The COG six-box grid as put forward by Dr Joe Strange is the standard tool employed by NATO and many other national militaries.
- Step 1: identify the organization’s desired ends or objectives.
- Step 2: identify the possible “ways” or actions that can achieve the desired ends. Select the ways that the organization is most likely to use to achieve its objectives, expressed as verbs. Ways = critical capabilities.
- Step 3: list the organization’s means available to execute these critical capabilities.
- Step 4: select the entity from the list of means that inherently possess the critical capability to achieve the end. This selection is the COG. It is the doer of the action that achieves the ends.
- Step 5: from the remaining items on the means list; select those that are critical for execution of the critical capability. These are the critical requirements. These critical requirements are supporting means that enable the COG, the supported entity to perform the critical capability.
- Step 6: identify those critical requirements or components of the critical requirements that are vulnerable to adversary actions.
- Step 7: draw conclusions from the analysis to include a feel for what would happen over time, should these vulnerabilities be exploited.