For developers
The model as JSON, the schemas it validates against, and the repository holding the model and its datasets.
In this section
API
Versioned static JSON served with permissive CORS. No key, no rate limit, no tracking.
Interoperability and handoffs
Which relationships are formal crosswalks, which are references, which are comparisons, which are handoffs, and the mechanisms that carry them: stable IDs, the versioned model JSON, the export schema and the reference datasets.
Data model
How the model is structured on disk, the JSON Schemas it validates against, and the shape of an assessment file.
Model repository
The public TID-CMM model, documentation, data and community on GitHub, and what is not published there.
Explore the public TID-CMM model, documentation, data and community discussions on GitHub. The assessment implementation and build system are not published there. Public model and community on GitHub.
Built to be consumed
The model is machine-readable by design. Every domain, sub-capability, level descriptor, weight, evidence criterion and crosswalk is available as structured data, so a detection platform, a GRC tool or a reporting pipeline can consume it without scraping a document.
The endpoints are versioned static JSON with permissive CORS. No key, no rate limit, no tracking, and no service to depend on — they are files on a CDN.
What is and is not published
The scoring arithmetic is specified rather than hidden, so an independent implementation can be written from the specification; conformance vectors that would let such an implementation prove agreement are not yet published. What is not published is the assessment tool's own source: it is free to use, including for commercial assessment work, and is not licensed for redistribution or derivative tooling.