Hunter Storm

HSRMS Interoperability and Government Classification Crosswalk

The Hunter Storm Records Management System™ (HSRMS), Hunter Storm Classification System™ (HSCS), and Hunter Storm Classification Numbering System™ (HSCNS) provide an independently defined records management and classification architecture. This crosswalk establishes documented relationships between those systems and relevant government agency taxonomies, enabling terminology correlation and comparative interpretation without requiring the systems to share identical structures.

The crosswalk documents classification relationships; it does not establish agency endorsement, official government classification, investigative involvement, attribution, or adjudication of any record. Inclusion of an external taxonomy identifies a reference framework, not an institutional relationship or determination.

 

Custom Records Management Architecture and Government Taxonomy Interoperability

 

Why Hunter Storm Built a Government Classification Crosswalk

Hunter Storm developed the Hunter Storm Records Management System™ (HSRMS), supported by the Hunter Storm Classification System™ (HSCS) and Hunter Storm Classification Numbering System™ (HSCNS), to provide a consistent, independently defined structure for identifying, organizing, classifying, and maintaining records across the Hunter Storm ecosystem.

She subsequently established a government taxonomy crosswalk to relate this custom architecture to relevant classification frameworks and terminology published by U.S. government agencies, including Cybersecurity and Infrastructure Security Agency (CISA), United States Department of Defense (DoD), Federal Bureau of Investigation (FBI), Office of the Director of National Intelligence (ODNI), and National Archives and Records Administration (NARA).

The objective is to connect an independently developed records management and classification architecture to established institutional terminology without surrendering the independence of the original system.

 

Classification and Correlation

A custom classification scheme may be internally consistent yet unfamiliar to external readers. The crosswalk addresses this interoperability challenge by documenting points of reference between Hunter Storm classifications and relevant government frameworks. These relationships make the system’s classifications easier to interpret in relation to established institutional terminology while preserving the distinctions between the underlying frameworks.

The crosswalk also addresses a practical design problem: different organizations may describe related events, hazards, threats, targets, or effects using different taxonomies and levels of specificity.

A single record may therefore require multiple classification dimensions or external references. Documented cross-references allow these relationships to be represented without requiring duplicate records or forcing independent classification systems into identical structures.

Where an authoritative external framework provides an appropriate reference, Hunter Storm preserves the source terminology and identifies the applicable framework. Where no suitable category exists, or the evidence does not support a definitive classification, descriptive or unresolved terminology is retained rather than forcing a record into an unsuitable category.

By connecting independent classification structures, the crosswalk provides a foundation for correlating and comparing records across domains of authority. The resulting analysis must still distinguish a documented classification relationship from an established relationship between events, and both from any conclusion about attribution or causation.

 

Scope and Authority

The Hunter Storm classification architecture remains independently defined and maintained. The crosswalk documents relationships between classification systems; it does not establish that a government agency developed, adopted, approved, endorsed, or applied the Hunter Storm systems.

Likewise, an external classification reference does not establish agency involvement in an event, investigative jurisdiction, attribution, motive, or an official finding. Those are separate questions requiring their own evidence.

The purpose is interoperability and interpretability: to make the architecture and its records more understandable across different classification environments while preserving the distinction between the original record, its classification, its supporting evidence, and any external reference.

 

Classification Taxonomy and Government Crosswalk

The Hunter Storm corpus uses a controlled vocabulary to describe documented events, records, artifacts, and related information.

Where an authoritative U.S. government framework provides useful terminology, that terminology is preserved as an external cross-reference.

The purpose is descriptive interoperability. It is not an assertion that a government agency investigated, classified, endorsed, attributed, or adjudicated any particular record.

 

Classification Methodology

This corpus uses established terminology and classification frameworks published by authoritative U.S. government agencies, including ODNI, FBI, DoD, CISA, and other relevant authorities, where applicable.

These classifications are used as a controlled vocabulary for describing and indexing documented characteristics of incidents.

Referencing an agency’s terminology does not imply that the agency investigated, classified, endorsed, or attributed the incident, nor does it establish jurisdiction or motive.

