Downloads

Artefacts and interop contracts

TIR-CMM is published as an open model with open tooling: a specification, a machine-readable definition of every domain, sub-capability, lattice axis and constraint, and a single-file client-side assessment tool. Some of it exists today. The rest is sequenced for v0.2, and the sequence is published so that nobody has to guess.

This is v0.1, a draft for review. Anything marked Planned below is committed work with a stated dependency, not an aspiration.

The artefacts

Six artefacts, in build order. Each depends on the ones above it, which is why the sequence is what it is: nothing downstream of the machine-readable model can be built until the model is settled.

Build sequence

Published in full, with dependencies, so the order is auditable.

Interop contracts

Two JSON contracts bond the three models. TIR-CMM imports from TID-CMM so that scope, adversaries and detection maturity are inherited rather than re-declared, and exports to UTIOM so that response gaps join detection and governance gaps in one improvement plan.

Both are plain JSON files that you produce and consume yourself. Nothing moves over a network on your behalf.

Import from TID-CMM

Produced by TID-CMM and read at step 1 of the assessment.

What each field does:

• schema — identifies the producing model and version. The bridge requires TID-CMM v1.3, which is the version that adds the substitution rule and this export field set.
• assessed_at — the date of the detection assessment. Response validation expires at twelve months; a detection score older than that is a stale input and should be flagged as one.
• detection_score_pre_substitution — the load-bearing field. It supplies D for constraint R4, which caps RE, CE and FI at D + 1: you cannot respond to what you never saw. It is deliberately the pre-substitution score, because TID-CMM substitutes the TIR-CMM overall into its own IR domain once a response assessment exists. Using the post-substitution figure would feed the response score back into the constraint that governs it. There is no circular inflation, and this ordering is stated in both specifications.
• domains — the eight TID-CMM domain scores, carried for reporting context and for the open question of whether R4 should use the overall score or the lower of overall and DC.
• crown_jewels — each with the asset classes that host it. This assigns criticality tier T1 to the cells that are or host a crown jewel, and drives the weighted Validated Response Score and the blind-cell gate.
• attack_paths — modelled paths, each as a sequence of stages and the asset classes they traverse. A lattice cell is in scope only where the asset class exists and at least one modelled path traverses that stage on that class. Cells on a path to a crown jewel become tier T2.
• actors — priority adversaries with breakout times in minutes. Each one produces its own Containment Margin and Tempo Ratio; the priority actor drives constraint R5.
• in_scope_techniques — techniques scoped by TID-CMM with their coverage status and ATT&CK mitigation M-codes. The M-codes are the traceability bridge: they map to lattice cells, so the response scope derives from the detection scope automatically rather than being re-argued.

Running without an import is supported. Detection maturity is then declared by the assessor, R4 uses that declaration, the report states plainly that the response score rests on an unaudited detection claim, and the overall band is capped at L3.

Export to UTIOM

Produced at step 10 and consumed by UTIOM’s roadmap tool.

What each field does:

• overall — the constraint-adjusted overall maturity, 0.00 to 5.00. This is the figure TID-CMM v1.3 substitutes into its IR domain, annotated with the model version and assessment date.
• band and band_capped_by — the reported band and the constraints that capped it. The honest shock in TIR-CMM arrives in the band rather than the decimal, so the cap is exported explicitly rather than left to be inferred from the number.
• domains — the eight domain scores after constraints, for the radar that superimposes on TID-CMM’s.
• vrs_cj — the crown-jewel weighted Validated Response Score, the reported coverage figure.
• engineered_rate and proven_rate — the proportion of cells at status 2 or better against the proportion at status 3. The gap between them is the headline finding: what an organisation believes it can do, against what it has shown it can do.
• blind_cells_t1t2 — the named list of stage-and-asset-class combinations on a path to a crown jewel where no response option exists at all. A single T1 entry caps the band at L2 under R6.
• tempo — per priority actor: breakout time, the three measured durations, the signed Containment Margin in minutes and the Tempo Ratio. A negative margin means containment lands after the adversary has already moved.
• constraint_adjustments — which constraint touched which domains, and by how much. Because R1 is applied last and is usually the tightest ceiling, the tool computes each constraint’s independent effect as well as its marginal one; without that, R2 and R4 read as “no effect” in exactly the organisations they were written for.
• roadmap — the merged, normalised, dependency-sequenced improvement list: rank, item, impact score and horizon of 90 days, 180 days or 12 months. It names capabilities and authorities required, never products.

UTIOM’s roadmap tool consumes both exports. Its roadmap.html reads the TID-CMM export and the TIR-CMM export together and produces one unified improvement plan across all three pillars — so that a detection gap and a response gap compete for the same budget on the same scale, which is the point of having a single operating model.

Licence

TIR-CMM is free to use, including commercially:

• The model — CC BY-ND 4.0. The domains, sub-capabilities, lattice, constraints, mathematics and crosswalks may be used, shared, quoted and taught with attribution. Derivative or rebranded versions of the model may not be published.
• The schemas and machine-readable model — CC BY 4.0. The JSON Schemas and the JSON and YAML exports may be built against freely, including commercially, with attribution.
• The tooling — source-available, all rights reserved. The assessment tool and the reference server may be run, self-hosted and audited, including on an air-gapped network, but not redistributed as your own product.

Nothing to buy, nothing to install, not vendor-aligned. The model names capabilities and authorities, never products.

Direct downloads

Every published artefact, linked. The model specification and the tooling are covered by the TIR-CMM licence; the schemas and the machine-readable model are CC BY 4.0 so you may build against them freely.