# TIR-CMM — Threat-Informed Response Capability Maturity Model

> TIR-CMM measures whether an organisation can act on what it detects — inside the adversary's breakout window, with the authority to do so — and whether it can prove it. It is the response module of UTIOM and the companion to TID-CMM, which measures detection. Free to use with attribution. Version 0.2.

## Key facts

- **Full name**: Threat-Informed Response Capability Maturity Model
- **Version**: 0.2
- **Author**: Reza Adineh (Minimal Cyber)
- **Parent framework**: UTIOM (Unified Threat-Informed Operations Model) — https://utiom.de
- **Companion model**: TID-CMM (Threat-Informed Detection CMM) — https://tid-cmm.com
- **Licence**: model CC BY-ND 4.0; schemas and machine-readable model CC BY 4.0; tooling source-available, all rights reserved
- **Cost**: free to use, including commercially. Nothing to buy.
- **Privacy**: the assessment tool runs entirely in the browser. No data is transmitted or stored remotely.
- **Structure**: 8 domains, 58 sub-capabilities, 7 integrity constraints, 6 maturity bands (L0–L5)
- **Assessment tiers**: Pulse (20 minutes); Baseline (1–2 hours); Assurance (2–4 weeks)

## The question it answers

Detection maturity models ask whether an organisation would observe an attack. TIR-CMM asks whether it could act on it: inside the breakout window, with someone permitted to authorise containment, at the intended blast radius, with evidence that it has been done before.

## Machine-readable

- [Model as JSON](https://tir-cmm.com/data/tir-cmm-model.json): the complete model — domains, sub-capabilities, constraints, scenarios, actions
- [Model as YAML](https://tir-cmm.com/data/tir-cmm-model.yaml): the same data
- [Export schema](https://tir-cmm.com/schemas/tir-cmm-export.schema.json): assessment result contract
- [Import schema](https://tir-cmm.com/schemas/tid-cmm-import.schema.json): TID-CMM handoff contract
- [Full text](https://tir-cmm.com/llms-full.txt): every page as plain text

## Pages

- [About](https://tir-cmm.com/about.html): Status, open questions, changelog and how to contribute.
- [Api](https://tir-cmm.com/api.html): JavaScript library API, JSON Schemas, self-hostable REST server, machine-readable model.
- [Assess](https://tir-cmm.com/assess.html): The free browser-based assessment tool. Runs entirely client-side.
- [Crosswalk](https://tir-cmm.com/crosswalk.html): Alignment to D3FEND, RE&CT, ATT&CK Mitigations, NIST SP 800-61r3, CSF 2.0, ISO 27035, DORA and NIS2.
- [Downloads](https://tir-cmm.com/downloads.html): Specification, machine-readable model, schemas and the standalone tool.
- [Faq](https://tir-cmm.com/faq.html): Direct answers to common questions about the model.
- [Glossary](https://tir-cmm.com/glossary.html): Defined terms: Containment Lattice, MTTDecide, breakout time, VRS and others.
- [Guide](https://tir-cmm.com/guide.html): How to run an assessment, including standalone without TID-CMM.
- [Index](https://tir-cmm.com/): Home. What TIR-CMM is and the three assessment tiers.
- [Lattice](https://tir-cmm.com/lattice.html): The Containment Lattice: eight attack-path stages by eight asset classes.
- [Licence](https://tir-cmm.com/licence.html): Licence terms: model CC BY-ND 4.0, schemas CC BY 4.0, tooling source-available.
- [Model](https://tir-cmm.com/model.html): The eight domains, 58 sub-capabilities, evidence levels and maturity bands.
- [Scoring](https://tir-cmm.com/scoring.html): Scoring mathematics, the seven integrity constraints, and the worked example.
- [Tiers](https://tir-cmm.com/tiers.html): Pulse, Baseline and Assurance — the three assessment depths.
- [What Is Tir Cmm](https://tir-cmm.com/what-is-tir-cmm.html): Canonical definition, purpose, and position in the UTIOM family.