The purpose is to describe events using terminology recognizable to investigators and subject matter experts (SME) while keeping observed facts, reported information, analytical hypotheses, and attribution distinct.

Where no authoritative classification adequately describes an incident, descriptive terminology is retained rather than forcing the incident into an inappropriate category.

External classification references identify the source taxonomy and applicable document/version; they do not constitute findings by that authority.

 

Classification Dimensions

Classification is multidimensional. A record may therefore have several classifications without requiring those classifications to become separate HSCNS records.

 

Event Class

Examples include:

• Assault
• Attack
• Cyber attack
• Exposure
• Intrusion
• Harassment
• Malicious cyber activity
• Property damage or tampering
• Sabotage
• Theft
• Threat
• Unauthorized access

 

The applicable term is selected according to the evidence and the definition being used.

 

Modality

Examples include:

• Biological
• Chemical
• Cyber
• Explosive
• Information
• Infrastructure
• Physical
• Unknown or unresolved
• Vehicle

 

Target or Object

Examples include:

• Account
• Device
• Information
• Infrastructure
• Network
• Organization
• Person
• Property
• Residence
• Vehicle
• Workplace

 

Effect

Examples include:

• Attempted harm
• Data loss
• Exposure
• Financial loss
• Incapacitation
• Injury
• Other documented effect
• Property damage
• Service interruption
• Unauthorized access

 

Evidence Status

Evidence status describes the provenance and corroboration of a record. It is not a determination of whether a proposition is true or false.

 

Attribution Status

Attribution is maintained separately from event classification. An event may be classified as an attack while attribution remains unknown.

Likewise, identifying a person associated with an event does not automatically establish that the person caused or directed the event.

 

Government Crosswalks

 

CISA — Cyber Incident Severity

CISA’s National Cyber Incident Response Plan provides the Cyber Incident Severity Schema for describing the severity and impact of cyber incidents.

Records related to cybersecurity may therefore carry a CISA cross-reference in addition to their HSCNS identity and other applicable classifications.

 

DoD — DoDI 6055.17

DoDI 6055.17, DoD Emergency Management Program, includes a Hazard and Threat Identification List covering categories such as toxic substance or toxin, chemical/biological/radiological hazards, transportation accidents, infrastructure or utility loss, terrorism, assault, CBRNE attack, cyber attack, and crime. The current public issuance incorporates Change 4 dated December 1, 2025.

This framework may provide useful modality and threat terminology even when the underlying record is not a DoD matter.

 

FBI — WMD / CBRNE

The FBI states that WMD often refers to chemical, biological, radiological, nuclear, or explosive (CBRNE) modalities and describes WMD investigations in terms of their CBRNE modality.

This terminology may be used where the documented evidence supports an applicable modality.

 

ODNI — ICD 190

ODNI ICD 190 provides examples of CRITIC events and includes a Hostile Acts category containing attacks, major acts of sabotage, hostile use of WMD, physical attacks on critical infrastructure, certain cyberspace attacks, and significant malicious cyber activity.

This provides a useful national security vocabulary for appropriate records.

 

Classification Rule

Do not force the evidence into the taxonomy. The taxonomy exists to make the evidence more legible.

Where a classification is uncertain, the record may retain:

• a broader classification;
• multiple plausible classifications;
• an unresolved classification; or
• a descriptive term pending additional evidence.

 

A classification may also be revised without changing the underlying HSCNS identifier.

 

No Attribution by Vocabulary

The use of a term such as Attack, CBRN, Cyber Attack, Insider Threat, Sabotage, or another government term does not itself establish who performed the act, why it occurred, or which organization had jurisdiction.

Classification and attribution are separate analytical dimensions.

---

Discover More from Hunter Storm

• Domain History
• Human-Layer Security | Definition, Origin, Variants, and 1994–2025 Lineage (Authoritative Guide)
• Hunter Storm Official Site
• StormWatch | Lessons from the CISA ChatGPT Incident
• StormWatch | Public AI, Private Data: Why Uploading Sensitive Information Is a Systemic Failure — Not an AI Problem

 

---