# TID-CMM — Threat-Informed Detection Capability Maturity Model

> An open capability maturity model measuring whether an organisation's threat detection is driven by adversary behaviour, whether the telemetry exists to see it, and whether it has been proven to work. Version 1.5.0: 8 domains, 58 sub-capabilities, 348 level descriptors, aligned to MITRE ATT&CK Enterprise v19.2. Created by Reza Adineh. Licensed CC-BY-4.0.

TID-CMM is the detection module of UTIOM, the Unified Threat-Informed Operations
Model. TIR-CMM (https://tir-cmm.com) is its response module: TID-CMM measures
whether you would see an intrusion, TIR-CMM whether you could stop it.

Assessments are self-declared. There is no certification scheme.

## Core pages

- [Model](https://tid-cmm.com/model/): Eight domains, 58 sub-capabilities and 348 level descriptors that describe what a threat-informed detection capability actually looks like at each level of maturity.
- [Overview](https://tid-cmm.com/model/overview/): Why rule counts and alert volumes do not measure detection capability, and what the model measures instead.
- [Eight domains](https://tid-cmm.com/model/domains/): Threat intelligence, threat modeling, telemetry, detection engineering, adversarial validation, analytics, incident response and governance — with the weight each carries and the question each answers.
- [58 sub-capabilities](https://tid-cmm.com/model/sub-capabilities/): Every sub-capability in the model, its domain, its weight, its applicability profile and the question it asks.
- [Maturity levels](https://tid-cmm.com/model/levels/): What each level means in practice, and why level 5 is not a target for most organisations.
- [Seven principles](https://tid-cmm.com/model/principles/): The arguments the model enacts rather than merely states: scope is an intersection, capability requires evidence, detection is bounded by visibility, and validation expires.
- [Relationship to ATT&CK](https://tid-cmm.com/model/attack/): ATT&CK is consumed, not reproduced. How the in-scope technique set is derived, and why covering all 697 techniques is not the goal.
- [Methodology](https://tid-cmm.com/methodology/): How an assessment is run, how it is scored, and the rules that stop it flattering itself.
- [Assessment guide](https://tid-cmm.com/methodology/assessment-guide/): Who to involve, how long it takes, how to scope it, and the mistakes that make a maturity assessment worthless.
- [Scoring](https://tid-cmm.com/methodology/scoring/): The weighted rollup, the order constraints are applied in, the Validated Coverage Score and the prioritisation arithmetic.
- [Integrity constraints](https://tid-cmm.com/methodology/constraints/): Validation ceiling, visibility ceiling, evidence rule, intent ceiling and inherited intent — applied mechanically, because exhortation does not survive a budget cycle.
- [Evidence requirements](https://tid-cmm.com/methodology/evidence/): A score of 4 or 5 requires a named artefact. What qualifies, what does not, and why the rule exists.
- [Telemetry assurance](https://tid-cmm.com/methodology/telemetry-assurance/): Whether you have the visibility to detect a given behaviour at all, computed from the log sources ATT&CK's own analytics require.
- [Validated coverage](https://tid-cmm.com/methodology/validated-coverage/): Replacing percentage of ATT&CK covered with a number that distinguishes a rule that exists from a detection proven to fire.
- [Assessment](https://tid-cmm.com/assessment/): Ten guided screens that derive your in-scope technique set, compute what your telemetry cannot see, and produce a ranked plan.
- [Start assessment](https://tid-cmm.com/assess): Runs entirely in your browser. No account, no email address, and nothing you enter leaves the page.
- [Environment](https://tid-cmm.com/assessment/environment/): What you run, what you collect and how you work. Everything downstream is derived from this.
- [Threat scope](https://tid-cmm.com/assessment/threat-scope/): Crown jewels, threat actors, the techniques most likely to be used against you, and the attack paths that make a technique matter.
- [Telemetry](https://tid-cmm.com/assessment/telemetry/): How much of your estate each log source actually covers, and what that makes structurally undetectable.
- [Capability](https://tid-cmm.com/assessment/capability/): Scoring the sub-capabilities in your profile, with the evidence that substantiates each claim.
- [Results](https://tid-cmm.com/assessment/results/): The adjusted score, which constraints bound it, and which adversaries would walk through the gaps.
- [Roadmap](https://tid-cmm.com/assessment/roadmap/): What to fix, ranked by what it unlocks, and a 30/60/90 plan naming owners and the artefact that proves each step is done.
- [Resources](https://tid-cmm.com/resources/): The white paper, the workbook, a worked example, the datasets and an offline copy of the tool. All free to use; the model and datasets are CC BY 4.0.
- [Developers](https://tid-cmm.com/developers/): The model as JSON, the schemas it validates against, and the repository holding the model and its datasets.
- [API](https://tid-cmm.com/developers/api/): Versioned static JSON served with permissive CORS. No key, no rate limit, no tracking.
- [Data model](https://tid-cmm.com/developers/data-model/): How the model is structured on disk, the JSON Schemas it validates against, and the shape of an assessment file.
- [Model repository](https://tid-cmm.com/developers/repository/): The model and its datasets on GitHub under CC-BY-4.0, and what is not published there.
- [About](https://tid-cmm.com/about/): Who made it, why, where it sits inside UTIOM, and how it pairs with TIR-CMM.
- [Licence](https://tid-cmm.com/licence/): Copyright Reza Adineh. The model, methodology and datasets are free to use with attribution; the assessment tool is free to use but not to redistribute.
- [Privacy](https://tid-cmm.com/privacy/): No cookies, no analytics, no accounts, and nothing you enter is transmitted. What the site stores, where, and how to erase it.
- [Changelog](https://tid-cmm.com/changelog/): Every release, what it added, and whether it was the model or the site that moved — because only a model change makes two scores incomparable.

## Key facts

- The model scores eight domains: threat intelligence, threat modeling, telemetry and detection coverage, detection engineering, adversarial validation, analytics and hunting, incident response, and governance.
- Five integrity constraints are applied mechanically at scoring time, in the order C3, C4, C2, C1. A constraint may only ever lower a score.
- C1 validation ceiling: no domain may exceed the adversarial validation score + 1.
- C2 visibility ceiling: detection engineering may not exceed adjusted telemetry coverage + 1.
- C3 evidence rule: a score of 4 or 5 without a named artefact is counted as 3.
- C4 intent ceiling: telemetry and detection may not exceed max(threat intelligence, threat modeling) + 1.
- 423 techniques, 89% of all Windows techniques in ATT&CK v19.2, have detection analytics referencing Sysmon; for 20 of them it is the only source referenced.
- The Validated Coverage Score counts only techniques scoped as relevant, and validation status expires.

## Data

- Model as JSON: https://tid-cmm.com/api/model.json
- Repository: https://github.com/ReZaAdineH/tid-cmm
- Contact: hello@tid-cmm.com
