The most significant pre-crisis signals rarely appear in a single domain in isolation. They appear first as a small deviation in one domain that triggers a predictable chain of secondary effects across others. This lesson teaches you to recognize those chains before they converge — and to understand why multi-domain concurrent deviations are the most reliable indicators of developing crises.
The Problem With Single-Domain Thinking
A team that monitors only vehicle patterns may notice increased traffic on a key route. A team that monitors only infrastructure may notice that fuel resupply is delayed. A team that monitors only communications may notice that cell service is degraded in the evenings.
Any one of these observations, taken alone, may be explainable by benign causes. Taken together, across the same 72-hour window, they are almost certainly connected — and that connection is what elevates a collection of AMBER observations to a RED intelligence picture.
Cascade analysis is the practice of watching for those connections deliberately.
FM 34-2-1 Chapter 4 addresses multi-source correlation as the mechanism that transforms tactical reconnaissance data into actionable intelligence assessments. The principle is explicit: single-source data supports observation; multi-source correlation supports conclusion. The cascade framework in this lesson is a direct civilian adaptation of that principle.
How Cascades Work
Infrastructure systems, human behavior, and communications networks are interdependent. When one degrades, others follow — in predictable sequences. Knowing those sequences lets you identify crisis onset earlier than any single-domain monitor can.
Three common cascade chains for community-level analysis:
A cascade chain is not a prediction. It is a collection priority matrix. When you observe an early-chain indicator (Step 1), the cascade framework tells you exactly which other domains to monitor next — and what specific indicators to look for. You are not waiting to see what happens. You are directing collection toward the most likely next signal.
Concurrent Multi-Domain Deviations
When deviations in two or more domains occur within the same observation period, they should be evaluated together — not independently. This is the single most important analytical habit in cascade analysis.
The rule is simple: two concurrent AMBER observations across different domains equal one RED threshold event.
This is not a mechanical formula — it is a heuristic for directing analytical attention. Two concurrent AMBER observations should immediately trigger:
- A cross-domain Event Template that links the two observations explicitly
- A cascade chain review to identify which chain (if any) the combination matches
- Targeted corroboration collection on the next-step indicators in that chain
- A briefing to MAG leadership within 12 hours
On a Thursday, a MAG observer logs a 35% increase in vehicle traffic on the main supply route into town (AMBER, vehicle domain). Another team member reports that the local grocery restocked only partially on its normal Wednesday cycle — dairy and canned goods were low, bread was out entirely (AMBER, infrastructure domain). Taken individually, each might be coincidental. Taken together on the same day, they match the early indicators of Supply Disruption Cascade Chain 1.
The MAG team opens a cross-domain Event Template and immediately redirects collection toward Step 2 of the chain: human activity at the grocery and at the fuel stations. Within 24 hours, they confirm elevated purchasing behavior and longer-than-normal lines at the ATM. They brief leadership that evening and activate their 72-hour resupply protocol. The supply gap did not resolve for 11 days.
Building Your Cascade Watch List
Your collection framework from Lesson 1 needs one addition: a Cascade Watch List — a short, pre-defined list of the two or three cascade chains most relevant to your area, with the Step 1 indicator highlighted as a collection priority.
The watch list does not increase collection burden. It redirects existing collection effort toward the leading indicators most likely to provide early warning for your most probable scenarios.
Cascade analysis is a tool for directing collection, not a tool for drawing conclusions. Identifying a pattern that matches a cascade chain does not confirm that the crisis is occurring — it means you should collect more aggressively on the next indicators. Resist the urge to brief an emerging crisis before the data justifies it. The damage to team credibility from false alarms compounds over time and degrades the value of future reporting.
When cascade analysis surfaces a significant multi-domain pattern, you have a hypothesis — not a confirmed assessment. INT-01: Analysis of Competing Hypotheses (ACH) provides the structured analytical tool for rigorously evaluating that hypothesis against alternatives. ACH and cascade analysis are complementary: cascade tells you what to collect; ACH tells you how to weigh what you have.
Build your Cascade Watch List. Review the three cascade chains presented in this lesson. For your area, identify which one (or which combination) represents the most likely scenario. List the Step 1 indicators for that chain. These become your highest-priority collection targets — the first things your observers should be logging on every shift.
Share the list with your MAG or preparedness team and confirm that your collection coverage is actually positioned to observe those indicators.