The UTIOM website: the Unified Threat-Informed Operations Model, its documentation and four browser-based assessment instruments.
Everything is static. There is no backend, no database and no analytics. The assessment tools run entirely in the browser and store results in local storage on the visitor's own device.
public/ everything served at utiom.de
index.html home
capability.html capability assessment, 105 indicators
maturity.html maturity assessment, 50 staged criteria
metrics.html metrics calculator, 70 metrics
roadmap.html improvement roadmap, combines the three
diagrams/ seven figures and two appendix tables
philosophy/ principles and intellectual foundations
standards-alignment/ mapping to 17 standards and frameworks
security-operations-economics/
nis2-dora-compliance/
... supporting content pages
_headers security headers and caching, applied by Cloudflare
_redirects trailing-slash and legacy URL rules
sitemap.xml robots.txt crawling
utiom-framework-v1.1.pdf the framework book
utiom-assessment-*.xlsx/zip workbook and self-hosting toolkit
Connected to Cloudflare. Pushing to main triggers a build and deploy.
Build command: none. Output directory: public.
cd public
python3 -m http.server 8000
Note that _headers and _redirects are Cloudflare features and are ignored by
a plain local server, so the security headers and redirect rules will not apply.
Every page carries a build stamp in <meta name="build">. If you change an
assessment, update the stated counts wherever they appear: the tool page, the
home page, the toolkit README and the changelog.
Copyright (c) 2026 Reza Adineh. Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0). https://creativecommons.org/licenses/by-sa/4.0/