The data model

The model is YAML on disk, validated against JSON Schema, and published as JSON. An assessment is a separate document with its own schema, so a tool can validate one before scoring it.

Layout

model/
  meta.yaml              levels, domain weights, tiers and entry gates,
                         the five integrity constraints, applicability
                         profiles, environment archetypes
  domains/*.yaml         one file per domain: sub-capabilities, weights,
                         profiles, questions, six level descriptors,
                         evidence criteria, crosswalks
  schema/
    model.schema.json    validates the model itself
    assessment.schema.json  validates an assessment document
data/
  attack_techniques.csv  697 techniques with tactics and platforms
  attack_actors.csv      1,057 actors with the techniques each uses
  attack_analytics.json  1,745 analytics with required log sources
  attack_detection.csv   detection strategies per technique
  attack_log_sources.csv normalised log source index
  telemetry_catalogue.yaml  how to enable each source

A sub-capability

- id: AV.3
  name: Threat-actor emulation plans
  weight: 14
  profile: standard
  question: >-
    ...
  levels:
    0: ...
    5: ...
  evidence:
    - Named artefact that substantiates a claim at 4 or 5
  crosswalk:
    nist_csf_2: [DE.CM-01, ID.RA-05]
    soc_cmm: [Process.Use case management]

Scoring an assessment

The arithmetic is specified in full on the scoring page, and the repository publishes conformance vectors — complete assessments with the scores a conforming implementation must produce. Implement the specification, run the vectors, and you can prove you reached the same answer.

The repository