SECTION 05
05The four dimensions
Four things to build. Measured separately, read together. The order is not one of importance but of construction: governance first, because it licenses everything after it. The instrument produces four results rather than one; enterprise resilience is set by the weakest dimension, not by the average — so the first investment always goes to the lowest score.
Text in this figure
UCSMM — COGNITIVE LAYER · D1 · BUILT FIRST · AI governance · D2 · Cyber resilience · D3 · Threat detection · D4 · Adaptive management · L1 · L2 · L3 · L4 · L5 · Each dimension is scored on the same five levels · ↑ ↑ ↑ · FOUNDATION · ISO/IEC 27001 · NIST CSF · CMMI · Zero Trust
UCSMM sits on existing frameworks and adds four dimensions measured in one structure. Governance is built first because it licenses the rest.
AI governance
Who owns each decision across the model lifecycle, under which document, and with what authority to stop. Not an ethics committee but a traceable accountability path: who authorised deployment, who reviews impact, and who can withdraw a model this week.
Maturity evidence: approved model register · roles & responsibilities matrix · pre-deployment impact assessment · documented stop authority.
Cyber resilience
The ability to absorb an incident, keep operating, recover and learn from it. Protection assumes prevention is possible; resilience assumes failure and asks its cost and duration — with one question added for AI: how do we operate while our model is disabled or untrusted?
Maturity evidence: continuity plans covering model outage · simulation exercises · rollback to a previous version · measured recovery time.
Threat detection
Moving from signature-based to behaviour-based detection: baselines for users, systems and models, with deviation raised as an alert. And what most organisations miss: monitoring the model itself — its output distribution, its accuracy on a reference sample, and the query patterns reaching it.
Maturity evidence: behavioural analytics · model integrity monitoring · integrated threat intelligence · measured true-positive rate.
Adaptive management
Changing controls at the speed of the threat, not the budget cycle. At its core an organisational learning capability: is every incident, lesson and exercise translated into a documented change to a control, a policy or a training programme? An organisation that learns faster than its adversary wins even when it is less well funded.
Maturity evidence: post-incident reviews that produce change · faster risk-register cadence · response automation · indicators reviewed quarterly.
Tip: use ← → to move between sections.