Scoring & constraints

TIR-CMM scores in the same shape as TID-CMM, so the two results sit on one axis and the workbook formulas transfer. What is new is on this page: a metric for the race against adversary tempo, a constraint that caps capability at the authority to use it, and a constraint that caps response at the detection it depends on.

Two things changed in v0.2. Constraint R3 no longer asks a yes/no question about evidence — it applies a graduated evidence cap derived from an evidence level of 0 to 3. And a seventh constraint, R7, caps the band at the depth of the assessment and the strength of its governance.

The domain scores answer how mature is the capability. These two answer the questions a board actually asks: where can we act, and are we faster than the adversary.

The direct analogue of TID-CMM's Validated Coverage Score, computed across the in-scope cells of the Containment Lattice.

Unweighted:

Crown-jewel weighted — the reported figure:

Three further rates are reported alongside VRS, and they are expected to be the numbers that land in the room:

Detection maturity is a coverage problem. Response maturity is a race. A model that scores response without reference to adversary tempo is measuring paperwork. For each priority actor a with breakout time B(a):

Tempo Ratio drives constraint R5.

Identical in form to TID-CMM, so results are comparable and the workbook formulas transfer. Every sub-capability is scored 0–5; sub-weights are within-domain and total 100 per domain; domain weights total 100.

Not-applicable sub-capabilities are removed from both numerator and denominator. No penalty, no benefit — the same treatment the lattice gives an out-of-scope cell.

The lattice does not feed the overall domain score arithmetically. It is reported alongside it, exactly as TID-CMM reports Validated Coverage Score alongside domain maturity. Conflating them would let broad shallow coverage mask a structural inability to act.

The lattice does, however, bind the score in two other ways: through constraint R6, which caps the band when a Tier-1 cell has no response option at all, and through prioritisation, where cell gaps compete directly with capability gaps for the top of the roadmap.

TID-CMM's central innovation is that constraints apply mechanically, lower scores only, and cannot be argued with. TIR-CMM inherits this exactly and adds three constraints of its own: an authority ceiling, a tempo ceiling, and — new in v0.2 — an assessment-depth and governance ceiling.

The direct analogue of TID-CMM's C1. Response is more exposed to this than detection: a detection rule at least executes automatically every day, whereas a playbook that is never run may not survive first contact with the tooling, the people or the clock.

The constraint with no equivalent in any existing model. It expresses the single most common structural failure in incident response: a technically capable organisation that cannot act because nobody with authority is available, informed, or willing to accept the business impact. Buying a better SOAR does not move this score.

v0.1 asked a yes/no question — is there a named, dated artifact? — and demoted any 4 or 5 that failed it to 3. That was a blunt instrument in both directions. It let a policy document carry a score of 3 unchallenged, and it treated a repeatably validated capability and a screenshot as the same answer.

v0.2 replaces the flag with an evidence level of 0 to 3, and each level caps the score it will support. The levels are aligned to TID-CMM's Validated Coverage grades, so an imported VC grade sets the ceiling directly instead of having to be reinterpreted.

A blank evidence level is treated as level 0 — assertion only — capping that sub-capability at 1. It is not skipped and it is not waved through. An assessment that declines to say what its evidence is has answered the question.

The one exception is Pulse, which does not ask for evidence at all. Rather than penalise twenty answers as though evidence were absent, the cap is switched off for Pulse and the reduced rigour is carried by the L3 band ceiling under R7.

v0.1 records still resolve without rescoring: the old boolean flag meant a named, dated artifact, which is VC2, so true imports as level 2 and caps at 4.

The graduated cap is materially stricter than the flag it replaces. In the worked example below it binds six sub-capabilities where the v0.1 rule bound three, because a level-1 answer now caps at 2 rather than passing at 3 — and every one of those six is a capability the organisation believed it had.

This is the structural hinge that makes TIR-CMM complete TID-CMM rather than duplicate it. It also creates the correct incentive: an organisation cannot reach a high response score by buying response tooling while remaining blind.

The unverified path is deliberately uncomfortable — the report states plainly that the response score rests on an unaudited detection claim, and caps the overall band at L3.

R4 also subsumes the role of TID-CMM's C4 (intent ceiling) for the response module, since the threat modelling that produces the lattice is imported from TID-CMM's TM domain rather than re-assessed here.

Applies to the band, not to domain scores.

This is the constraint that prevents TIR-CMM from becoming a paperwork audit. An organisation can hold excellent playbooks, full automation coverage and a rehearsal programme, and still be losing every race. The tempo cap makes that visible in one number that a board understands.

