# CTEM.org (Continuous Threat Exposure Management)

> CTEM.org is an open, community-driven standard for labeling security exposure types with CTEM identifiers (CTEM-IDs), plus guidance on implementing the CTEM program.

## What is CTEM?

CTEM (Continuous Threat Exposure Management) is Gartner's five-stage framework for systematically reducing security exposure:

1. **Scoping** - Define what matters to protect
2. **Discovery** - Find vulnerabilities and exposures
3. **Prioritization** - Rank risks by business impact
4. **Validation** - Test that controls work
5. **Mobilization** - Coordinate remediation

## What are CTEM Identifiers?

CTEM Identifiers (CTEM-IDs) are standardized labels for security exposures—similar to how CVE numbers identify software vulnerabilities. CTEM-IDs cover exposure types that CVE does not: credential leaks, lookalike domains, infected devices, misconfigurations, ransomware data dumps, and more.

## Primary References

- Homepage: https://ctem.org/
- What is CTEM? (definitive guide): https://ctem.org/docs/what-is-continuous-threat-exposure-management
- Getting Started with CTEM (90-day pilot roadmap): https://ctem.org/docs/getting-started
- CTEM Identifiers catalog: https://ctem.org/docs/identifiers
- CTEM Specification: https://ctem.org/docs/specification
- Resources (logos, data feeds): https://ctem.org/resources
- Updates & Changelog: https://ctem.org/docs/updates

## CTEM Stages

- Stages Overview: https://ctem.org/docs/stages/
- Scoping: https://ctem.org/docs/stages/ctem-scoping
- Discovery: https://ctem.org/docs/stages/ctem-discovery
- Prioritization: https://ctem.org/docs/stages/ctem-prioritization
- Validation: https://ctem.org/docs/stages/ctem-validation
- Mobilization: https://ctem.org/docs/stages/ctem-mobilization

## CTEM Comparisons

- Comparisons Overview: https://ctem.org/docs/comparisons/
- CTEM vs Vulnerability Management: https://ctem.org/docs/comparisons/ctem-vs-vulnerability-management
- CTEM vs Exposure Management: https://ctem.org/docs/comparisons/ctem-vs-exposure-management
- CTEM vs EASM/CAASM: https://ctem.org/docs/comparisons/ctem-vs-easm-caasm
- CTEM vs BAS: https://ctem.org/docs/comparisons/ctem-vs-bas
- CTEM vs Penetration Testing: https://ctem.org/docs/comparisons/ctem-vs-pentesting

## Identifier Categories

### Brand Impersonation (BND)
Counterfeit products or sites using your branding.
- Category page: https://ctem.org/docs/brand-impersonation/
- CTEM-BND-1: Counterfeit Product Offered for Sale or Use

### Credential Dump (CRD)
Leaked credentials tied to corporate hostnames.
- Category page: https://ctem.org/docs/credential-dump/
- CTEM-CRD-1: Employee Credentials Dumped Publicly
- CTEM-CRD-2: Vendor System Dump with Credentials

### Financial Information (FIN)
Corporate bank/routing data exposure.
- Category page: https://ctem.org/docs/financial/
- CTEM-FIN-1: Corporate Bank Account / Routing Information Exposed
- CTEM-FIN-2: Accounts Payable Information Exposure

### Infected Device (INF)
Infected devices (corporate, vendor, employee-owned).
- Category page: https://ctem.org/docs/infection/
- CTEM-INF-1: Infected Corporate-Owned Device
- CTEM-INF-2: Infected Vendor-Owned Device
- CTEM-INF-3: Infected Employee-Owned Device (Corporate Credentials)
- CTEM-INF-4: Infected Employee-Owned Device (Personal Use of Corporate Identity)
- CTEM-INF-5: Infected Customer-Owned Device
- CTEM-INF-6: Infected Employee-Owned Device (Internal Network Connected)
- CTEM-INF-7: Infected Employee-Owned Device (3rd Party Business Use)

### Lookalike Domains (DOM)
Typosquatting, homoglyph, phishing domains.
- Category page: https://ctem.org/docs/lookalike-domains/
- CTEM-DOM-1: Typo-Squatted Domain
- CTEM-DOM-2: Homoglyph Attack Domain
- CTEM-DOM-3: Phishing Indicator Domain
- CTEM-DOM-4: Brand Impersonation Domain

### Ransomware (RAN)
Data leaked via ransomware attacks.
- Category page: https://ctem.org/docs/ransomware/
- CTEM-RAN-1: Ransom Dump (Supplier)
- CTEM-RAN-2: Ransom Dump (Customer)

### Source Code Exposure (SRC)
Public repository exposures.
- Category page: https://ctem.org/docs/source-code/
- CTEM-SRC-1: Public Repository - Company Sanctioned
- CTEM-SRC-2: Public Repository - Employee Created
- CTEM-SRC-3: Public Repository - Vendor Owned
- CTEM-SRC-4: Public Repository - Unrelated 3rd Party
- CTEM-SRC-5: Public Repository - Company Comment/Issue

### System Exposure (EXP)
Internet-exposed systems and devices.
- Category page: https://ctem.org/docs/system-exposure/
- CTEM-EXP-1: Directly Connected Internal System
- CTEM-EXP-2: Remote Site-Owned System Presumed Connected
- CTEM-EXP-3: Corporate Internet-Exposed Gateway Device
- CTEM-EXP-4: Corporate Cloud-Connected System
- CTEM-EXP-5: Presumed Company System by Branding
- CTEM-EXP-6: Contractor/Vendor-Managed System

## Machine-Readable Data

- CTEM Identifiers JSON feed: https://ctem.org/source.json

The JSON feed contains all CTEM identifiers with:
- Unique ID (e.g., CTEM-DOM-1, CTEM-CRD-2)
- Title and description
- Link to detailed documentation
- Last updated date

## How to Cite

When referencing CTEM identifiers:
- Use the identifiers catalog for overview: https://ctem.org/docs/identifiers
- Use the canonical page for any CTEM-ID (e.g., https://ctem.org/docs/ctem-dom-1)
- Use the definitive guide for framework questions: https://ctem.org/docs/what-is-continuous-threat-exposure-management
- The JSON feed provides machine-readable data for integrations

## Sitemap

Full sitemap available at: https://ctem.org/sitemap.xml

## License

Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
Free for non-commercial use.

## Contact

- Community and working group: https://ctem.org/join
- Questions: https://securecoders.com/contact-ctem-org/