ATT&CK ships two releases a year - do you re-map five years of technique mappings or pin a version?

## The decision, stated honestly The catalogue is revised roughly twice a year. Your organisation holds five years of technique references written against six different releases. Somebody wants year-over-year statements out of it. There are three postures and only one of them survives contact. **Pin forever.** Freeze on one release, express everything against it, refuse to move. Internally consistent, cheap, and it decays: two releases a year means that within about two years your identifiers stop lining up with what partners, providers and published material use. The catalogue's entire value is that it is a *shared* vocabulary; a private dialect of it is worth much less than it costs to maintain. **Re-map everything, every release.** Superficially rigorous. In practice it is unbounded work whose expensive half cannot be done correctly at all, and it destroys the historical record every time it runs. **Split by cost, which is the answer.** Migration has three outcomes and they price very differently. ## The three outcomes and what each costs **Mechanically resolvable.** A revoked identifier names its replacement in the published data. Following that pointer requires no judgment. This is most of the volume from the July 2020 restructure - `T1527` to `T1550.001` and its peers - and it is genuinely close to free. Automate it, on a schedule tied to releases, and **write the migrated identifier alongside the original rather than over it**. The original is the evidence that the migration was faithful; overwriting it means nobody can ever audit the transformation, and a later reader cannot tell an authored claim from a derived one. **Valid but coarse.** A parent that gained children was neither revoked nor deprecated. An old reference to it is still correct. Pushing it down to a child requires knowing something the original author never asserted, and the material that would settle it is usually long gone. **This is where the money would go, and it is the work to refuse.** Re-deriving granularity means specialist hours re-reading old material to recover detail that was never load-bearing, in order to sharpen a series that was never a measurement instrument. Worse, if the re-derivation is done from memory or from what is usually true, you have fabricated claims that look exactly like recorded ones. **Unresolvable.** A deprecated identifier has no successor. Mark it explicitly so it does not silently fall out of a migration and leave a plausible-looking hole. ## The cheap thing that makes all of it work Record the ATT&CK release version with every mapping **at the moment it is written**. It costs nothing then and it is the only thing that makes an old identifier interpretable later - without it you cannot tell whether a `T1078` from 2019 means "valid accounts, kind unknown" or "valid accounts, before children existed", and every subsequent migration is guesswork dressed as data. Organisations that skip this pay for it repeatedly and never trace the cost back. ## The organisational layer This is where the decision stops being technical. - **Who pays.** Mechanical migration is an engineering task with a known, small cost. Granularity re-derivation is an open-ended commitment of the scarcest people you have. If someone wants it, they have to name what decision changes as a result - and usually nothing does. - **What a contract or a partner requires.** If an agreement names an ATT&CK version, you inherit that release as an obligation and must be able to express your material in it on demand. That argues for keeping originals plus a version stamp, since you can then render into any release, rather than destructively normalising into one. - **What you say to the person asking for the five-year trend.** The strongest answer available to you is usually not a curve. It is: the catalogue is a vocabulary revised twice a year, the identifier space moved several times inside the window, and comparisons are only honest at the coarsest common level with the release stated. Producing a defensible-looking chart instead of saying that is the failure mode, because the chart will outlive the caveat. - **What you do not promise.** Never commit to a stable multi-year technique series as a standing obligation. You would be guaranteeing something the catalogue's own release cadence makes impossible, and you will meet the commitment by quietly inventing precision. ## The policy in five lines Stamp the release on every mapping at write time. Migrate revoked identifiers automatically, keeping the original. Mark deprecated ones; do not let them vanish. Never back-fill granularity. Compare across years only at the coarsest common level, with the release named. That is cheap, defensible, and it survives the next six releases without a decision being re-litigated.