TID-CMM Threat-Informed Detection Capability Maturity Model
HomeDevelopersModel repository

The repository

The model and its datasets are published on GitHub under CC-BY-4.0, together with the scoring specification and conformance vectors.

View on GitHub

What is published

What is not

The assessment tool's source is not published. It is free to use for any purpose, including commercial assessment work, and is not licensed for redistribution or for building derivative tooling.

Why publish the specification but not the implementation. The model's central claim is that an assessment cannot flatter itself, because the constraints are applied mechanically rather than urged. That claim is only worth something if someone other than the author can check it — which the specification and the conformance vectors allow, without the implementation.

Contributing

Descriptors, weights and crosswalks are open to challenge. The most useful contribution is not a correction but a counter-example: if a level descriptor does not match what you see in practice, say which sub-capability, which level, and what you actually observed.