The Framework Family

UTIOM is the operating model. Two capability maturity models measure its pillars in depth, and both rest on the same premise: everything a security operations function does is incident response.

The modules do not fill gaps in UTIOM. They add measurement depth. UTIOM defines how security operations should work; a module tells you, with evidence, how well one part of it actually works in your organisation.

UTIOM. The operating model. How should the whole security operation be designed and run? Version 1.2, with four assessment instruments.

TID-CMM. The detection module. Would we actually see the adversaries most likely to attack us? Published at tid-cmm.com. Eight domains, 58 sub-capabilities, aligned to MITRE ATT&CK Enterprise and crosswalked to NIST CSF 2.0 and SOC-CMM.

TIR-CMM. The response module. Could we stop it, inside the breakout window, with the authority to act? Published at tir-cmm.com. Introduces the Containment Lattice and the Containment Margin metric, and measures decision latency separately rather than folding it into MTTR.

RSMM. The Realistic SIEM Maturity Model. Is the SIEM a security tool or expensive log storage? Five levels from Blame Collector to Outcome-Driven SIEM.

STRATA. The organisational model. Strategy, Talent, Resilience, Automation, Telemetry and Adaptability, replacing the People, Process and Technology triad.

16.1 How UTIOM produces what the modules measure#

Crown Jewels produces the asset registry and threat models that TID-CMM uses to derive its in-scope ATT&CK set.

Strategy produces the documented adversary profile that TID-CMM's threat intelligence domain scores.

Threat Visibility produces the telemetry blueprint and accepted gap report that its telemetry assurance computation consumes.

Threat Detection produces the version-controlled, tested, traceable content its detection engineering domain measures.

Validation produces the emulation evidence its adversarial validation domain requires.

Response and Continuous Improvement produce the containment authority, rehearsed playbooks and feedback loops that TIR-CMM measures.

The order matters. TID-CMM and TIR-CMM measure depth in one pillar each. UTIOM decides what that pillar should be pointed at.