C2M2 v2.1 — Cybersecurity Capability Maturity Model

Why does it matter?

C2M2 gives an organization a common scale for cybersecurity capability. Ten domains hold the practices, grouped into objectives, and each practice is assigned to a maturity indicator level. Organizations can see where they stand domain by domain and choose where to invest rather than chasing the highest score everywhere (section 4.2).

Key benefits include:

• Domain-by-domain scoring

The MILs apply independently to each domain, so an organization can be at MIL1 in one domain and MIL3 in another (section 4.2).

• Targets instead of a pass mark

Organizations set a target MIL per domain, because striving for the highest level everywhere may not be optimal (section 4.2).

• Every size can start

The model was designed so that companies of any size can achieve MIL1 across all domains (section 4.2).

• IT and OT together

Practices address IT, OT and information assets, which matters for energy, utilities and industrial operators (section 3.3).

• Repeatable improvement loop

A four-step method from self-evaluation to reevaluation turns scores into a funded plan (chapter 5).

How does it work?

C2M2 organizes practices into ten domains, each with several objectives. The practices within each objective are ordered by MIL. A practice counts as performed in the self-evaluation tools when it is marked Fully Implemented or Largely Implemented, and MILs are cumulative within a domain: all MIL1 and MIL2 practices must be performed to reach MIL2 (section 4.2).

The MILs combine two progressions. The approach progression means practices become more complete and advanced at each level. The management progression adds institutional discipline: at MIL2 practices are documented and adequately resourced, and at MIL3 activities are guided by policies, responsibility is assigned, personnel have the right skills and effectiveness is evaluated and tracked (sections 4.3, 4.4 and Table 4).

Three domains are enterprise-focused: Cybersecurity Program Management, Risk Management and Cybersecurity Architecture (section 4.5). The model includes a cybersecurity architecture domain that asks for controls and processes commensurate with risk to critical infrastructure, and it aligns with the NIST Cybersecurity Framework and NIST SP 800-53.

Key Elements

• Ten domains (section 6)

ASSET (asset, change and configuration management), THREAT (threat and vulnerability management), RISK (risk management), ACCESS (identity and access management), SITUATION (situational awareness), RESPONSE (event and incident response, continuity of operations), THIRD-PARTIES (third-party risk management), WORKFORCE (workforce management), ARCHITECTURE (cybersecurity architecture) and PROGRAM (cybersecurity program management).

• Maturity indicator levels (section 4.2)

MIL0 means practices are not performed. MIL1 means initial practices are performed but may be ad hoc. MIL2 and MIL3 add management characteristics and more advanced practices. Levels are cumulative within each domain, and each domain is rated on its own.

• Approach and management progressions (sections 4.3 and 4.4)

The approach progression is about how complete a practice is, from initial to advanced. The management progression is about discipline: documentation and resources at MIL2, then policies, assigned accountability, skills and tracked effectiveness at MIL3. Table 5 and Table 6 use the ASSET domain as examples.

• Function scoping (section 3.2.1)

In the model, a function is the part of the organization being evaluated. It can be a department, line of business, facility, network zone, product line or system, and it defines which IT, OT and information assets and which participants are in scope. A well-chosen scope improves the accuracy of the results.

• Four-step use (chapter 5)

Step 1 performs a self-evaluation, step 2 analyzes the identified gaps, step 3 prioritizes and plans, and step 4 implements the plans and periodically reevaluates. Setting target MILs per domain focuses gap analysis.

• Self-evaluation tools

An HTML-based tool at c2m2.doe.gov and a PDF-based tool available from the DOE support the self-evaluation. DOE offers no-cost, voluntary self-evaluation support to organizations in the U.S. energy sector.

What does it cover?

C2M2 can be used by any organization, regardless of size, type or industry. It was created by and for the U.S. energy sector, and it covers IT, OT and information assets within a defined function of the enterprise. It is a self-evaluation model, not a legal requirement and not a certification.

What are its objectives?

The model supports measured improvement of cybersecurity capability.

Give organizations a consistent way to evaluate cybersecurity practices across ten domains.

Define maturity indicator levels that show progress from initial to managed practice.

Help organizations choose target levels aligned with business objectives and cost.

Support gap analysis, prioritization and planning of improvements.

Allow organizations to reevaluate periodically and track progress over time.

Align with NIST Cybersecurity Framework and NIST SP 800-53 practices.

Framework in Context

C2M2 was developed with U.S. government and industry input, and the model describes itself as an easily scalable tool for implementing the NIST Cybersecurity Framework. Its practices draw on sources that include NIST SP 800-53 and the NIST Cybersecurity Framework. Its distinctive feature is the maturity scale, which rates how complete and institutionalized each practice is.

Common Framework Mappings

Organizations map C2M2 to complementary frameworks to align maturity assessments with technical controls, regulatory requirements, and threat models, enabling simpler audits, risk management, and operational cybersecurity improvements.

Mapped frameworks include:

CIS Critical Security Controls

ISO/IEC 27001

ISO/IEC 27002

ISO/IEC 27701

MITRE ATT&CK

NIST Cybersecurity Framework

NIST SP 800-171

NIST SP 800-53