v0.2 — the headline change

Three tiers

One model, three depths. Twenty minutes, an afternoon, or a facilitated engagement. Each tier is a strict superset of the one below, so you can start in twenty minutes and deepen later without ever rescoring anything you have already answered.

The v0.1 model was too heavy to start with. It asked for 58 sub-capabilities, a containment lattice, an authority map and three tempo measurements before it would report anything at all — which is the right depth for a result you intend to defend, and entirely the wrong depth for the first conversation. Organisations that could not clear that bar did not get a shallower answer; they got no answer. That was a design failure, not a filter.

v0.2 fixes it by splitting the same model into three depths rather than diluting it into one. Nothing was removed. What changed is where you are allowed to stop.

Each tier carries its own band ceiling: Pulse caps the reported band at L3, Baseline at L4, and Assurance carries no tier ceiling at all. That looks like a penalty for choosing the fast option. It is not.

The depth an assessment reaches is itself evidence about how far the result can be trusted. Twenty questions cannot evidence a claim of adaptive response maturity, however good the answers are — not because the answers are wrong, but because twenty answers do not carry enough of the organisation to support that claim. The ceiling records the strength of the method alongside the strength of the capability, which is exactly what a reader of the report needs in order to know what to do with it.

This is the same logic the model applies everywhere else. Constraint R3 caps a score at the strength of its evidence. Constraint R5 caps the band when tempo is unmeasured. Constraint R4 caps response at the detection it depends on. R7 extends it one level up: it caps the band at the strength of the assessment.

The arithmetic underneath is identical in all three tiers. A Pulse assessment computing 3.4 reports 3.4 — it simply reports the band as L3 rather than L3 with an implied claim to more, and the report says which cap is doing the work. Deepening the assessment does not change the arithmetic; it removes the cap.

Each tier is a strict superset of the one below. Every question in Pulse is a question in Baseline, asked in the same words, scored on the same 0–5 scale, against the same anchors. Every question in Baseline is a question in Assurance. Nothing is reworded, rescaled or reinterpreted between tiers.

The practical consequence is the point of the design: deepening an assessment never costs you the work you have already done. Run Pulse on Monday, and the twenty answers you gave are already 20 of the 58 Baseline answers when you come back to it. Run Baseline, and every one of its eleven steps is already complete when you commission an Assurance engagement. There is no migration, no remapping, and no moment where an organisation is told its earlier assessment does not count.

This matters more than it sounds. The most common reason a maturity assessment is never repeated is that repeating it means starting again. A model that only rewards the deepest tier will be run once, at the wrong depth, by an organisation that was not ready for it — and then never again.

Read down the Pulse column and you have the shortest honest assessment the model can produce. Read across a row and you have the reason the deeper tier exists.

Twenty sub-capabilities, chosen so that every one of the eight domains is represented and the selection is weighted towards the things that most often decide the outcome: authority, rehearsal, and whether containment options exist at all.

Domain scores in Pulse are extrapolated from whichever of that domain's sub-capabilities are in the subset. That is a real approximation, and the report states it rather than hiding it. FI is represented by a single question and its domain score should be read accordingly.

Pulse still runs the domain-level constraints. R1 still caps every domain at rehearsal plus one; R2 still caps automation and containment at authority plus one; R5 still caps the band when tempo is losing or unsupplied. Those are the constraints that produce the finding, and the finding is the reason to run Pulse at all.

The model as v0.1 defined it, plus evidence levels: all 58 sub-capabilities, the Containment Lattice scoped to your crown jewels, the containment inventory, the authority map and the three tempo measurements.

Baseline is where the model does its characteristic work. It is the tier at which the lattice exists, so it is the first tier that can report the gap between engineered and proven coverage — the difference between believing you can act and having shown it. It is also the first tier that asks for an evidence level against every score, which is what makes constraint R3 bite.

The band ceiling is L4. A self-service assessment, however carefully done, is a self-assessment: nobody independent challenged the scores, and no second reviewer looked at the claims above 3. That is enough to support a serious internal improvement programme. It is not enough to support a claim of validated maturity.

Everything in Baseline, plus the three things that turn a populated questionnaire into an assurance result.

Assurance carries no tier ceiling — but it does not follow that an Assurance engagement automatically reaches L5. The other constraints all still apply, and the governance layer adds one of its own: without evidence-led scoring, independent calibration and separation of assessor from approver, the result is a self-assessment and is capped at L4 whatever tier it was run at. Buying the deeper engagement does not lift the ceiling. Doing the governance work does.

Each of the three additions has its own page section: telemetry attributes, scenario validation and the governance layer on the model page.

The honest default is start with Pulse. Twenty minutes costs nothing, the superset guarantee means the answers are not wasted, and the finding it produces is usually enough to decide whether the deeper tier is worth commissioning.

• You have twenty minutes and no prior assessment. Pulse. It will tell you which three things are holding you back, and that is a better starting position than a full assessment you never finish.
• You are the SOC or IR lead and you want an honest internal picture. Baseline. Block out an afternoon, bring the crown-jewel list and the case-system timings, and expect the authority map to surprise you.
• Someone external will read the result. Assurance. A regulator, a board, an insurer or an acquirer will ask who challenged the scores, and a self-assessment has no answer to that question.
• You already ran Baseline last year. Deepen rather than repeat. Response maturity is perishable — lattice cells expire, owners leave, platforms change — so the useful next assessment is the one that adds scenarios and independent calibration, not the one that re-answers the same 58 questions.