The response analogue of TID-CMM's structural-gap analysis, and consistent with UTIOM's Law 3 — crown jewels drive resource allocation — and Law 5 — blind spots are architectural choices.

Applies to the band, not to domain scores.

R7 does two jobs with one mechanism. It records how much of the organisation the assessment actually reached, and it records whether anybody independent challenged what it found.

The depth half follows from the tiering. A Pulse assessment scores 20 of the 58 sub-capabilities, has no lattice and asks for no evidence, so it caps at L3. A Baseline assessment scores all 58 with evidence levels and a full lattice, but is self-service, so it caps at L4. Assurance carries no tier cap.

The governance half is independent of tier and applies to any assessment. Three of the eight assurance conditions decide it: GV-3 evidence-led rather than self-declared scoring, GV-4 independent calibration of every score above 3, and GV-5 separation of the person proposing scores from the person approving them. Miss any one of the three and the result is a self-assessment, capped at L4.

The two halves compose, and the lowest cap wins. Commissioning an Assurance engagement does not lift the governance cap on its own — running it with an independent validator does.

The full pipeline was executed numerically against a fictional mid-size European financial services organisation of around 9,000 staff, with a competent but optimistic security team: good preparation, real detection engineering investment, a well-regarded SOAR deployment, tabletop exercises — and no live-fire, no measured decision latency, nothing signed on containment authority. This is the most common profile in the market.

Structural checks passed: domain weights sum to 100, 58 sub-capabilities, and all eight domains' sub-weights sum to 100.

32 in-scope cells — inside the 24–38 design band, and four more than in v0.1 because the S0 Prevent row is now scored. VRS_cj 45.5%, engineered rate 40.6%, proven rate 3.1%. One blind Tier-1 cell: S3 × A1 — privilege escalation on identity infrastructure, no response option at all.

This is the intended shape of the mechanism. TID-CMM's published worked example moves an organisation from a self-assessed 2.44 to an adjusted 2.34 — a deliberately modest drop that demonstrates the mechanism without theatre. TIR-CMM behaves comparably on the decimal, and the honest shock arrives in the band, not the number.

Note what R7 is doing here, and what it is not. It is not the binding cap — R5 is, by three bands — so it costs this organisation nothing. Its job is to be recorded in the report anyway, so that a reader knows the 2.32 was self-scored and never independently challenged. On an organisation whose tempo and lattice were healthy, R7 would be the cap that mattered.

Not one of the top five is a product purchase, and three of five are things this organisation believed it already had. That is the model working.

The two S0 cells at ranks 3 and 4 are new in v0.2, and they arrive there mechanically rather than by advocacy: S0 carries the highest stage leverage in the model, and both cells sit on crown-jewel asset classes at status 1. The model is saying, without being asked to, that hardening identity and backup would buy this organisation more than any further response engineering — which is the correct answer for an organisation losing the race by a factor of five.

Two ranked lists are produced and then merged. Both are mechanical — no advocacy, no facilitator bias.

Identical to TID-CMM's formula:

This surfaces the correct counter-intuitive result: a status-0 cell at S1 on a Tier-0 identity asset outranks a status-2 cell at S7 on a peripheral system, even though the latter feels more urgent during an incident.

From v0.2 the leverage scale starts at S0 — Prevent & Harden, λ = 1.6, the highest value in the model. A preventive gap on a crown jewel therefore outranks every response gap of equal status and tier, because prevention buys the one thing response cannot manufacture, which is time.

The two lists operate on incompatible scales. Maximum capability impact is 0.16 × 0.25 × 3 × 1000 = 120; maximum cell impact is 3 × 1.6 × 3 × 100 = 1440.

Each list is normalised to its own maximum before merging:

This is scale-free and survives any future reweighting. The merged list is then sorted descending. Validation confirms it produces a properly interleaved result whose top five are the live-fire exercising gap, the blind identity-escalation cell, the two crown-jewel prevention cells, and decision-latency measurement — which is the model's central argument, generated mechanically rather than asserted.

1. Anything that lifts a binding constraint is promoted, because it unlocks score elsewhere. In practice, RA and RV work is almost always promoted — which is the model's central argument made arithmetically.
2. Items are grouped into a 90-day / 180-day / 12-month plan, matching UTIOM's roadmap tool.
3. The output names capabilities and authorities required, not products — inherited directly from TID-CMM's design principle.