An open framework,published and maintainedby one company.

What it is

An open framework for human risk in three parts: the HRM Taxonomy (what to measure: 9 risk domains, 137 signals, 24 cohorts, 11 sequences and 10 breach scenarios), the HRM Maturity Model (how mature a program is) and the initial assessment (where a program stands today). New to the words? Start with the key terms.

Why it exists

Programs that count completions cannot show that risk went down. A shared vocabulary and a verifiable maturity ladder let a security leader place a program honestly, plan the next quarter, and compare with peers on the same terms. Any tool that produces the evidence meets it.

Who publishes it

Living Security, a human risk management company founded in 2017 and based in Austin, Texas, published the 1.0 framework on this site. Version 2.0.0 is a Living Security publication, maintained by Living Security. Product mentions on this site are confined to modules marked "How Living Security helps" and to the meeting link.

License

The framework is published under the Creative Commons Attribution 4.0 International license (CC BY 4.0). You may copy, adapt and build on it, including for commercial use, if you credit the source. The citation is on the download page.

How it is maintained and changed

• Anyone can suggest a change: every entry page has a "Suggest a change" button, and the Get involved page lists the other ways in.
• Changes are proposed as issues against the data files (the JSON downloads are the source of truth) and reviewed by the maintainers.
• A criterion is accepted only if it is observable, vendor-neutral and ordered after the previous level's criteria (see the methodology).
• Identifiers never change meaning. A retired entry stays in the files with a retired flag. Each release gets a version and an entry in the changelog that ships with the data files.
• Benchmark rules (cohort minimum, consent basis, what is stored) change only with a new consent version.

Send proposals and questions about the framework through Suggest a change.

Versions

This is version 2.0.0, released 2026-10-29. Each release has a version number and an entry in the changelog that ships with the data files. The pages, the downloads and the data package always describe the same version, and the version is part of the citation, so a policy that cites one version keeps meaning the same thing after the next.

What it is not

The initial assessment is self-reported and the badge is not a certification. The framework does not score individuals; person-level data belongs in a program's own governance, which the framework describes under governance terms.

At the 2.0.0 release (2026-10-29) the HRM Benchmark holds no consented records; its first edition publishes when 25 organizations have contributed. A record is sent to the benchmark store only when the person who took the assessment consents, and it is deleted on request through the privacy contact named on the company site's privacy page.