DIV-3: Physical Data Model

Physical implementation of the Logical Data Model entities, e.g., message formats, file structures, physical schema (In DoDAF V1.5, this was the SV-11)

Viewpoint: Data and Information Viewpoint · https://mithril.fund/ontology/dm2/2.02/views#DIV-3

Concepts with Mithril instances

Concept	Code	Count	Examples
`Activity`	o	558	契約審査ライフサイクルインシデントエスカレーションライフサイクル法人設立・組織変更請求・支払ライフサイクルアクセス権プロビジョニングライフサイクル入退社ライフサイクル契約書ドラフト作成法務・条項審査財務条件審査 CEO 契約承認契約締結契約書保管 and 546 more (all in the JSON-LD)
`Data`	n	9	Arp Cache Discovery — 公開ラボ監査ログ VC fund catalog Compliance standards catalog Sanctions watchlist catalog Legal data catalog Public security knowledge Enterprise digital twin orgbrain reference organization NIST CSF 2.0 catalog
`GeoPoliticalExtent`	df	2	European Economic Area European Union
`Guidance`	df	106	DE.AE-02 — Potentially adverse events are analyzed to better understand associated activities DE.AE-03 — Information is correlated from multiple sources DE.AE-04 — The estimated impact and scope of adverse events are understood DE.AE-06 — Information on adverse events is provided to authorized staff and tools DE.AE-07 — Cyber threat intelligence and other contextual information are integrated into the analysis DE.AE-08 — Incidents are declared when adverse events meet the defined incident criteria DE.CM-01 — Networks and network services are monitored to find potentially adverse events DE.CM-02 — The physical environment is monitored to find potentially adverse events DE.CM-03 — Personnel activity and technology usage are monitored to find potentially adverse events DE.CM-06 — External service provider activities and services are monitored to find potentially adverse events DE.CM-09 — Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events GV.OC-01 — The organizational mission is understood and informs cybersecurity risk management and 94 more (all in the JSON-LD)
`Information`	dfo	19	EUR-Lex — EU 官報・連合法源ポータル CourtListener / RECAP — US 連邦裁判例・ドocket コーパス CanLII — カナダ判例・法源コーパス AustLII — オーストラリア法情報研究所 (判例・法源コーパス) Canada Justice Laws Website (カナダ連邦法令ポータル) NZLII — ニュージーランド法情報研究所 (判例・法源コーパス) Singapore Statutes Online — シンガポール法令公式ポータル (AGC Legislation Division 運営) HUDOC — 欧州人権裁判所 (ECtHR) 判例データベース Singapore Law Watch — 判例・法務ポータル (Singapore Academy of Law 運営) US Treasury OFAC SDN List UN Security Council Consolidated List EU Financial Sanctions Database and 7 more (all in the JSON-LD)
`Location`	dfo	1	Cloudflare global edge
`Organization`	o	722	Kotoba Labs Inc. cloud-kotoba (kotoba.cloud operator) AWAI Network, L.L.C. (Delaware) kotoba-lang (language substrate) 1Password (AgileBits) 42Crunch ANY.RUN AT&T Cybersecurity AWS Abnormal Security Acronis Akamai and 710 more (all in the JSON-LD)
`OrganizationType`	o	6	Mithril organization account VC fund Portfolio company ATT&CK intrusion set Historical ransomware group (Ransomwatch) orgbrain reference organization
`PedigreeInformation`	dfo	8	Pedigree of VC fund catalog — 8 funds each with source-url (8 primary-fetched); 6 companies with sourced rounds Pedigree of Compliance standards catalog — 16 of 16 frameworks with source-url Pedigree of Sanctions watchlist catalog — 9 source lists with issuing authority and URL (6 declared-2026-03, 3 primary-fetched) Pedigree of Legal data catalog — 52 records each with source-url (37 primary-fetched, 15 secondary-reported) Pedigree of Public security knowledge — every claim carries prov:wasDerivedFrom one of 7 archived sources (CISA, MITRE, NIST, OTRF, OTRF, joshhighet/ransomwatch, Kotoba); snapshot baguqeera6fji5y3mgsvalio2cz7ca6kxlhojidwtsuqwx6klgf3wycr2gpca, 2026-09-13T23:53:34.337Z Pedigree of Enterprise digital twin — every instance cites an in-repo source (2026-09-18T00:00:00+09:00) Pedigree of orgbrain reference organization — kotoba-lang/kyber@055c94b00d71, 7 files pinned by sha256 Pedigree of NIST CSF 2.0 catalog — 106 subcategories from NIST CSWP 29 (2024-02-26, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)
`Rule`	dfo	21	approve-spend sign-contract hire fire compliance it-admin SUPPORT_RATE_LIMIT 10/min per client address (503 by name on miss) POST /v1/invoke verifies Biscuits against pinned root public key; absent key refuses every invocation by name GDPR (EU 2016/679) CCPA / CPRA (Cal. Civ. Code 1798) FedRAMP (NIST SP 800-53 Rev.5 baseline) HIPAA Security Rule (45 CFR 164 Subpart C) and 9 more (all in the JSON-LD)
`Service`	o	10	CTEM DAST SAST SPECT VM GRC IR DR Stripe (live billing, AWAI account) Cloudflare Workers / R2 / DO / custom domains
`ServiceDescription`	o	8	CTEM — /security/services/ DAST — /security/services/ SAST — /security/services/ SPECT — /security/services/ VM — /security/services/ GRC — /security/services/ IR — /security/services/ DR — /security/services/
`ServicePort`	o	3	POST /v1/security/govern POST /v1/security/respond POST /v1/security/recover
`Standard`	df	9	ISO/IEC 27001:2022 SOC 2 (Type I / Type II) PCI DSS 4.0 NIST Cybersecurity Framework 2.0 CIS Controls v8.1 ISO/IEC 27701:2019 (privacy extension) CSA Cloud Controls Matrix v4 NIST Cybersecurity Framework 2.0 SCAP — 構成・脆弱性情報を交換する仕様群
`System`	o	396	Mithril (mithril.fund) kotoba-cloud-control-plane kotoba-identity-authority kotoba-research-authority kotoba-cloud-database kotobase-authn R2 kotobase-graph-database-production (PUBLIC_BLOCKS) R2 internal-security-nvd (NVD_BLOCKS, read-only allow-listed keys) Durable Object PqKeyRegistry (SQLite, post-quantum key registry) Durable Object BillingAccount (SQLite) EDR / XDR CMDB / 資産台帳 and 384 more (all in the JSON-LD)
`SystemType`	o	45	Vulnerability Assessment / VM Attack Surface Management / EASM Patch Management Penetration Testing / PTaaS Bug Bounty / Crowdsourced Testing EDR / XDR NDR / Network Detection SIEM / Log Analytics SOAR / Orchestration Threat Intelligence SBOM / VEX AppSec (SAST/DAST/SCA) and 33 more (all in the JSON-LD)

