TIR-CMM vs MITRE D3FEND — a countermeasure ontology and a response maturity model do different jobs

MITRE D3FEND is a knowledge graph of defensive countermeasures — seven tactics, a formal ontology, no scores. TIR-CMM is a maturity model that measures whether response works against the adversary's clock. D3FEND names the countermeasure; TIR-CMM measures whether yours is authorised, rehearsed and fast enough. Run both: they answer different questions.

What is MITRE D3FEND?

MITRE D3FEND is a knowledge graph of cybersecurity countermeasures, built by MITRE with NSA funding and published at d3fend.mitre.org. The current ontology release is 1.5.0, dated 31 July 2026, shipped alongside UI version 0.24.0 — both figures are stated on D3FEND's own version page. D3FEND reached general availability at ontology 1.0.0 on 20 December 2024, and MITRE has published six ontology releases in the twenty months since: 1.0.0, then 1.1.0 (21 April 2025), 1.2.0 (1 August 2025), 1.3.0 (16 December 2025), 1.4.0 (31 March 2026) and 1.5.0.

The D3FEND matrix has seven top-level tactics: Model, Harden, Detect, Isolate, Deceive, Evict and Restore. That set is verified against both the live matrix at d3fend.mitre.org and the D3FEND Tactic column of the published d3fend.csv spreadsheet. MITRE does not publish a headline technique total on the matrix page — the technique inventory, several hundred entries carrying D3- identifiers, is distributed in d3fend.csv and in the TTL, JSON-LD and RDF/OWL ontology files rather than advertised as a single number. Any technique count you see quoted elsewhere is a snapshot of one release, and the releases move.

The Digital Artifact Ontology is the mechanism

D3FEND's central construction is not the matrix — it is the Digital Artifact Ontology. The founding paper, Toward a Knowledge Graph of Cybersecurity Countermeasures by Peter E. Kaloroumakis and Michael J. Smith of MITRE, published in 2021 and built from an analysis of over 500 countermeasure patents, defines digital artefacts in what it calls the archaeological sense: the objects a cyber actor touches inside a computer system. Offensive and defensive techniques are both related to those artefacts through typed relations — produces, executes, analyzes, accesses. Because a defensive technique analyses an artefact that an offensive technique produces, the defence-to-offence relationship can be inferred rather than hand-curated. That is the reason D3FEND is a knowledge graph and not a spreadsheet, and it is genuinely elegant work.

Where ATT&CK Mitigations fit

ATT&CK Mitigations are the coarser sibling. MITRE ATT&CK lists 44 Enterprise mitigations, numbered in the range M1015 to M1060, each a broad control statement such as Network Segmentation or Multi-factor Authentication. D3FEND publishes an ATT&CK Mitigations to D3FEND mapping whose table covers 56 mitigation identifiers between M1013 and M1056, and that page is candid about its own gaps: M1017 User Training is annotated as outside D3FEND's scope, and M1013 Application Developer Guidance awaits a future taxonomy of source-code hardening techniques. A mitigation says do segmentation. A D3FEND technique says which specific mechanism, acting on which artefact. Neither says whether yours is switched on, or how long it takes to fire.

What TIR-CMM measures

TIR-CMM measures one thing: whether an organisation can stop an intrusion inside the adversary's breakout window, with someone permitted to act, and prove it. The model holds 8 domains and 58 sub-capabilities with weights summing to 100, scored 0–5 against six maturity bands from L0 Improvised to L5 Adaptive. Response is assessed on a Containment Lattice of 8 attack-path stages × 8 asset classes = 64 cells, of which a typical in-scope set is 24–38.

Three mechanisms do the honest work. Seven integrity constraints (R1–R7) only ever lower a score, never raise it — R2, the authority ceiling, holds automation and containment to at most one band above Response Authority. Evidence is a ceiling, not a conversion: VC0 caps a sub-capability at 1, VC1 at 2, VC2 at 4, VC3 at 5 — and a VC3 artefact behind a capability you scored 2 leaves it at 2. And TIR-CMM measures MTTDecide — the interval between knowing and being authorised to act — separately from MTTR, because inside MTTR that interval is invisible. Assessment runs at three depths: Pulse (20 minutes, caps at L3), Baseline (1–2 hours, caps at L4) and Assurance (2–4 weeks, no depth ceiling). See the model and scoring and constraints.

Side by side

Do TIR-CMM and D3FEND overlap?

TIR-CMM uses D3FEND as one of its four anchoring ontologies, so the overlap is deliberate and declared rather than accidental. The standards alignment page names the division: D3FEND supplies the countermeasure vocabulary, RE&CT supplies the response-action spine across RA1000–RA6000, ATT&CK Mitigations carry traceability from detection scope to response scope, and NIST SP 800-61r3 provides the governance crosswalk.

