The FIR Framework
A systematic, measurable path from vulnerable to self-sustaining. Three resilience vectors. Six maturity levels. A days-of-supply modifier that rewards endurance. Built on proven methodology — enterprise transformation architecture applied to the one system that matters most: the infrastructure your community cannot survive without.
The Problem
Every emergency plan in America has a design assumption built into it: help arrives within 72 hours. FEMA deploys. The National Guard mobilizes. Mutual aid activates. Supplies flow from unaffected regions to affected regions. That assumption is valid for hurricanes, earthquakes, and ice storms — every disaster Americans have experienced in living memory.
It is catastrophically invalid for a Black Sky Event. In a BSE, there are no unaffected regions. The attack is against the grid itself — not a geography. Every community in the interconnected grid is affected simultaneously. On Day 4, the 72-hour plan has been executed, help has not arrived, and help is not coming. For the vast majority of American communities, there is nothing beyond that horizon. No plan. No supplies. No fallback.
The FIR Framework exists to close that gap.
Three Independent Resilience Vectors
Your community does not face one threat. It faces three categories of attack — each requiring different defenses, different expertise, and different funding. FIR scores each independently so that progress on one vector is real, measurable progress regardless of where the other two stand.
Cyber
Volt Typhoon is inside your utility’s control systems. CyberAv3ngers compromised water treatment PLCs using default passwords. Salt Typhoon accessed telecommunications metadata. The cyber vector scores your defenses against nation-state pre-positioned access: network segmentation, OT monitoring, credential management, incident response, and detection capability.
Physical
919+ documented physical attacks on the U.S. grid since 2010. The Metcalf sniper attack destroyed 17 transformers — never solved. Most substations are protected by chain-link fencing. The physical vector scores hardening against kinetic attack: ballistic protection, facility security, counter-UAS, surveillance, access control, and perimeter defense.
EMP / GMD
Russia is developing space-based EMP weapons. A Carrington-class geomagnetic storm has a 10–12% probability per decade. Both destroy the same target: large power transformers that take 18 months to replace. The EMP/GMD vector scores protection against electromagnetic environments: Faraday shielding, GIC blocking, surge protection, and hardened communications.
The Days-of-Supply Modifier
Each entity carries a single days-of-supply number representing its physical stockpile — water, food, fuel, medical supplies, treatment chemicals — that sustains operations without external resupply. Thirty days of stored water is thirty days whether the cause was a cyberattack, a rifle attack on transformers, or a geomagnetic storm. The stockpile supports all three vectors.
A community scored “Cyber Silver | Physical Bronze | EMP/GMD Bronze | 60-Day Supply” has early-stage hardening but two months of endurance. That endurance buys time — time to recover, adapt, and advance. FIR encourages communities to build stockpile depth early, even at Bronze, because endurance is a strategic asset that changes the outcome of every scenario.
How a Score Reads
A community assessed at “Cyber Gold | Physical Silver | EMP/GMD Bronze | 30-Day Supply” has strong cyber defenses, moderate physical hardening, early-stage electromagnetic protection, and one month of endurance across all three vectors. Each vector has its own champion, its own funding stream, and its own improvement roadmap. Progress is measured — not all-or-nothing.
This model eliminates the psychological barrier that stops most communities from starting. You do not need to reach Diamond on all three vectors simultaneously – Diamond Blue arrives when the third vector gets there. You advance each vector at its own pace, funded by its own grant program, led by its own internal champion. Every step forward is documented, scored, and real.
Six Maturity Levels — Per Vector
Bronze
The decision to begin. Governance resolution adopted. Working group established. Initial infrastructure inventory complete. Threat posture documented. Bronze costs nothing beyond the decision to act. This is where every community starts — and it is available today.
Silver
Shadow Infrastructure inventory complete for the vector. Basic hardening actions implemented. Working group trained through BSE 099 and foundation courses. Documented plan and budget to advance to Gold. First tabletop exercise completed. The community knows what it has, knows what it lacks, and has a funded plan to close the gap.
Gold
Vector-specific hardening standards substantially implemented. Workforce trained. Backup systems tested under realistic conditions. Grant funding secured or applied for. Functional exercise completed demonstrating capability under simulated attack. Gold means the community can withstand the initial impact on this vector and begin recovery.
Diamond Basic
Advanced hardening across all six assessment domains for this vector. Redundant systems operational. Inter-community mutual aid agreements in place with sister municipalities within 100-mile radius. Full-scale exercise validated. Documented plan and budget to Diamond Blue. Diamond Basic means the community is fully hardened to the vector’s threat checklists and can sustain operations through an extended disruption — it has entered the Diamond family on hardening, before the measured Diamond-N supply base is built.
Diamond-N
The vector’s infrastructure is hardened at or above its survivable threshold, and the community holds a measured stockpile. The Diamond number is Days of Supply across the consumable categories – food and water treatment, fuel, medical, repair parts, sanitation and shelter items, and construction materials – and it is always set by the binding constraint: the category that runs out first. A community with 60 days of food but 14 days of water treatment chemicals is Diamond-14. Diamond is a fully valid, certifiable status one vector at a time – Cyber Diamond 30 is real, measurable progress even while Physical and EMP/GMD are still climbing.
