Reza Adineh. Copyright in the model, the descriptors, the datasets, the documentation and the tooling is held by the author. The CC BY 4.0 grant over the model and data is a licence, conditional on attribution, not a transfer of ownership.

Can I use it commercially?

Yes. Assess your own organisation, or assess clients for a fee, without asking. Build a commercial product on the Open Model and Open Data with attribution retained. The only restriction is on redistributing the assessment tool itself.

Do I have to pay for anything?

No. There is nothing to buy, no licence fee, no account and no tier. Free here means free, including for commercial work.

Can I say my organisation is TID-CMM certified?

No. Assessments are self-declared and there is no accrediting body. You can accurately say you assessed against TID-CMM and state the depth of the assessment you ran, which is what the report records.

Can I fork the model and publish my own version?

Yes, under CC BY 4.0, provided you attribute the original and indicate what you changed. That is the point of publishing it openly. What you may not do is redistribute the assessment tool.

Home › Licence

Licence and copyright

TID-CMM — the model, the methodology and the tooling — is the work of Reza Adineh, first drafted in 2022 and published in 2026. All of it is free to use. Two of the three things below are also openly licensed, and the difference matters enough to state it rather than imply it.

The short version. Assess your own organisation with this, or your clients for a fee, without asking anyone. Build on the model and the datasets, with attribution. Do not repackage the assessment tool as your own product.

Licence — three things, three answers

The project ships an Open Model, Open Data and a Free Assessment Tool. All three cost nothing. Two are openly licensed.

What	Licence	You may	You may not
Open Model domains, sub-capabilities, level descriptors, weights, evidence criteria, crosswalks, scoring rules	CC BY 4.0	Use commercially, adapt, build products on it, assess clients for a fee — with attribution	Drop the attribution
Open Data derived ATT&CK datasets, telemetry catalogue, conformance vectors, JSON schemas	CC BY 4.0 (ATT&CK content remains © MITRE)	Redistribute, transform, embed in your own tooling — with attribution	Imply MITRE or this project endorses your product
Free Assessment Tool the browser tool, the offline HTML build and the Excel workbooks	Free to use — not an open-source licence	Use it for anything, including paid client assessment work, unlimited, without asking	Redistribute it, rebrand it, or ship derivative tooling from it

Stated as one sentence, because that is the form it will be quoted in: TID-CMM model content and datasets are openly licensed under CC BY 4.0; the assessment tool is free to use, including for commercial assessment work, but is not licensed for redistribution or derivative tooling.

The short version for consultancies and MSSPs: assess your clients with this and charge for it — that is expressly permitted and needs no permission. Rebuild the model into your own product from the open model and data — also permitted, with attribution. What is not permitted is shipping this tool as yours.

Copyright

Copyright subsists in the expression of this work: the eight domains and their weights, the 58 sub-capabilities, all 348 level descriptors, the evidence criteria, the 5 integrity constraints, the Validated Coverage Score, the telemetry assurance method, the crosswalks, the derived datasets, the documentation on this site and the assessment tooling.

The CC BY 4.0 grant over the Open Model and Open Data is a licence, not a transfer. Copyright remains with the author, and the licence is conditional on attribution. Remove the attribution and the permission lapses.

How to attribute

Anywhere you reproduce, adapt or build on the model or the datasets:

TID-CMM — Threat-Informed Detection Capability Maturity Model
© 2022–2026 Reza Adineh. Licensed CC BY 4.0.
https://tid-cmm.com

For a paper, a report or a citation manager, the repository ships a CITATION.cff file. In prose:

Adineh, R. (2026). TID-CMM: Threat-Informed Detection Capability
Maturity Model (v1.5.0). https://tid-cmm.com

What you may do without asking

Assess your own organisation, as often as you like, and report the result internally or externally.
Assess clients for a fee. Consultancy and MSSP use of the tool in paid engagements is expressly permitted and needs no permission or licence.
Adapt the model — add sub-capabilities, change weights, write your own descriptors — and publish the result, with attribution and an indication that changes were made.
Build a product on the Open Model and Open Data, including a commercial one, with attribution retained.
Redistribute the datasets, in whole or in part, with attribution. MITRE ATT&CK content within them remains © The MITRE Corporation.
Quote the documentation in articles, talks and training material.

What requires permission

Redistributing the assessment tool — the browser tool, its offline build or the Excel workbooks — whether modified or not.
Rebranding the tool or shipping derivative tooling built from it.
Implying endorsement. Using the model does not make a product, service or assessment “TID-CMM certified”. There is no certification scheme and no accrediting body, so any such claim should be read as marketing.

Permission for any of the above is a conversation, not a refusal: hello@tid-cmm.com.

Third-party content

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. ATT&CK content in the datasets is © The MITRE Corporation and used under the ATT&CK Terms of Use. This project is independent and is not affiliated with, endorsed by or sponsored by MITRE, NIST or SOC-CMM.

No warranty

The model and the tool are provided as they are, without warranty of any kind. A maturity score is a management aid, not an assurance of security. Nobody — the author included — can be liable for a decision taken on the strength of a number this tool produced.