. Workforce trained. Backup systems tested under realistic conditions. Grant funding secured or applied for. Functional exercise completed demonstrating capability under simulated attack. Gold means the community can withstand the initial impact on this vector and begin recovery.
Platinum
Advanced hardening across all six assessment domains for this vector. Redundant systems operational. Inter-community mutual aid agreements in place with sister municipalities within 100-mile radius. Full-scale exercise validated. Documented plan and budget to Diamond Blue. Platinum means the community can sustain operations through an extended disruption on this vector and support neighboring communities.
Diamond Blue
The community can sustain itself indefinitely on this vector by producing more than it consumes. Diamond Blue requires more than technical hardening. It requires the full post-BSE sustainment architecture: community consolidation contingency planning, local economic continuity, organized labor and governance structures capable of functioning without centralized services, and demonstrated capability through a 48-hour full-scale exercise. Diamond Blue means no outside help is needed — on this vector — ever.
Diamond Blue is the destination. The pace of getting there is determined by affordability, leadership commitment, and the threat environment. The target is never negotiated down — it remains the documented standard against which every community is measured.
The Methodology: Seven Steps
The FIR Framework is built on the same transformation methodology used in thousands of enterprise programs worldwide — TOGAF’s Architecture Development Method, PMI’s project lifecycle, and federal capital planning. The application to infrastructure resilience is FIR’s contribution. The methodology is proven. The domain is new.
1: Inventory
Document where you are. Load real data from federal databases. Map every substation, water plant, hospital, pipeline.
2: Target Architecture
Define where you need to be. Localize the Diamond Blue checklist for your specific community across all three vectors.
3: Gap Assessment
Measure the delta. Every checklist item scored as achieved, partially achieved, or not achieved.
4: Roadmap & Budget
Translate every gap into phased actions with costs, responsible parties, and timelines — one roadmap per vector.
5: Affordability Decision
The critical leadership gate. Your governing authority decides what to fund now and what to accept as unmitigated risk. The target is never reduced — the pace is determined by what the community can afford.
6: Roadmap Refinement
The funded roadmap becomes the implementation plan. Unfunded items are deferred, not deleted. Grant opportunities are mapped to every deferred item.
7: Capability Validation
You have not achieved a maturity level until you have exercised it. Tabletop, functional, and full-scale exercises prove the score is real — not a checklist on paper.
Diamond Blue: Six Self-Sustaining Domains
At Diamond Blue, a community operates independently across six core domains — producing more than it consumes in each. These domains apply across all three vectors because a self-sustaining community survives regardless of what caused the failure.
Energy
ndigenous production operating indefinitely without external fuel or grid connection. Solar, wind, biomass, micro-hydro — not diesel generators dependent on a fuel supply chain that no longer exists.
Water / Wastewater
Closed-loop treatment powered by local energy. Locally sourced treatment chemicals. Gravity-fed or energy-powered distribution independent of the municipal system.
Food & Agriculture
Community production on multiple sites. Contingent procurement contracts with local farms. Seed preservation. Medicinal plant cultivation. The transition from supply chain dependency to indigenous production.
Communications
Solar-powered ham radio network with 50+ licensed operators. Five-layer architecture from tactical (FRS/GMRS) through strategic (HF ham). Non-electronic backup validated through exercise.
Security & Governance
Governance council with resource allocation, dispute resolution, and emergency operational authority. Community defense with concentric ring structure. Counter-intelligence function. Continuity of government through 5-deep succession.
Societal Continuity
Education, labor organization, sanitation, deceased management, heating and shelter, manufacturing and repair, mental health, justice, inter-community coordination, and medical capability. The thirteen functions that sustain a community as a society — not just a collection of survivors.
Who This Is For
Municipalities & Counties
State capitals, military-adjacent communities, Federal Reserve cities, critical manufacturing centers, and any community whose leadership is willing to confront the 72-hour gap.
Military Installation Communities
City-base pairs where civilian infrastructure resilience directly affects military deployment capability. Cheyenne WY / F.E. Warren AFB. Petersburg VA / Fort Gregg-Adams. The base cannot deploy if the community outside the fence line cannot sustain itself.
Community Organizations
Churches, civic groups, neighborhood associations, volunteer fire companies — any organization willing to serve as a coordination point for the people who depend on it.
Utilities & Healthcare Systems
Electric, water, gas, and telecommunications utilities. Hospitals and healthcare networks. Any entity whose failure cascades through the community it serves.
What It Costs
Bronze costs nothing. It requires a governance resolution and a working group. The decision to begin is free.
For qualifying disadvantaged communities of 10,000 population, the local cost share for Diamond Blue Transition — across energy, water, communications, medical, food, governance, and exercise — is approximately $110,000 to $350,000 when federal grants cover the rest at 90% federal / 10% local cost share. That is less than the cost of a fire truck.
The FIR Grant Funding Navigator maps every Diamond Blue checklist item to its eligible federal grant program — FEMA BRIC, DOE Grid Resilience, USDA Community Facilities, EPA water infrastructure, OLDCC for base-adjacent communities — with disadvantaged community scoring advantages documented.
Start Today
The assessment is free. The training starts free. Bronze costs nothing. The only requirement is the decision to act.