Open dataCC BY 4.0
Download, cite, embed
The whole framework is data. Use it in your own tooling, cite it in a policy, or put the assessment on your own site.
Data files
JSON · CC BY 4.0- JSON taxonomy.json 9 risk domains, 92 terms, 137 signals, 481 indicators, cohorts (each Easy, Medium or Hard), sequences, breach scenarios, stages, sources, grade metrics. Download
- JSON maturity-model.json 5 levels, 6 practices with criteria, evidence and next-level actions, 71 playbooks (each Easy, Medium or Hard), crosswalks. Download
- JSON assessment.json The 18 questions, options and levels, profile questions, consent text and level CTAs. Download
Also: index.json (a compact search index of every entity) and llms.txt for answer engines.
Every collection as CSV
14 files · UTF-8One file per collection, for a spreadsheet or a database. Every value is in double quotes; a list of identifiers is separated by spaces, a list of sentences by " | ".
| File | What a row is | Rows |
|---|---|---|
| signals.csv | One row per signal: risk domain, dimension, polarity, source, breach scenarios, NIST CSF 2.0 and MITRE ATT&CK. | 137 |
| indicators.csv | One row per library indicator: risk domain, category, dimension, polarity and subject. | 481 |
| cohorts.csv | One row per cohort: class, difficulty (Easy, Medium or Hard), risk domain, formula, signals and breach scenarios. | 24 |
| sequences.csv | One row per sequence: window, breach scenario, the signals in order and their ATT&CK tactics. | 11 |
| sequence-steps.csv | One row per step of each sequence: signal, ATT&CK tactic and stage. | 42 |
| breach-scenarios.csv | One row per breach scenario: anchor, SOC signals, NIST CSF 2.0 and MITRE ATT&CK. | 10 |
| risk-domains.csv | One row per risk domain: scope, definition, the three dimensions and the standards crosswalk. | 9 |
| terms.csv | One row per concept term in the glossary: layer, parent, synonyms and definition. | 92 |
| maturity-levels.csv | One row per maturity level: tagline, NIST CSF tier and typical owner. | 5 |
| maturity-practices.csv | One row per practice: the question it answers, its weight and the risk domains it covers. | 6 |
| maturity-criteria.csv | One row per practice and level: criteria, evidence and next-level actions. | 30 |
| playbooks.csv | One row per playbook: practice, level, difficulty (Easy, Medium or Hard; a quick win is Easy), owner, weeks and the metric that proves it worked. | 71 |
| mappings-nist-csf.csv | One row per mapping from a risk domain, signal, breach scenario or term to a NIST CSF 2.0 outcome. | 236 |
| mappings-mitre-attack.csv | One row per mapping from a risk domain, signal, breach scenario or term to a MITRE ATT&CK technique. | 137 |
License and attribution
The Human Risk Management Framework is published under the Creative Commons Attribution 4.0 International license. You may copy, adapt and build on it, including for commercial use, if you credit the source. Keep the identifiers (for example SE-B-04 or HRM-MEAS-03) when you reuse an entry so readers can find the canonical definition.
Living Security. Human Risk Management Framework 2.0.0. 2026-10-29. https://www.humanriskmanagement.com. Licensed CC BY 4.0.The badge
After the assessment, show the level on your site or in a deck. The badge links to the level's criteria so a reader can see what it means.
<a href="https://www.humanriskmanagement.com/maturity-model/level-3"><img src="https://www.humanriskmanagement.com/badge/level-3.svg" alt="Assessed at level 3 of the HRM Maturity Model" width="220" height="48"></a>Replace the level number with yours. The badge states the self-reported level; it is not a certification.
Embed the assessment
The assessment runs inside an iframe with the same engine and the same open results. Leads captured in the embed carry the embedding page as the entry page.
<iframe src="https://www.humanriskmanagement.com/embed/assessment" title="HRM Maturity Assessment" width="100%" height="900" style="border:0;max-width:760px" loading="lazy"></iframe>Source
The scoring engine, the content schemas and the validation script that enforces referential integrity are published with the sites' source code. To be confirmed: the public repository URL, once the code is released.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.