The model

The response half of threat-informed operations

TID-CMM asks one honest question — would we actually see it? TIR-CMM asks the question that follows: could we actually stop it? Not whether playbooks exist, but whether containment lands inside the adversary’s breakout window, with someone permitted to pull the trigger, at the blast radius intended — and whether any of it can be proved.

TIR-CMM is the response module of UTIOM and the companion to TID-CMM. It scores eight domains and 58 sub-capabilities, scores a Containment Lattice of eight attack-path stages crossed with eight asset classes, and applies seven integrity constraints mechanically — lower scores only, and not arguable.

From v0.2 it runs at three depths. Pulse is twenty questions in twenty minutes. Baseline is the 58 sub-capabilities, the lattice and response tempo. Assurance adds telemetry attributes, exercised scenarios and the governance layer. Each tier is a strict superset of the one below, so nothing on this page has to be answered before you are ready to answer it.

Three ways response fails

An organisation claiming 48.9% detection coverage can prove only 12.7%. That is the number TID-CMM produces. TIR-CMM exists because the question after it — could the organisation have acted on what it saw — has never been measured. Three failure modes, structurally parallel to TID-CMM’s three.

The consequence

Organisations invest in detection maturity while remaining structurally unable to act on what they detect. TID-CMM makes visibility honest. Without a matching instrument, response remains the last unmeasured link — and a validated detection that fires into an organisation that cannot contain is a very expensive alarm.

Where it sits

UTIOM organises around three pillars. The two capability maturity modules map cleanly onto two of them, with no overlap.

On the UTIOM V-model, TID-CMM measures the descending arm’s output — what the engineering decisions produced. TIR-CMM measures the ascending arm: whether the design survives contact and is proven by validation. This is why TIR-CMM’s validation domain carries the highest structural leverage in the model.

UTIOM Law 6 — operations functions as continuous incident response — is the load-bearing premise. TIR-CMM does not measure “the IR team.” It measures the organisation’s capacity to act, of which the IR team is one component and frequently not the binding one.

Division of scope

TIR-CMM deliberately contains no detection domain. It consumes detection maturity as an input constraint, R4 — Detection Dependency: RE ≤ D + 1, CE ≤ D + 1, FI ≤ D + 1, where D is the TID-CMM overall score if an assessment is imported, or an assessor-declared detection maturity flagged “unverified” otherwise. You cannot respond to what you never saw.

This is what makes the two models complementary rather than overlapping, and it is the design decision that keeps a combined assessment under two hours.

The eight domains

Weights total 100. Sub-capability counts total 58, matching TID-CMM’s structure so the two radars superimpose. Every sub-capability is scored 0–5. Sub-weights are within-domain and total 100 per domain.

All 58 are scored at Baseline and above. At Pulse, twenty of them are scored and the remaining domain scores are extrapolated from that subset.

Evidence levels

v0.1 asked a yes/no question against every score: is there a named, dated artifact? v0.2 replaces that flag with a level of 0 to 3, and each level carries a cap on the score it will support. The levels and their caps are aligned to TID-CMM’s Validated Coverage grades, so an imported VC grade sets the evidence ceiling directly rather than having to be reinterpreted.

The cap is a ceiling, not a conversion

This is the point on which the whole mechanism turns, and it is the one most often misread. A high evidence grade permits a high score. It does not create one. VC3 evidence against a capability you score 2 leaves the score at 2 — excellent proof of a modest capability is still a modest capability. The cap only ever removes the part of a claim the evidence cannot carry.

Read the other way, the cap is why the evidence level is worth recording honestly. Raising a level to lift a cap does not improve the capability; it removes the finding. The gap between the score you would have given and the score the evidence permits is the finding.

A blank level is level 0

An evidence level left blank is treated conservatively as level 0 — assertion only, capping that sub-capability at 1. It is not waved through and it is not skipped. An assessment that declines to say what its evidence is has answered the question.

Records written against v0.1 still resolve: the old boolean flag meant “a named, dated artifact”, which is VC2, so a true flag imports as level 2 and caps at 4. Nothing has to be rescored.

Attack-path stages

The rows of the Containment Lattice. Each carries a stage leverage λ, which weights a gap at that stage when the roadmap is ranked: a missing option early in the path costs more than a missing option late, because acting early is what changes the outcome.

v0.2 adds S0 — Prevent & Harden ahead of S1, and gives it the highest leverage in the model.

S0 is scored first, and it asks a question the rest of the lattice cannot: whether architecture or controls blunt the behaviour before a response is needed at all. It carries λ = 1.6, higher than any response stage, for a reason that is arithmetic rather than rhetorical. Every other stage improves the odds of winning a race that has already started. S0 shortens the race, or stops it being run. A model that scores only response will systematically undervalue the control that removed the incident, which is the opposite of the behaviour it should encourage.

It maps to ATT&CK Mitigations (M-codes) and D3FEND Harden, so a preventive control inventory already expressed in either vocabulary drops straight into the row. The lattice is therefore 8 stages × 8 asset classes = 64 cells at full extent in v0.2.

