Measure and improve your CR-CMM cyber resilience maturity

CR-CMM, the Cyber Resilience Capability Maturity Model, is a free, community-driven toolkit for measuring an organisation's ability to anticipate, withstand, recover from and adapt to adverse cyber events. It assesses ten practices, from criticality analysis to cyber recovery, using 151 evidence-based questions and a five-level maturity scale. It is inspired by the SOC-CMM and aligned with NIST SP 800-160 and the MITRE Cyber Resiliency Engineering Framework.

CR-CMM is owned and sponsored by High Value Target, a boutique cyber resilience firm, and guided by a community Advisory Board that reviews change requests and publishes meeting summaries. It was developed with input from ISSA and the wider cyber resilience officer community, and ISSA's Cyber Resilience Special Interest Group uses it as a reference model at its events.

No. CR-CMM is a voluntary maturity model, not a law or certifiable standard, so there are no penalties for not using it. Organisations adopt it to prove and improve their real ability to survive a cyber attack. It can help support regulatory expectations such as DORA and NIS2, because its workbook cross-references those regulations, but using it does not on its own demonstrate compliance with them.

The ten CR-CMM practices are Criticality Analysis, Situational Awareness, Threat Informed Defense, Defensible Architecture, Crisis Management, Scenario Simulation, Contingency Testing, System Testing, Offensive Testing and Cyber Recovery. Each practice contains three practice areas, giving 30 in total, and each is scored on a five-level maturity scale ranging from initial, reactive practices to optimised, continuously improving resilience.

An initial CR-CMM self-assessment is designed to be completed in a single half-day, facilitator-led workshop with key stakeholders, using the Excel workbook that automates scoring and visualisation. A five-minute online quick assessment is also available as a first pass. The model's authors recommend reassessing once or twice a year to track progress, and after major incidents or organisational changes.

CR-CMM complements rather than replaces ISO 27001, ISO 22301 or NIST CSF 2.0. Those frameworks describe what good security and continuity management looks like, while CR-CMM measures operational resilience maturity at the point where cyber security and business continuity meet. Its questions carry control mappings to sources including ISO 27001, NIST SP 800-160, NIST SP 800-172 and MITRE ATT&CK, so existing controls and evidence can be reused.

No formal CR-CMM certification scheme is published. CR-CMM is a self-assessment and benchmarking toolkit: the output is a heat-mapped maturity profile and a prioritised improvement backlog rather than a certificate. Organisations can run it internally or bring in an experienced facilitator, and results can be shared with boards or stakeholders as evidence of resilience maturity.

Yes, on request. CR-CMM is mapped in OneClickComply's control library and available on request rather than offered as a standard live framework. Once enabled, the controls behind each practice, such as backups, incident response testing and penetration testing, can be tracked with automatically collected evidence that also counts towards ISO 27001, SOC 2, NIS2 and other mapped frameworks.