Federal Modernization Workbook · Book 09
Book 09 — Network & Transport
Physics, Control and the Order of Operations
Transport is a physics decision; control is a compliance decision: why physics decides the architecture, what TIC 3.0 and the network control plane require, who owns the network, and how to move branches without a compliance regression
This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book brings together the workbook’s Physics of a Single Source of Truth series, the branch-networking whitepapers (The Branch Edge Gap, The Long Interim, SD-WAN vs. DIA Under TIC 3.0, Network Transport and Governance, and the field-office WAN paper), the Microsoft 365 Optimize exemption instruments, and the short SD-WAN, SASE and RADIUS pages. Every external claim was checked against a primary source starting October 20, 2026, with later additions dated in their footnotes, and carries a footnote; third-party sources are labeled as such. The earlier pages are kept in the repository’s archive/b09-network/ folder, and their old addresses forward to the chapters that replaced them.
b09-network-bundle.docx: the whole book as one Word document, regenerated on every site deploy.
15-minute presentation (about 13 minutes narrated): the Why / What / Who / How deck and its narrated, self-running edition, with built-in captions, are on the Presentations page.
Executive briefing (about 30 minutes live, 22 narrated): the decisions, their owners and timing, on the Presentations page.
Technical deep dive (about 50 minutes live, 19 narrated): TIC 3.0 in practice, SD-WAN and SASE, network access control after AD, and the reference architecture, in modules on the Presentations page.
SD-WAN technical deep dive (about 50 minutes live, 18 narrated): transport physics, the branch edge and TIC 3.0, securing and governing the fabric, and the field-office transformation, on the Presentations page.
SD-WAN executive business case (about 7 minutes narrated): the field-office WAN case from Chapter 11, its cost, roadmap, gates and the decision to ask for, on the Presentations page. Research under review: the SD-WAN platform deep dive and the Cisco Catalyst SD-WAN implementation guide.
Every other book in this workbook moves something: identities, devices, databases, certificates, names. This one is about the paths they move over, and the one constraint no product removes. Light in fiber covers about 200 kilometers per millisecond, and conversational voice leaves the network roughly 70 to 100 milliseconds one way. A field office that hairpins through a distant data center spends much of that on the detour, and a faster circuit doesn’t straighten the path. So the architecture follows physics: centralize the source of truth logically, then need less global synchronization rather than trying to make it faster. The second idea is the book’s spine: transport is a physics decision; control is a compliance decision. Direct internet access, MPLS, satellite and 5G are pipes that support one control family, telecommunications diversity (CP-8 and SC-47). The governor above them, SD-WAN and the security service edge enforcing TIC 3.0 policy, provides the protection controls, leaves the agency and its assessor to own what is left, and is itself attack surface. Done in the wrong order, lighting up fast connections before the governor is live, modernization becomes a compliance regression with better latency.
Why, what, who, how
| Question | Chapters | |
|---|---|---|
| Why | Why does physics decide the architecture, and why are transport and control separate decisions? | 01, 02 |
| What | What federal policy actually requires, and what the target network looks like: centralization and tokens, SD-WAN and SASE, legacy protocols on new paths, network access control and the reference architecture | 03, 04, 05, 06, 07, 08 |
| Who | Who decides and who does the work for the network and its transport | 09 |
| How | Hold a safe posture through the long interim, transform a field-office WAN, handle Microsoft 365 traffic, and sequence, cost and evidence the change | 10, 11, 12, 13 |
Appendices: A — Optimize exemption decision instruments · B — Requirements mapping and sources · C — Glossary
Reading paths
- Executives (20 minutes): Chapters 01, 02 and 13, or the 15-minute presentation.
- Network and security architects: Chapters 01–08, then 13.
- Authorizing officials and boundary owners: Chapters 02, 03, 09 and 12, with Appendices A and B.
- Program managers and acquisition: Chapters 09, 10, 11 and 13.
- Identity and endpoint engineers: Chapters 04, 06 and 07.
Where this book sits in the workbook
This is Book 09 of the Federal Modernization Workbook. Book 08 — DNS, DHCP & IPAM governs the name layer that SD-WAN interception and encrypted DNS touch (Chapter 05). Book 07 — PKI & Certificates issues the certificates 802.1X depends on, and Book 04 — Access & Privilege turns network location into one signal among many. Book 05 — Devices & Endpoints and Book 06 — Data Platform carry the device and database work that moves over these paths. For control-level depth, the Federal Compliance volumes on 802.1X network access control, network modernization and telecommunications modernization remain in the repository.