Three readiness lenses

The eight domains describe how the capability is built. That is the right structure for improving it and the wrong structure for reporting it: no executive has ever asked how the automation and orchestration domain is doing.

The lenses re-cut the same 58 sub-capabilities against the three outcomes leadership does ask about — can we respond, can we recover, can we keep running. No new questions are asked and no sub-capability is scored twice; this is a second view over the same scores, computed as a weighted mean of the R3-adjusted sub-capability values in each lens.

They are lenses, not partitions. A sub-capability can serve more than one outcome, and eight of them do: RP-3, RP-6, RA-4, RA-6, RE-9, CE-7, CE-8 and FI-1 each appear under two lenses. Nothing is double-counted in the overall score, which remains the domain-weighted figure; the lenses sit beside it, not inside it.

What feeds each lens

Lens weights are 2 for a sub-capability the outcome depends on directly and 1 for one that contributes to it. They are lens weights only: they do not alter domain weights, sub-weights or the overall score. Forty-eight of the 58 sub-capabilities appear in at least one lens; the ten that do not — RE-5, RE-8, RE-10, AO-7, RV-2, RV-4, RV-5, RV-7, RG-1 and RG-5 — are engineering, validation and governance machinery that shows up in the domain scores and in the rehearsal ceiling rather than in an outcome.

Claimed and proven

Each lens reports twice. The claimed figure is the weighted mean as scored. The proven figure applies the rehearsal ceiling from constraint R1 — validation maturity plus one — because an outcome nobody has exercised is an outcome nobody can claim. A lens is not exempt from the constraint that governs every domain.

There is a consequence worth stating before anyone reads a lens chart. Where the rehearsal ceiling binds, it flattens all three proven figures to the same number, since they are all being cut by the same ceiling. Three equal readiness scores say nothing about the balance between responding, recovering and continuing to operate; they say that validation is the binding constraint on all three. In that state the claimed figures are what discriminate between the lenses — and the distance between claimed and proven is itself the finding, because it is the exact size of the readiness that has been engineered and never executed.

Maturity bands

Six bands, identical arithmetic ranges to TID-CMM so the two scores sit on one axis.

Band gates

Three gates sit above the arithmetic. They cap the band regardless of the decimal.

• L4 and L5 are unreachable without supplied tempo evidence. Under R5 — Tempo Ceiling, a Tempo Ratio of 2.0 or above caps the band at L1; a ratio between 1.0 and 2.0 caps it at L2; tempo not supplied at all caps it at L3 and marks the report “tempo unverified.” A response capability structurally slower than the adversary is not a level 3 capability, whatever the documentation says.
• L3 is unreachable with any Tier-1 blind cell. Under R6 — Blind-Cell Gate, a single in-scope cell at criticality T1 with a Response Readiness Status of 0 caps the band at L2. If there is a stage on a crown jewel where you have no response option at all, you are not threat-informed.
• L5 is unreachable below the Assurance tier, and L5 is unreachable without independent review. Under R7 — Assessment Depth & Governance Ceiling, Pulse caps the band at L3 and Baseline caps it at L4; and a self-assessment run without evidence-led scoring, independent calibration and separation of assessor from approver caps at L4 whatever tier it was run at. Twenty questions cannot evidence adaptive maturity, and a result nobody challenged is not assurance.

The honest shock in TIR-CMM arrives in the band, not in the number. In the model’s numerical validation a self-assessed 2.69 became an adjusted 2.32 — a modest decimal move — while the reported band fell from L2 to L1 — Documented, because the gates fired.

Assurance tier

Telemetry attributes

Response depends on evidence, and evidence has properties beyond “we collect it.” Eight attributes are scored 0–5 against each asset class.

Why per asset class, and not per data component

The conventional approach scores these attributes against each ATT&CK data component. That is 106 rows, and it is the single largest cost in a traditional assessment workbook. TIR-CMM asks the same eight questions against the eight asset classes instead: roughly eight rows rather than 106, for very little loss of signal.

The reason it loses so little is that telemetry health is a property of a platform, not of a log type. Retention, timeliness, health monitoring and access protection are set by the pipeline the platform feeds, so the answer is stable across every data component that platform emits. Scoring them 106 times mostly re-records the same eight answers at thirteen times the cost, and the variance it recovers is not what decides whether a responder can act.

The output is a per-asset-class telemetry mean and a named list of weak attributes — anything at 1 or below — which is what a remediation plan needs.

Assurance tier

Scenario validation

Questionnaires reveal claims. Scenarios reveal integration. A scenario traces one business-relevant path from first evidence to trusted recovery, and deliberately tests people, data, tooling, authority, suppliers and communications together. It is the only part of the model that can turn a claimed capability into a proven one, which is why an exercised scenario is the fastest route to lifting the rehearsal ceiling.

Twelve starter scenarios ship with the model, each scored across ten lifecycle stages.