Relations

Concept	Code	Count	Examples
`WholePartType`	ifo	164	契約審査ライフサイクル → 契約書ドラフト作成契約審査ライフサイクル → 法務・条項審査契約審査ライフサイクル → 財務条件審査契約審査ライフサイクル → CEO 契約承認契約審査ライフサイクル → 契約締結契約審査ライフサイクル → 契約書保管インシデントエスカレーションライフサイクル → インシデント検知・トリアージインシデントエスカレーションライフサイクル → 指揮本部設立・指揮官任命 and 156 more (all in the JSON-LD)
`activityPerformedByPerformer`	o	54	COO → 契約書ドラフト作成 COO → 法務・条項審査 CFO → 財務条件審査 CEO → CEO 契約承認 CFO → 契約締結 COO → 契約書保管 IT Admin → インシデント検知・トリアージ COO → 指揮本部設立・指揮官任命 and 46 more (all in the JSON-LD)
`couple`	if	657	CTEM → VM (site:feedsFindingsTo) DAST → VM (site:feedsFindingsTo) SAST → VM (site:feedsFindingsTo) SPECT → VM (site:feedsFindingsTo) IR → DR (site:handsOffTo) CTEM → Threat Intelligence (site:coversCategory) CTEM → CSPM / CNAPP (site:coversCategory) CTEM → Vulnerability Assessment / VM (site:coversCategory) and 649 more (all in the JSON-LD)
`describedBy`	dfo	69	CTEM → CTEM — /security/services/ DAST → DAST — /security/services/ SAST → SAST — /security/services/ SPECT → SPECT — /security/services/ VM → VM — /security/services/ GRC → GRC — /security/services/ IR → IR — /security/services/ DR → DR — /security/services/ and 61 more (all in the JSON-LD)
`servicePortDescribedBy`	o	3	POST /v1/security/govern → GRC — /security/services/ POST /v1/security/respond → IR — /security/services/ POST /v1/security/recover → DR — /security/services/
`typeInstance`	ifo	891	exposure management → continuous external attack-surface and asset inventory exposure management → reachable attack-path identification exposure management → asset context (public routes, dependencies, owner) exposure management → exposure events fed to the VM ledger dynamic testing → dynamic probing of running applications dynamic testing → probing with authenticated scenarios dynamic testing → runtime vulnerability detection as findings static analysis → static source-code analysis and 883 more (all in the JSON-LD)

Concepts without Mithril instances (97)

The model concept codes (o, n, np, s, df, dfo, if, ifo) are shown verbatim: the DoD workbook publishes no legend for them, and none is assigned here.