Reza Adineh. Copyright in the model, the descriptors, the datasets, the documentation and the tooling is held by the author, all rights reserved. TID-CMM is free to use under the permissions on the licence page; that is a permission, not a transfer of ownership, and not an open-source licence.

Can I use it commercially?

Yes. Assess your own organisation, or assess clients for a fee, without asking. Those are permitted uses and need no licence. Building a product on the model, republishing it, adapting it or embedding it in another product needs written permission.

Do I have to pay for anything?

No. There is nothing to buy, no licence fee, no account and no tier. Free here means free, including for commercial work.

Can I say my organisation is TID-CMM certified?

No. Assessments are self-declared and there is no accrediting body. You can accurately say you assessed against TID-CMM and state the depth of the assessment you ran, which is what the report records.

Can I fork the model and publish my own version?

Not without written permission. Publishing a modified or derivative version of TID-CMM, or presenting an unofficial derivative as TID-CMM, is reserved. Ask, and say what you want to do with it: hello@tid-cmm.com.

Home › Licence

Licence and copyright

TID-CMM — the model, the methodology, the datasets and the tooling — is the work of Reza Adineh, first drafted in 2022 and published in 2026. The current version is free to use under the permissions set out on this page.

Free to use does not mean open source. It is not a public-domain dedication, not an open-source licence, and not permission to redistribute, rebrand or create derivative products. Everything in the first list below needs no permission at all. Everything in the second needs written permission, which is a conversation rather than a refusal: hello@tid-cmm.com.

Permitted without written permission

Reading, studying and citing TID-CMM.
Using the official assessment tool to assess your own organisation.
Using the official tool in paid engagements — consulting and MSSP assessment work included. This is expressly permitted and needs no licence.
Sharing the assessment reports you produce for the organisation you assessed.
Quoting reasonable excerpts for research, education, review and commentary, with attribution.
Linking to this site and to the public TID-CMM model and community project on GitHub.

Requires written permission

Republishing or redistributing the complete model, the datasets, the workbooks or the assessment implementation.
Publishing a modified or derivative version of TID-CMM.
Embedding the model, the scoring specification or the datasets in another commercial software product.
Rebranding, white-labelling or reselling the model or the tool.
Redistributing the offline assessment tool.
Removing TID-CMM or Reza Adineh attribution.
Representing an unofficial derivative as TID-CMM.
Using the implementation as the basis of competing derivative tooling.

Ask, and say what you want to do with it: hello@tid-cmm.com.

Stated plainly

TID-CMM is free to use under the permissions stated here. Free to use does not mean open source, public domain, or permission to redistribute, rebrand or create derivative products. These are the author’s own permitted-use terms: they are not an OSI-approved open-source licence, not a Creative Commons licence and not a dedication to the public domain. The canonical statement of them is https://tid-cmm.com/licence/. If a page, a product or a repository describes TID-CMM as open source, it is wrong.

Copyright

© 2022–2026 Reza Adineh. All rights reserved except as expressly permitted above. Copyright subsists in the expression of this work: the eight domains and their weights, the 58 sub-capabilities, all 348 level descriptors, the evidence criteria, the five integrity constraints, the Validated Coverage Score, the Scenario Coverage Score, the telemetry assurance method, the crosswalks, the derived datasets, the documentation on this site, and the assessment and site implementation.

The assessment and site implementation — the browser tool, the offline single-file build, the workbooks and this site’s own code and styles — is copyright, all rights reserved. It is free to use as stated above; it is not open-source licensed. Because the assessment runs in your browser, the client-side implementation delivered to your browser is technically inspectable. That visibility grants no permission.

Earlier versions keep the licence they were released under

Model 1.5.0 and documents v1.4 were published under CC BY 4.0. Copies distributed under that licence remain under it, and nothing on this page withdraws a permission already granted for material already distributed. The terms above apply to model 1.6.0, documents v1.6 and the current site. The release archive describes the previous release under the licence it was released with.

How to attribute

Wherever you cite or quote TID-CMM:

TID-CMM — Threat-Informed Detection Capability Maturity Model
© 2022–2026 Reza Adineh. Used by permission; see https://tid-cmm.com/licence/
https://tid-cmm.com

For a paper, a report or a citation manager, the public project ships a CITATION.cff file. In prose:

Adineh, R. (2026). TID-CMM: Threat-Informed Detection Capability Maturity Model (v1.6.0). https://tid-cmm.com

Third-party content

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. ATT&CK content inside the datasets is © The MITRE Corporation and is governed by MITRE’s own Terms of Use, not by the terms on this page. Nothing here claims ownership of MITRE content, of public facts, or of third-party standards such as NIST CSF 2.0, ISO/IEC 27001 or SOC-CMM: the crosswalks express this project’s reading of them and nothing more. This project is independent and is not affiliated with, endorsed by or sponsored by MITRE, NIST or SOC-CMM.

Using the model does not make a product, service or assessment “TID-CMM certified”. There is no certification scheme and no accrediting body, so any such claim should be read as marketing.

No warranty

The model and the tool are provided as they are, without warranty of any kind. A maturity score is a management aid, not an assurance of security. Nobody — the author included — can be liable for a decision taken on the strength of a number this tool produced.

Common questions

Who owns TID-CMM?: Reza Adineh. Copyright in the model, the descriptors, the datasets, the documentation and the tooling is held by the author, all rights reserved. TID-CMM is free to use under the permissions on the licence page; that is a permission, not a transfer of ownership, and not an open-source licence.
Can I use it commercially?: Yes. Assess your own organisation, or assess clients for a fee, without asking. Those are permitted uses and need no licence. Building a product on the model, republishing it, adapting it or embedding it in another product needs written permission.
Do I have to pay for anything?: No. There is nothing to buy, no licence fee, no account and no tier. Free here means free, including for commercial work.
Can I say my organisation is TID-CMM certified?: No. Assessments are self-declared and there is no accrediting body. You can accurately say you assessed against TID-CMM and state the depth of the assessment you ran, which is what the report records.
Can I fork the model and publish my own version?: Not without written permission. Publishing a modified or derivative version of TID-CMM, or presenting an unofficial derivative as TID-CMM, is reserved. Ask, and say what you want to do with it: hello@tid-cmm.com.