<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security Program Maturity Assessment — API Reference

## Maturity Assessment Schema

```json
{
  "domain": "incident_response",
  "maturity_level": 3,
  "maturity_description": "standardized, comprehensive docs, proactive",
  "evidence": {
    "documentation": true,
    "formal_process": true,
    "metrics": false,
    "automation": false
  },
  "target_level": 4,
  "gap": 1.0
}
```

## Agent Commands

```bash
# Assess single domain
node agent.js --action assess --domain incident_response --input evidence.json

# Score overall program
node agent.js --action score --input domains.json

# Generate maturity report with roadmap
node agent.js --action report --input domains.json --target 3.5 --output report.json
```

## Maturity Model Comparison

| Level | CMMI | NIST CSF Tier | C2M2 MIL |
|-------|------|---------------|----------|
| 1 | Initial | Partial | MIL 0 |
| 2 | Managed | Risk Informed | MIL 1 |
| 3 | Defined | Repeatable | MIL 2 |
| 4 | Quantitative | Adaptive | MIL 3 |
| 5 | Optimizing | — | — |
