Cyber, physical, personnel, and ops fail at the seams, not for lack of tools. Vendors sit inside the boundary. Identity is the control plane. The first hour is people, authority, and a shared picture, not a SIEM cookbook. Cheap models belong in recon and vendor tool-use, not a chatbot policy.
Buy the Kit to operate. Buy the Identity briefs to brief the control plane. Buy the Model pack to put the board on the same map. Together they are one program. Apart they still point at each other.
Turn the operating model into something you can run on Monday: who has authority in the first hour, what a CSO briefs, and a tabletop that crosses cyber, physical, personnel, and a preferred vendor.
If digital compromise can become a badge, a vendor on site, or a muted door, these six pages show the identity seams that made it possible, and the questions to ask on Monday.
Treat models as capability in recon, malware-assist, and vendor tool-use, then give the board questions, evidence, and a 90-day program that does not require a new platform religion.
All three packs use the same story: Vendor SSO to Facility Access. A preferred facilities vendor's SSO session into the enterprise IdP is stolen and, within the hour, becomes badge-admin access, an after-hours work order, and a muted door. Optional second path: recon-via-model of the vendor's people and the site.
Seams, identity plane, GSOC, unified command, first hour, human-in-the-loop, legitimacy, common operating picture, break-glass, crown jewels, PIO discipline, OPSEC, vendor liaison, recover to mission. Named seats stay the same in the runbook, the tabletop, and the briefs: Incident Commander; Cyber Lead; Physical / Site Lead; Personnel Lead; Ops / Business Continuity Lead; Legal / Privacy Lead; PIO; GSOC Watch; Vendor Liaison; Executive Sponsor.