Cybersecurity Capability Maturity Model (C2M2)

Today's energy organizations face many difficult cybersecurity questions. How susceptible is my organization to cybersecurity risks? How do I measure and improve my organization's cybersecurity posture? How do I communicate more effectively with my leadership about cybersecurity risks? Where should I invest my next cybersecurity dollar? The Cybersecurity Capability Maturity Model, C2M2, was created to help energy organizations answer these questions. The C2M2 is a set of cybersecurity practices organized into 10 subject areas called domains. Developed with input from more than 150 energy sector cybersecurity experts, the C2M2 is designed for use in both operational technology and information technology environments. It has been widely adopted across industries and around the globe as a tool to measure cybersecurity capabilities and harden critical infrastructure against cyber attacks. The C2M2 is different from other frameworks because it is not a static one-dimensional checklist of controls. Instead, it is a maturity model, a set of progressively mature activities that describe how organizations advance capabilities over time. Each practice in the C2M2 is assigned a maturity indicator level 1 through 3 that outlines a crawl-walk-run progression of practices and establishes a path for organizational improvement over time. Additionally, the C2M2 measures how ingrained cybersecurity is in an organization's culture. The more deeply ingrained, the more likely the outcomes of cybersecurity activities will be enduring, consistent, and repeatable during times of stress. These features make maturity models effective tools for assessing the organization's current state, identifying gaps, and improving performance and resilience. Several free resources are available to support C2M2 users, including a self-evaluation tool in HTML and PDF versions. The C2M2 is designed to enable organizations to complete a self-evaluation in a single day or as part of a series of short workshops. The self-evaluation tool generates summary and detailed reports with performance dashboards that present a comprehensive view of organizational maturity, facilitate benchmarking, and can help strengthen communications with executive leaders about program accomplishments and needs. All input entered into the self-evaluation tool is stored and processed only on your device. No input or results can be accessed by the Department of Energy. Additionally, the C2M2 is aligned with the NIST cybersecurity framework, ensuring consistency with an established standard while providing additional detail and maturity context. To learn more about the C2M2 or to get started with a self-assessment, check out the model and additional resources available at energy.gov slash c2m2. Reach out to c2m2 at doe.gov with questions or to learn more about no-cost facilitated self-assessments available for U.S. energy utilities.