Resources
Everything here is free to use. Two of the three things below are also openly licensed — and the difference matters, so it is stated rather than implied. No account, no email address, no sales call.
Licence — three things, three answers
The project ships an Open Model, Open Data and a Free Assessment Tool. All three cost nothing. Two are openly licensed.
| What | Licence | You may | You may not |
|---|---|---|---|
| Open Model domains, sub-capabilities, level descriptors, weights, evidence criteria, crosswalks, scoring rules |
CC BY 4.0 | Use commercially, adapt, build products on it, assess clients for a fee — with attribution | Drop the attribution |
| Open Data derived ATT&CK datasets, telemetry catalogue, conformance vectors, JSON schemas |
CC BY 4.0 (ATT&CK content remains © MITRE) | Redistribute, transform, embed in your own tooling — with attribution | Imply MITRE or this project endorses your product |
| Free Assessment Tool the browser tool, the offline HTML build and the Excel workbooks |
Free to use — not an open-source licence | Use it for anything, including paid client assessment work, unlimited, without asking | Redistribute it, rebrand it, or ship derivative tooling from it |
Stated as one sentence, because that is the form it will be quoted in: TID-CMM model content and datasets are openly licensed under CC BY 4.0; the assessment tool is free to use, including for commercial assessment work, but is not licensed for redistribution or derivative tooling.
The short version for consultancies and MSSPs: assess your clients with this and charge for it — that is expressly permitted and needs no permission. Rebuild the model into your own product from the open model and data — also permitted, with attribution. What is not permitted is shipping this tool as yours.
MITRE ATT&CK content in the datasets is © The MITRE Corporation and used under the ATT&CK Terms of Use.
Licence and copyright in full — how to attribute, what you may do without asking, and what needs permission.