TOM is the model part of the Evidence-Based cybersecurity approach that I champion, JC, it seems we are mind aligned with just slightly different terminology... :)