TID-CMM Threat-Informed Detection Capability Maturity Model
HomeDevelopers

For developers

The model as JSON, the schemas it validates against, and the repository holding the model and its datasets.

In this section

API

Versioned static JSON served with permissive CORS. No key, no rate limit, no tracking.

Data model

How the model is structured on disk, the JSON Schemas it validates against, and the shape of an assessment file.

Model repository

The model and its datasets on GitHub under CC-BY-4.0, and what is not published there.

Built to be consumed

The model is machine-readable by design. Every domain, sub-capability, level descriptor, weight, evidence criterion and crosswalk is available as structured data, so a detection platform, a GRC tool or a reporting pipeline can consume it without scraping a document.

The endpoints are versioned static JSON with permissive CORS. No key, no rate limit, no tracking, and no service to depend on — they are files on a CDN.

What is and is not published

The scoring arithmetic is specified rather than hidden, and the repository publishes conformance vectors so an independent implementation can prove it agrees. What is not published is the assessment tool's own source: it is free to use, including for commercial assessment work, and is not licensed for redistribution or derivative tooling.