Toolkit
UTIOM · Capability Assessment

Where does your security operation actually stand?

Ninety-three indicators covering the full UTIOM lifecycle, grouped by the framework's three pillars. Score each honestly and you get a position per pillar and per domain, plus the specific gaps worth closing first.

Score what is true today, not what is planned. An indicator counts as measured only if someone could produce the number this week without starting a project. Indicators marked KPI map to a metric in the framework. Those marked AUTO describe the automated end-state the framework treats as the mature form of that activity.
Not started
0/93

Your UTIOM position

Scores are grouped by the three pillars. The overall level weights the lowest domain rather than the mean, because each lifecycle phase depends on the one before it. A foundational gap cannot be offset by operational strength.

0

Capability profile

Each axis is a domain. The further from centre, the stronger the capability.

Risk reduction leverage

Where the same unit of effort buys the most operational risk reduction, accounting for lifecycle dependencies.

Influence and constraint

How each phase limits the one that depends on it. A phase built far ahead of its foundation returns less than its score suggests.

Operational risk exposure today
If the top three reach level 4
Reduction available

A directional model, not an actuarial estimate. Exposure weights each domain by its leverage in the lifecycle and discounts downstream gains when upstream phases are weak, so improving detection while visibility is thin returns less than the raw score suggests.

Close these first

    Open metrics calculator