05The four dimensions

SECTION 05

Four things to build. Measured separately, read together. The order is not one of importance but of construction: governance first, because it licenses everything after it. The instrument produces four results rather than one; enterprise resilience is set by the weakest dimension , not by the average — so the first investment always goes to the lowest score.

FIGURE 3 — THE UNIFIED ARCHITECTURE

UCSMM — COGNITIVE LAYER

D1 · BUILT FIRST

AI governance

D2

Cyber resilience

D3

Threat detection

D4

Adaptive management

L1 · L2 · L3 · L4 · L5

Each dimension is scored on the same five levels

↑ ↑ ↑

FOUNDATION · ISO/IEC 27001 · NIST CSF · CMMI · Zero Trust

UCSMM sits on existing frameworks and adds four dimensions measured in one structure. Governance is built first because it licenses the rest.

01 · AI governance

Who owns each decision across the model lifecycle, under which document, and with what authority to stop. Not an ethics committee but a traceable accountability path: who authorised deployment, who reviews impact, and who can withdraw a model this week.

Maturity evidence: approved model register · roles & responsibilities matrix · pre-deployment impact assessment · documented stop authority.

02 · Cyber resilience

The ability to absorb an incident, keep operating, recover and learn from it. Protection assumes prevention is possible; resilience assumes failure and asks its cost and duration — with one question added for AI: how do we operate while our model is disabled or untrusted?

Maturity evidence: continuity plans covering model outage · simulation exercises · rollback to a previous version · measured recovery time.

03 · Threat detection

Moving from signature-based to behaviour-based detection: baselines for users, systems and models, with deviation raised as an alert. And what most organisations miss: monitoring the model itself — its output distribution, its accuracy on a reference sample, and the query patterns reaching it.

Maturity evidence: behavioural analytics · model integrity monitoring · integrated threat intelligence · measured true-positive rate.

04 · Adaptive management

Changing controls at the speed of the threat, not the budget cycle. At its core an organisational learning capability: is every incident, lesson and exercise translated into a documented change to a control, a policy or a training programme? An organisation that learns faster than its adversary wins even when it is less well funded.

Maturity evidence: post-incident reviews that produce change · faster risk-register cadence · response automation · indicators reviewed quarterly.