ABCDEFGHIJKLMNOPQRSTUVWXYZAAAB
1
Cyber Threat Intelligence Capability Maturity Model (CTI-CMM)
2
The Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) is designed to help improve cyber threat intelligence teams support to cybersecurity and risk management functions, leading to improved security outomes. Its goal is to provide a roadmap on how intelligence programs can mature existing support and process constructs to ultimately strengthen the organization's operational resilience. The CTI-CMM is industry sector, organization type, and size agnostic and was inspired by the U.S. Department of Energy's C2M2 cybersecurity framework.

The CTI-CMM offers a stakeholder-first approach to CTI maturity. The CTI-CMM focuses on the implementation and management of CTI best practices associated with information technology (IT), operational technology (OT), and information assets and the environments in which they operate. The model can be used to:

• Enable organizations to effectively and consistently evaluate and benchmark cyber threat intelligence capabilities
• Improve organizational reach and support to cybersecurity and risk management stakeholders
• Establish a roadmap to grow CTI program capabilities and improve existing maturity
• Prioritize investment and actions to improve cyber threat intelligence capabilities
• Share knowledge and best practices on CTI program operations
3
The CTI-CMM Domains
4
The CTI-CMM is organized into 11 "Domains," comprised of "Use Cases" which contain "Practices."
The Use Cases are operational areas where a CTI team should focus its efforts and the Practices are the practical outcomes that should be attained if those efforts are successful.
Each Practice can be scored with an attainment rating from 1-3 and the spreadsheet then calculates the "maturity" score.
There are four progressive CTI maturity indicator levels; CTI0 (Pre-Foundational), CTI1 (Foundational), CTI2 (Advanced), and CTI3 (Leading). See section 4.3 of the CTI-CMM for additional details on maturity levels.

1. Asset, Change, and Configuration Management (ASSET)
2. Threat and Vulnerability Management (THREAT)
3. Risk Management (RISK)
4. Identity and Access Management (ACCESS)
5. Situational Awareness (SITUATION)
6. Event and Incident Response, Continuity of Operations (RESPONSE)
7. Third-Party Risk Management (THIRD-PARTIES)
8. Fraud and Abuse Management (FRAUD)
9. Workforce Management (WORKFORCE)
10. Cybersecurity Architecture (ARCHITECTURE)
11. Cybersecurity Program Management (PROGRAM)
5
Version 1.3 / January 2026
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100