Concretely, three of D3FEND's seven tactics — Isolate, Evict and Restore — are the response-side ones, and TIR-CMM's CE domain (Containment, Eradication & Recovery, weighted 14%) maps onto exactly those three. Model and Harden map to the RP preparation domain. The containment primitives held per asset class in the Containment Lattice — revoke session, network-isolate, quarantine principal, immutable snapshot — are D3FEND vocabulary applied to a specific column of the lattice. Sub-capability RE-8 scores whether an organisation's response actions are mapped bidirectionally to RE&CT RA-codes or D3FEND techniques, which means a D3FEND-literate organisation starts that sub-capability ahead.

Four TIR-CMM domains have no D3FEND counterpart at all, and the crosswalk marks them with an em dash rather than fudging: RA (authority), FI (forensics), RV (validation) and RG (governance). D3FEND is not deficient for that. Authority, rehearsal and governance are not countermeasures, so a countermeasure ontology correctly has nothing to say about them.

Where D3FEND is stronger

D3FEND is better than TIR-CMM at almost everything TIR-CMM does not attempt. D3FEND covers the entire defensive surface — hardening, detection, deception — where TIR-CMM covers response and stops. D3FEND is machine-readable in TTL, JSON-LD and RDF/OWL, exposes an API with endpoints for techniques, tactics, artefacts and weaknesses, and ships D3FEND CAD for building semantic defence diagrams that import STIX 2.1. The ontology repository is MIT-licensed. It is maintained by MITRE on a roughly quarterly cadence, has an institutional lifespan TIR-CMM has not earned, and is the closest thing the industry has to an agreed definition of what a countermeasure is.

If your problem is that two teams, or a team and a vendor, cannot agree on what a control does — if procurement is comparing four products that all claim "isolation" — D3FEND is the right instrument and a maturity model is not. Use D3FEND instead of TIR-CMM if you need precise vocabulary, product-to-capability mapping, or a machine-readable graph you can reason over. TIR-CMM will not give you any of those.

Where TIR-CMM is stronger

TIR-CMM answers three questions D3FEND deliberately does not ask. Does your countermeasure work? D3FEND describes D3-CR Credential Revocation; TIR-CMM asks whether you have executed it against a clock in the last 12 months, and expires the proof at 12 months rather than TID-CMM's 18 because response rests on people and authority, which change faster than detection logic. How fast? TIR-CMM computes a Tempo Ratio of (MTTD + MTTDecide + MTTC) divided by breakout time, and constraint R5 caps the band at L1 when that ratio reaches 2.0 and at L2 from 1.0. Is anyone allowed to fire it? Constraint R2 holds the automation and containment domains to at most RA + 1, which is the mechanism that stops a well-tooled organisation scoring highly while nobody on the night shift may isolate a domain controller.

None of that is a criticism of D3FEND. A taxonomy that also graded you would be a worse taxonomy — it would have to make assumptions about your environment, your adversaries and your risk appetite, and it would stop being a neutral shared vocabulary the moment it did.

Can you use both?

Using D3FEND and TIR-CMM together is the intended configuration, not a compromise. The practical sequence is: name your containment options in D3FEND vocabulary so that everyone means the same thing; place those options into the lattice cell they actually serve, one attack-path stage against one asset class; then score each cell 0–3 on Response Readiness Status, where 2 means engineered and 3 means proven within the recency window. D3FEND gives you the columns' contents. TIR-CMM gives you the grade and the gap.

TIR-CMM is built to expect a particular result from an organisation with good D3FEND mappings: strong coverage of named countermeasures, a large gap between the engineered rate (cells at status 2 or above) and the proven rate (cells at status 3), and one or two Tier-1 blind cells that trigger constraint R6 and cap the whole assessment at L2. Knowing the name of a countermeasure you have never fired does not move the number, which is the point.

Which should you run?

If you need a shared, precise, machine-readable vocabulary for defensive technology — for procurement, architecture, vendor comparison or research — run D3FEND, and do not expect a score. D3FEND is not a maturity model, carries no levels and grades nothing, and MITRE has never claimed otherwise.

If you need to know whether your response capability is authorised, rehearsed and faster than your adversary, run TIR-CMM — start with a Pulse assessment at 20 minutes, which caps at L3, and move to Baseline when you want a defensible number. Then map your containment primitives to D3FEND identifiers so the roadmap you produce is written in a vocabulary the rest of the industry already reads.

If you are choosing only one and you have no measurement problem, choose D3FEND. It is the more broadly useful artefact and it will outlive most models on this site. TIR-CMM earns its place only when the question has become are we fast enough, and can we prove it — and at that point a taxonomy, however good, will not answer you.