The ten lifecycle stages

Each in-scope scenario is scored 0–5 against every one of these. They are the seams a real incident tests, and they are where integration fails even when each component is individually healthy.

What makes a scenario pass

A scenario passes only when all four of the following hold. Three of the four are about the exercise rather than the answers, which is the point.

• Every one of the ten stages scores above 1. Nothing at or below 1 anywhere in the lifecycle.
• It was exercised, with a date.
• The exercise was timed — an observed recovery time was recorded.
• The observed recovery time met its target.

Pass conditions

The stage scores are judged against these seven conditions, which are what “good” means at each seam:

• Required evidence is generated, retained, accessible and attributable to the correct entities.
• Detection and case transitions occur within the approved response horizon.
• Analysts can explain the hypothesis, affected scope, confidence, impact and next action.
• Authorised containment is feasible, safe, logged, and reversible where it needs to be.
• Forensic evidence is preserved without delaying urgent risk reduction beyond tolerance.
• Recovery meets agreed objectives and validates identity, data, configuration and control integrity.
• Every material deviation becomes a governed finding with an owner and a retest date.

The minimum scenario record

A scenario that cannot be handed to somebody else and re-run is a story. The minimum record is eight items:

• Scenario ID, version, owner, business service, crown jewel and impact
• Actor, access assumptions, platforms and explicit scope exclusions
• Core ATT&CK techniques and environment-specific procedures
• Required telemetry, analytics, case flow, entity joins and known blind spots
• Investigation questions, decision thresholds and containment authority
• Eradication criteria, clean-recovery requirements, RTO/RPO and integrity validation
• Test method, injects, expected results, observed results, timestamps and evidence links
• Findings, owner and retest date

Assurance tier

The governance layer

A populated assessment without controlled scope, evidence, decision rights and retesting is a draft, not an assurance result. This layer is what makes the difference, and it is the part maturity models most often omit.

The eight assurance conditions

Answered yes or no. Three of them — GV-3, GV-4 and GV-5 — decide whether the result is assurance or self-assessment.

Decision rights

Who is entitled to do what to the assessment itself. The line that does most of the work is the third one.

The ten calibration questions

Asked of the assessor, not of the assessed. Each one is designed to find a score that is true on paper and false in practice.

1. What would fail if the primary analyst, engineer, administrator or supplier contact were unavailable?
2. Which score depends on a feature being licensed rather than implemented and tested?
3. Which evidence proves the control works under the current architecture, and not only in a lab?
4. What is the oldest evidence supporting a score above 3, and what has changed since it was collected?
5. Which priority behaviour is visible but cannot be contained inside the required response horizon?
6. Which recovery assumption has not been proven from an isolated or compromised identity state?
7. Which cross-domain entity joins fail across identity, endpoint, cloud, SaaS, network and business evidence?
8. Which alert or case cannot tell the analyst what is believed, why, what is affected, and what to do next?
9. Which accepted risk lacks an expiry, a compensating control, or an accountable business owner?
10. Which closed action has not been independently retested?

Response RACI

Decision rights during an incident, as distinct from decision rights over the assessment. This is the table the RA domain scores against, and the one organisations most often discover they do not have.

Anti-gaming rules

Six ways an assessment is quietly inflated, named so that they can be refused.

• Do not count out-of-scope items in the denominator.
• Do not score the availability of a product feature as an implemented capability.
• Do not use stale tests, screenshots, policies or vendor statements as current operational proof.
• Do not average away critical gates, failed scenarios, incomplete assessment or missing evidence.
• Do not let the assessor be the only approver of their own high scores.
• Do not raise an evidence level to lift a cap. The cap is the finding.

Governance rules

• Critical-gate closure requires accepted evidence and a retest, not a status change in a tracker.
• Risk acceptance must name a business owner, a rationale, a compensating control, an expiry and a reassessment trigger.
• Risk acceptance expires. It never marks the underlying capability as complete.
• A supplier statement may support evidence but never replaces customer-side proof of integration, access, containment and recovery.
• The assessor must not also be the sole approver of high scores or of gap closure.
• Freeze the imported baseline before scoring, so improvement is measured against a stable start.

Reporting to a board

• Show scope, completion, evidence freshness, target and open critical gates beside every average.
• Report business scenarios and survival outcomes before any coverage percentage.
• Separate proven readiness, planned capability and accepted risk. Never merge them into one number.
• Show a trend only when scope, method, target and data lineage are comparable; otherwise explain the break.
• Use a small number of decision-oriented measures and link the detail to owners and actions.

Publication cautions

• Do not publish stage-level weaknesses, evidence locations, rule identifiers, response authorities or recovery details outside their approved audience.
• Remove sensitive system names and operational detail from external reports; keep the full evidence register in the controlled repository.
• State the model version, assessment date, scope, exclusions and evidence limitations alongside any shared score.
• TIR-CMM is a practitioner model. It is not certification, regulatory approval, or endorsement by MITRE, NIST, CISA or FIRST.