The atomic scoring unit

The Containment Lattice

Response does not vary meaningfully per ATT&CK technique — you isolate a compromised laptop the same way whether the adversary arrived via T1566 or T1190. It varies by where on the attack path you are, and what kind of asset you are acting on.

TID-CMM scores coverage against in-scope ATT&CK techniques. That is the right unit for detection, because detection logic is written per behaviour. It is the wrong unit for response. The atomic unit of TIR-CMM is therefore a lattice cell: one attack-path stage crossed with one asset class.

A cell carries three things — a criticality tier inherited from the crown-jewel mapping, a Response Readiness Status from 0 to 3, and an expiry date. Together they produce the Validated Response Score, the engineered-versus-proven gap, and the blind-cell list.

Attack-path stages — the rows

Eight stages, collapsed from ATT&CK tactics into the boundaries at which a different response decision is available. S0 — Prevent & Harden is new in v0.2 and is scored first, ahead of every response stage.

Stage leverage

Containing early is worth more than containing late. The leverage coefficient λ is used in prioritisation, where a cell’s impact is ω(c) × λ(stage) × (3 − RRS(c)) × 100.

Why S0 carries the highest leverage

S0 — Prevent & Harden asks a question no other row can: whether architecture or controls blunt the behaviour before a response is needed at all. It carries λ = 1.6, above every response stage, and the reason is arithmetic rather than rhetorical. Every other stage improves the odds of winning a race that has already started. S0 shortens the race, or stops it being run.

Prevention buys the one thing response cannot manufacture, which is time.

A model that scored only response would systematically undervalue the control that removed the incident, and would rank a marginal playbook improvement above a hardening change that made the playbook unnecessary. That is the opposite of the behaviour the model should encourage, and it is why prevention now sits inside the lattice rather than beside it.

S0 maps to ATT&CK Mitigations (M-codes) and to D3FEND’s Harden tactic, so a preventive control inventory already expressed in either vocabulary drops into the row without translation. It is scored on the same Response Readiness Status scale as every other cell: a status-3 S0 cell means the hardening is demonstrably in place and has been shown to work, not that a standard says it should be.

Why S7 carries the lowest

S7 is weighted lowest not because impact response is unimportant, but because by S7 the model is measuring damage limitation rather than defence. An organisation whose entire response capability is concentrated at S7 is running a disaster recovery function and calling it incident response — the leverage weighting surfaces this automatically.

The same weighting produces a counter-intuitive but correct result in the roadmap: a status-0 cell at S1 on a Tier-0 identity asset outranks a status-2 cell at S7 on a peripheral system, even though the latter feels more urgent during an incident.

Asset classes — the columns

Eight classes, derived from the “what you run” and “what you protect” steps. Classes not present in the environment are excluded entirely.

Scoping and sizing

Maximum lattice: 8 × 8 = 64 cells. This is deliberately never the working set.

A cell is in scope only when both conditions hold:

1. The asset class exists in the environment, as declared in step 1 of the assessment; and
2. At least one modelled attack path — imported from TID-CMM or declared locally — traverses that stage on that asset class.

Typical in-scope lattice: 24–38 cells. A cell outside scope is marked N/A and excluded from both numerator and denominator, exactly as TID-CMM handles N/A sub-capabilities — no penalty, no benefit.

This is the mechanism that keeps the assessment inside the one-hour promise while giving the model far richer output than a flat questionnaire.

Cell criticality tiers

Each in-scope cell inherits a tier from the crown-jewel mapping.

Response Readiness Status

Each in-scope cell carries a status from 0 to 3, deliberately identical in shape to TID-CMM’s validated-coverage status, so the two lattices read the same way.

The gap between the engineered rate (cells at status 2 or better — “we believe we can act here”) and the proven rate (cells at status 3 — “we have shown we can act here”) is the headline finding the lattice is built to make unavoidable rather than to flatter.

Status 3 expires

TID-CMM expires validation at eighteen months. TIR-CMM expires at twelve months, because response capability rests on people and authority, and organisations change those faster than they change detection logic.

A cell reverts from 3 to 2 on any of the following:

• Twelve months elapsed since last proof
• Change of the tooling that executes the action (EDR swap, SOAR migration, IdP change)
• Change of the on-call or escalation model
• Reorganisation of the response function, or departure of the named owner
• Material architecture change affecting that asset class
• Change of the managed provider or retainer delivering the action

Response maturity is perishable in a way detection maturity is not. This expiry rule is the single most important honesty mechanism in the model.

A worked lattice

The model’s numerical validation was executed against “Meridian Group,” a fictional mid-size European financial services organisation of roughly 9,000 staff with a competent but optimistic security team: good preparation, real detection engineering investment, a well-regarded SOAR deployment, tabletop exercises — and no live-fire, no measured decision latency, nothing signed on containment authority. This is the most common profile in the market.

Thirty-two cells fall in scope, inside the 24–38 design band. The OT/ICS column is excluded entirely: the asset class does not exist in the environment. Four of the thirty-two are the new S0 Prevent row, which is why the total moved from 28 in v0.1.

One blind Tier-1 cell falls out of the grid: S3 × A1 — privilege escalation and credential access on identity infrastructure, with no response option at all. It is a stage on a crown jewel where the organisation would improvise or watch. Under R6 — the Blind-Cell Gate, that single cell caps the reported band at L2 on its own, regardless of the decimal score.

The engineered-versus-proven gap — 40.6% against 3.1% — is the response analogue of TID-CMM’s 48.9% against 12.7%, and is proportionally wider. That is the expected and intended result, since response capability is rehearsed far less often than detection logic is exercised.

Adding the S0 Prevent row widened the gap rather than narrowing it, which is worth noticing. Meridian has hardened its endpoint and network estate to engineered, but its identity and backup estates — the two crown-jewel classes — sit at manual only. Prevention, like response, has been built where it was easy rather than where the crown jewels are.

The mechanical roadmap that follows puts live-fire exercising first, the blind identity cell second, decision-latency measurement third, exercise timing capture fourth and persistence on identity infrastructure fifth. Not one of the top five is a product purchase, and three of the five are things this organisation believed it already had.