Cybersecurity Capability Maturity Model (C2M2) v2.1
Overview of C2M2
The Cybersecurity Capability Maturity Model (C2M2) version 2.1, published by the US Department of Energy in 2022, provides a comprehensive framework for evaluating and improving cybersecurity programs within the energy sector and critical infrastructure. Unlike prescriptive compliance frameworks, C2M2 offers a maturity-based approach enabling organizations to assess current capabilities, identify improvement priorities, and track progress over time. The model's flexibility accommodates organizations of varying sizes, complexity, and risk profiles while providing consistent evaluation criteria.
Originally developed for the energy sector in response to growing cyber threats against critical infrastructure, C2M2 has been adopted across sectors including oil and gas, electricity generation and transmission, nuclear facilities, and renewables. Version 2.1 incorporates lessons learned from thousands of self-assessments, emerging threats including ransomware and supply chain compromises, and alignment with evolving cybersecurity frameworks like the NIST Cybersecurity Framework. The model emphasizes programmatic capabilities—policies, processes, procedures, and organizational structures—rather than specific technical controls, recognizing that sustainable security requires institutional commitment beyond individual technologies.
C2M2 Structure: 10 Domains and 4 Maturity Levels
C2M2 organizes cybersecurity capabilities into 10 domains covering essential program areas, evaluated across four maturity indicator levels (MIL 0-3) representing progressively sophisticated capabilities.
The 10 Domains
1. Asset, Change, and Configuration Management: Manage assets, changes, and configurations to enable risk management and protect critical systems. Includes asset inventories, change control processes, and configuration baselines.
2. Threat and Vulnerability Management: Establish and maintain plans, procedures, and technologies to detect, identify, analyze, manage, and respond to cybersecurity threats and vulnerabilities. Covers vulnerability scanning, patch management, and threat intelligence.
3. Risk Management: Establish, operate, and maintain an enterprise cybersecurity risk management program to identify, analyze, and mitigate cybersecurity risk. Includes risk assessments, risk treatment decisions, and risk monitoring.
4. Identity and Access Management: Create and manage identities for people, systems, and services authorized to access organizational assets. Encompasses authentication, authorization, account management, and privileged access.
5. Situational Awareness: Establish and maintain activities and technologies to collect, analyze, and present cybersecurity situational awareness information. Covers logging, monitoring, alerting, and security operations.
6. Information Sharing and Communications: Establish mechanisms to share cybersecurity information internally and externally. Includes threat intelligence sharing, incident reporting, and stakeholder communications.
7. Event and Incident Response, Continuity of Operations: Establish and maintain plans, procedures, and technologies to detect, analyze, and respond to cybersecurity events and incidents. Encompasses incident response, business continuity, and disaster recovery.
8. Supply Chain and External Dependencies Management: Establish and maintain controls to manage cybersecurity risks associated with suppliers and external dependencies. Covers vendor risk assessments, contractual requirements, and supply chain monitoring.
9. Workforce Management: Establish workforce planning, training, and awareness programs to ensure personnel have cybersecurity knowledge and skills. Includes role-based training, awareness campaigns, and competency management.
10. Cybersecurity Program Management: Establish and maintain an enterprise-level cybersecurity program providing governance, strategic planning, and resource management. Covers policies, leadership, budgeting, and continuous improvement.
The 4 Maturity Indicator Levels
MIL 0 (Not Performed): Practices are not performed or performed incompletely with no documentation.
MIL 1 (Performed): Practices are performed but may be ad hoc, inconsistent, or undocumented. Success depends on individual efforts rather than institutionalized processes.
MIL 2 (Managed): Practices are documented, consistently performed, and managed at the organizational level. Processes are established with defined responsibilities and oversight.
MIL 3 (Optimized): Practices are regularly reviewed, measured, and continuously improved. The organization uses metrics, lessons learned, and industry best practices to optimize performance.
C2M2 Implementation and Assessment
Organizations implement C2M2 through self-assessment processes that evaluate current maturity across the 10 domains. Unlike pass/fail compliance audits, C2M2 assessments identify maturity gaps and prioritize improvements based on organizational risk profiles, operational requirements, and available resources.
Conduct Initial Baseline Assessment: Organizations begin by assessing current maturity using C2M2 evaluation tools and questionnaires. Baseline assessments typically involve interviews with stakeholders across IT, security, operations, and management, document reviews, and observations of practices. Initial assessments establish current state, identify strengths and weaknesses, and inform improvement roadmaps.