New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — Why Physics Decides the Architecture | Why latency is a physical constraint no product removes: the pendulum back toward logical centralization, the speed-of-light floor, what the 150 ms voice budget really allows, what a hairpin costs, and why the right move is to need less global synchronization. |
| Chapter 02 — Transport Is Physics, Control Is Compliance | Why “SD-WAN versus DIA” is a false choice: what direct internet access solves and what it leaves undone, the transport menu and the one control family transport supports, what the governing control layer contributes, why that governor is itself attack surface, and the order of operations that keeps modernization from becoming a compliance regression. |
| Chapter 03 — What TIC 3.0 and Federal Policy Actually Require | What TIC 3.0 and the surrounding federal instruments require of a branch network as of October 2026, read from the documents themselves: the TIC 3.0 document set and use cases, the binding obligations that land on branch equipment, the control assertions an agency makes about its own boundary, the encryption requirement that is and isn’t there, logging and CISA telemetry after MTIPS, FedRAMP’s limits, and the DoD contrast. |
| Chapter 04 — Logical Centralization and Token-Based Security | Why one logical source of truth beats many authoritative copies, why token-based security is what makes a shared store safe, and how choosing the weakest consistency each flow tolerates keeps centralization inside the limits physics sets. |
| Chapter 05 — SD-WAN, SASE and Governed-Path Transport | What SD-WAN’s differentiated transport can and can’t do against the propagation floor, how SASE security services sit above it under TIC 3.0, the proposed token-bound governed path, the evidence the fabric must emit, and the controls owed to the controller and edges that make all of it possible. |
| Chapter 06 — Legacy Protocols on Re-Routed Paths | What actually breaks when an enforcement point sits in the path or the path changes, the real network dependencies of Kerberos and NTLM, why round trips rather than transport dominate chatty applications, and where transport genuinely matters for token-based access and continuous access evaluation. |
| Chapter 07 — Network Access Control: 802.1X and RADIUS | How port-based network access control with 802.1X, EAP-TLS and RADIUS proves which device is on the wire, why Network Policy Server is an Active Directory dependency that an Entra-native estate outgrows, and how to choose, deploy and evidence the replacement. |
| Chapter 08 — Reference Architecture: Consistency Classes Meet Network Classes | The book’s reference architecture: the rule that aligns each data flow’s consistency class with a network class, the program’s SaaS data plane as the worked example, four branch egress architectures compared, and the five design decisions that carry most of the risk. |
| Chapter 09 — Who Owns the Network and Its Transport | Who decides, who does the work and who is consulted when an agency changes its transport, its branch control layer, its TIC 3.0 posture and its network access control, with a responsibility matrix, the owner of each step in the decision sequence, and the access each team needs. |
| Chapter 10 — The Long Interim | The posture for an agency that can’t buy SD-WAN or adopt a TIC 3.0 use case for years: why each alternative to a branch-edge policy layer has closed, which of its functions are obtainable now, why the target is far off, how BOD 26-02 pulls the branch refresh forward, and the ten interim actions that need no award. |
| Chapter 11 — Field Office WAN Transformation | Why a per-office distribution point refresh treats a transport problem as a content problem, and how SD-WAN, direct internet access and a 12-hub content tier sized to Configuration Manager’s published limits replace it. |
| Chapter 12 — Microsoft 365 Traffic and the Optimize Inspection Exemption | What Microsoft’s Optimize, Allow and Default endpoint categories mean, why Microsoft’s bypass-inspection guidance collides with an inspect-everything boundary at a branch with direct internet access, how a documented SC-7(4) traffic-flow exception resolves the collision, what tenant restrictions v2 does and doesn’t keep, and the three decision instruments the exemption needs. |
| Chapter 13 — Sequencing, Cost and Evidence | The decision sequence and the technical dependencies behind it, the phase-inversion failure mode and the evidence for and against it, how to measure branch transport cost in your own estate rather than importing figures, what to stop doing, the evidence the boundary change needs, and the measurements that confirm or refute the case. |
| Appendix A — Optimize Exemption Decision Instruments | Templates for the three documents that exempt the Microsoft 365 Optimize endpoint set from TLS break-and-inspect at branch direct internet egress under NIST SP 800-53 SC-7(4): a skeleton for the authorizing official’s exception memo, the pilot site register that serves as the exception record, and the architecture review determination against TIC 3.0 Security Capabilities Catalog version 3.3. |
| Appendix B — Requirements Mapping and Sources | A compliance-enabling crosswalk, not a compliance claim: each federal requirement that touches branch network and transport design (TIC 3.0, OMB M-19-26, M-22-09, M-26-14, M-26-15, CISA Protective DNS, BOD 23-02, BOD 26-02, BOD 26-04, NIST SP 800-53 Rev. 5, SP 800-52 Rev. 2, FIPS 140 and FedRAMP), what it actually asks, where the book addresses it and the evidence it calls for, followed by the book’s sources. |
| Appendix C — Glossary | Plain definitions of the network, transport, policy and control terms used across Book 09, with corrections to terms the sources got wrong. Policy and product facts are as of October 21, 2026. |
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 09: fix confirmed crosswalk error findings (#372); Book 09: MAB default to quarantine; re-time savings ramp to the roadmap (#375); Book 09: resolve 24 inconsistency findings (cutover gate, FedRAMP wording, glossary, cross-references) (#431); Decisions pass, Books 05-12: apply Mike’s calls and take-the-recommendation items (#453); Claim language: supports, not satisfies (rule, check, first sweep) (#474); Content Delivery Modernization: distribution point consolidation guides, plan and kit (#468); and 4 more (all changes) |
| 1.4 | 2026.11.4 | 2026-11-05 | Sweep stale wording, and link sources on every deck (#361) |
| 1.3 | 2026.11.3 | 2026-11-05 | Book decks: narration names the book or the original source, and 68 videos re-exported (#344) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260); Retire Research: move each page to a home by type (guides, training, reference, evaluations, explainers) (#269) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (22 merged changes since the book began) |