Diamond Blue
Diamond Blue is the apex, achieved only when all three vectors have reached Diamond: the community sustains itself indefinitely by producing more than it consumes. Diamond Blue requires more than technical hardening. It requires the full post-BSE sustainment architecture: community consolidation contingency planning, local economic continuity, organized labor and governance structures capable of functioning without centralized services, and demonstrated capability through a 48-hour full-scale exercise. Diamond Blue means no outside help is needed – on any vector – ever.
Diamond Blue is the destination. The pace of getting there is determined by affordability, leadership commitment, and the threat environment. The target is never negotiated down — it remains the documented standard against which every community is measured.
The Methodology: Seven Steps
The FIR Framework is built on the same transformation methodology used in thousands of enterprise programs worldwide — TOGAF’s Architecture Development Method, PMI’s project lifecycle, and federal capital planning. The application to infrastructure resilience is FIR’s contribution. The methodology is proven. The domain is new.
1: Inventory
Document where you are. Load real data from federal databases. Map every substation, water plant, hospital, pipeline.
2: Target Architecture
Define where you need to be. Localize the Diamond Blue checklist for your specific community across all three vectors.
3: Gap Assessment
Measure the delta. Every checklist item scored as achieved, partially achieved, or not achieved.
4: Roadmap & Budget
Translate every gap into phased actions with costs, responsible parties, and timelines — one roadmap per vector.
5: Affordability Decision
The critical leadership gate. Your governing authority decides what to fund now and what to accept as unmitigated risk. The target is never reduced — the pace is determined by what the community can afford.
6: Roadmap Refinement
The funded roadmap becomes the implementation plan. Unfunded items are deferred, not deleted. Grant opportunities are mapped to every deferred item.
7: Capability Validation
You have not achieved a maturity level until you have exercised it. Tabletop, functional, and full-scale exercises prove the score is real — not a checklist on paper.
Diamond Blue: Six Self-Sustaining Domains
At Diamond Blue, a community operates independently across six core domains — producing more than it consumes in each. These domains apply across all three vectors because a self-sustaining community survives regardless of what caused the failure.
Energy
Indigenous production operating indefinitely without external fuel or grid connection. Solar, wind, biomass, micro-hydro — not diesel generators dependent on a fuel supply chain that no longer exists.
Water / Wastewater
Closed-loop treatment powered by local energy. Locally sourced treatment chemicals. Gravity-fed or energy-powered distribution independent of the municipal system.
Food & Agriculture
Community production on multiple sites. Contingent procurement contracts with local farms. Seed preservation. Medicinal plant cultivation. The transition from supply chain dependency to indigenous production.
Communications
Solar-powered ham radio network with 50+ licensed operators. Five-layer architecture from tactical (FRS/GMRS) through strategic (HF ham). Non-electronic backup validated through exercise.
Security & Governance
Governance council with resource allocation, dispute resolution, and emergency operational authority. Community defense with concentric ring structure. Counter-intelligence function. Continuity of government through 5-deep succession.
Societal Continuity
Education, labor organization, sanitation, deceased management, heating and shelter, manufacturing and repair, mental health, justice, inter-community coordination, and medical capability. The thirteen functions that sustain a community as a society — not just a collection of survivors.
Who This Is For
Municipalities & Counties
State capitals, military-adjacent communities, Federal Reserve cities, critical manufacturing centers, and any community whose leadership is willing to confront the 72-hour gap.
Military Installation Communities
City-base pairs where civilian infrastructure resilience directly affects military deployment capability. Cheyenne WY / F.E. Warren AFB. Petersburg VA / Fort Gregg-Adams. The base cannot deploy if the community outside the fence line cannot sustain itself.
Community Organizations
Churches, civic groups, neighborhood associations, volunteer fire companies — any organization willing to serve as a coordination point for the people who depend on it.
Utilities & Healthcare Systems
Electric, water, gas, and telecommunications utilities. Hospitals and healthcare networks. Any entity whose failure cascades through the community it serves.
What It Costs
Bronze costs nothing. It requires a governance resolution and a working group. The decision to begin is free.
For qualifying disadvantaged communities of 10,000 population, the local cost share for Diamond Blue Transition — across energy, water, communications, medical, food, governance, and exercise — is approximately $110,000 to $350,000 when federal grants cover the rest at 90% federal / 10% local cost share. That is less than the cost of a fire truck.
The FIR Grant Funding Navigator maps every Diamond Blue checklist item to its eligible federal grant program — FEMA BRIC, DOE Grid Resilience, USDA Community Facilities, EPA water infrastructure, OLDCC for base-adjacent communities — with disadvantaged community scoring advantages documented.
Start Today
The assessment is free. The training starts free. Bronze costs nothing. The only requirement is the decision to act.