Develop Target Maturity Profile: Based on risk assessments, regulatory requirements, and strategic objectives, organizations define target maturity levels for each domain. Not all domains require the same maturity—high-risk operational technology environments might target MIL 3 for Asset Management and Situational Awareness while accepting MIL 2 for Information Sharing. Target profiles balance risk mitigation with resource constraints.
Create Implementation Roadmap: Gap analysis between current and target maturity informs multi-year roadmaps prioritizing improvements delivering greatest risk reduction. Roadmaps should sequence implementations logically—achieving MIL 2 requires MIL 1 foundations. Organizations typically advance maturity progressively across all domains rather than achieving MIL 3 in one domain while remaining at MIL 0 in others.
Execute and Monitor Progress: Implementation involves developing policies, establishing processes, deploying technologies, training personnel, and documenting procedures. Regular progress monitoring through quarterly or semi-annual reviews tracks advancement toward targets, identifies obstacles requiring mitigation, and adjusts plans based on emerging threats or changing priorities.
Framework Applicability and Adoption
While developed for the energy sector, C2M2 has been adopted across critical infrastructure including water utilities, transportation systems, manufacturing, and chemical facilities. The DOE encourages voluntary adoption, with many organizations using C2M2 for self-assessment rather than regulatory compliance. However, some states and utilities incorporate C2M2 into regulatory frameworks or contractual requirements.
C2M2 is particularly valuable for operational technology (OT) environments where traditional IT security frameworks may not adequately address industrial control systems, SCADA systems, and physical process safety. The model's maturity approach accommodates the reality that achieving comprehensive security in complex OT environments requires multi-year investments and progressive capability building.
Relationship to Other Frameworks
C2M2 aligns with and complements other cybersecurity frameworks. The model maps to NIST Cybersecurity Framework functions and categories, enabling organizations using NIST CSF to assess maturity of CSF implementations. C2M2's 10 domains correlate with ISO 27001 control categories, and many C2M2 practices map to CIS Controls and NIST SP 800-53 controls.
Organizations can leverage C2M2 assessments to demonstrate compliance with regulatory frameworks including TSA Pipeline Security Directive, NERC CIP for electricity, and state-level critical infrastructure protection requirements. The maturity model approach provides evidence of continuous improvement rather than point-in-time compliance.
Frequently Asked Questions
What maturity level should organizations target?
Target maturity depends on risk profile, regulatory requirements, and resources. Most energy sector organizations target MIL 2 across all domains as a baseline, with MIL 3 for highest-risk domains (Situational Awareness, Event and Incident Response). Small utilities might initially target MIL 1-2, while large transmission operators or nuclear facilities often pursue MIL 2-3. Organizations should conduct risk assessments to inform appropriate targets.
How long does C2M2 implementation take?
Advancing one maturity level typically requires 12-24 months per domain, though timeframes vary based on starting point and resources. Organizations starting at MIL 0 might require 3-5 years to achieve comprehensive MIL 2. Targeted domain improvements can be achieved faster—advancing Asset Management from MIL 1 to MIL 2 might take 6-12 months for focused organizations.
Is C2M2 required for energy sector organizations?
C2M2 is voluntary guidance rather than mandatory regulation for most energy organizations. However, some states reference C2M2 in utilities regulations, DOE contractors may face C2M2 expectations, and cyber insurance providers increasingly require maturity assessments. The TSA Pipeline Security Directive and NERC CIP requirements overlap with C2M2 domains, making C2M2 valuable for demonstrating compliance.
Can C2M2 be used outside the energy sector?
Yes, C2M2's domain structure and maturity approach apply across sectors. Organizations in manufacturing, water utilities, transportation, and chemical facilities successfully use C2M2. The model's focus on programmatic capabilities rather than sector-specific technical requirements enables broad applicability. However, sector-specific frameworks may provide more tailored guidance—healthcare organizations might prefer NIST Cybersecurity Framework with healthcare sector profiles.
How does C2M2 v2.1 differ from previous versions?
Version 2.1 refined practice descriptions for clarity, updated references to align with current standards and frameworks, enhanced guidance for operational technology environments, incorporated supply chain risk management emphasis, and improved assessment tools and documentation. Organizations using earlier C2M2 versions should transition to v2.1 for current best practices, though core domains and maturity levels remain consistent.