For developers
The model as JSON, the schemas it validates against, and the repository holding the model and its datasets.
In this section
API
Versioned static JSON served with permissive CORS. No key, no rate limit, no tracking.
Data model
How the model is structured on disk, the JSON Schemas it validates against, and the shape of an assessment file.
Model repository
The model and its datasets on GitHub under CC-BY-4.0, and what is not published there.
Built to be consumed
The model is machine-readable by design. Every domain, sub-capability, level descriptor, weight, evidence criterion and crosswalk is available as structured data, so a detection platform, a GRC tool or a reporting pipeline can consume it without scraping a document.
The endpoints are versioned static JSON with permissive CORS. No key, no rate limit, no tracking, and no service to depend on — they are files on a CDN.
What is and is not published
The scoring arithmetic is specified rather than hidden, and the repository publishes conformance vectors so an independent implementation can prove it agrees. What is not published is the assessment tool's own source: it is free to use, including for commercial assessment work, and is not licensed for redistribution or derivative tooling.