What are the TID-CMM integrity constraints?

TID-CMM applies five constraints mechanically at scoring time. C1, the validation ceiling, prevents any domain scoring more than one level above adversarial validation. C2, the visibility ceiling, prevents detection engineering exceeding telemetry coverage by more than one level. C3, the evidence rule, downgrades any score of 4 or 5 that has no named artefact to 3. C4, the intent ceiling, prevents telemetry and detection exceeding threat intelligence and threat modeling by more than one level.

Can a TID-CMM constraint increase a score?

No. Every constraint is a ceiling and may only lower a domain score. They are applied in the order C3, C4, C2, C1, and C2 is measured against the already adjusted telemetry score so that it cannot restore a score an earlier constraint removed.

Home › Methodology › Integrity constraints

The five integrity constraints

A maturity self-assessment flatters itself unless something stops it. These five rules are applied mechanically at scoring time, in the order C3 → C5 → C4 → C2 → C1, each capping the thing it depends on. A ceiling may only ever lower a score.

ID	Name	Rule
C1	Validation ceiling	No domain may be scored above the AV domain score + 1. You cannot claim measured, validated detection engineering if you have never emulated an adversary against it.
C2	Visibility ceiling	DE (Detection Engineering) may not exceed DC (Telemetry & Detection Coverage) + 1. Detection logic cannot be more mature than the telemetry it runs on.
C3	Evidence rule	Any score of 4 or 5 requires a named artefact recorded in the evidence field. Unevidenced 4s and 5s are downgraded to 3 by the scoring engine in strict mode.
C4	Intent ceiling	DC and DE may not exceed max(TI, TM) + 1. Telemetry and detection content cannot be more mature than the strategy directing them. Sensors without architectural intent produce noise, not defence.
C5	Inherited intent ceiling	TI.2 may not exceed level 2 where the adversary set was accepted from the tool's suggested threat profile without modification. Accepting it unchanged means the question TI.2 asks — who are you defending against, and how do you know? — was answered by the tool, not by you. Reviewing the set lifts the ceiling: add an actor, remove one, or record why one was excluded.

Why the order matters

The sequence is causal, not arbitrary: strategy directs telemetry, telemetry carries detection, and validation proves it.

C3 at sub-capability level — a 4 or 5 with no named artefact becomes 3.
C5 at sub-capability level — if the adversary set was accepted from the suggested threat profile unmodified, TI.2 caps at 2. Applied here rather than to the whole domain, because how the actor list was produced says nothing about the rest of your intelligence capability.
Compute raw domain scores.
C4 — cap DC and DE at max(TI, TM) + 1.
C2 — cap DE at adjusted DC + 1.
C1 — cap every other domain at adjusted AV + 1.

C2 is measured against the adjusted telemetry score, not the raw one. Against the raw figure a ceiling could restore a score that C4 had already removed — which would let an organisation with no intelligence and no threat modeling keep a detection engineering score the model requires it to lose.

What each one prevents

C1 — validation ceiling

An untested capability is an assumed capability. The one-level margin acknowledges that a capability can be well-built before it is validated — but only just. In the worked example this single constraint pulls four domains down and identifies the one investment that would raise all of them.

C2 — visibility ceiling

Detection logic cannot outperform its inputs. It is the cheapest constraint to breach accidentally, because buying content is easier than onboarding telemetry.

C3 — evidence rule

In any process where an unevidenced claim scores the same as an evidenced one, assertion drives out evidence. What counts as evidence.

C4 — intent ceiling

Sensors and content without architectural intent produce noise, not defence. An organisation with strong telemetry, a large rule estate, no intelligence input and no attack path modelling has DC and DE held at 1 — usually the most uncomfortable and most useful number in the assessment.

C5 — inherited intent ceiling

The tool offers a suggested threat profile: declare your sector and region and it ranks the adversaries ATT&CK documents against organisations like yours. That makes the hardest step in an assessment tractable, and it is offered precisely because scoping is where assessments stall.

But TI.2 asks who are you defending against, and how do you know? If you accept the suggestion unchanged, the honest answer is that the tool knows and you inherited it — so TI.2 caps at 2. A model that supplies its own answer and then scores you on it is grading its own homework.

The ceiling lifts as soon as you engage with the list. Add an adversary the suggestion missed, remove one that does not apply to you, or record why you accepted one. Any of those is threat intelligence work, and the cap comes off. The constraint is not there to punish using the feature — it is there so that using it without thinking cannot look identical to doing the analysis.

This also makes the shortcoming visible as a finding rather than hiding it: a report carrying the C5 cap tells a reader exactly how the adversary set was produced.

Verifying the arithmetic

The constraints are published as a specification and as conformance vectors: complete assessments with the scores a conforming implementation must produce. Every constraint binds in at least one case, and one case has three binding at once. See the repository.