Measure and raise your C2M2 maturity with evidence you can trust

C2M2 is the Cybersecurity Capability Maturity Model, a voluntary model published by the US Department of Energy to help organisations evaluate and improve their cyber security. Version 2.1 contains 356 practices grouped into 10 domains, such as Risk Management, Identity and Access Management and Situational Awareness. Each practice sits at a maturity indicator level, so organisations can see how mature each capability is and where to invest next.

No. C2M2 is voluntary and provides descriptive rather than prescriptive guidance. The Department of Energy offers it free so organisations can benchmark and improve their own cyber security. Some energy sector organisations adopt it because customers, partners or sector bodies use it as a common language for maturity, but there is no legal obligation or penalty attached to the model itself.

C2M2 was developed with asset owners and operators in the electricity, oil and natural gas industries, and it remains most common among utilities and other energy organisations. The Department of Energy says it can be used by organisations of all sectors, types and sizes. It suits any organisation that runs both IT and operational technology and wants a structured way to measure cyber security maturity.

C2M2 uses four maturity indicator levels. MIL0 (Incomplete) means MIL1 has not been achieved in the domain. MIL1 (Initiated) means initial practices are performed but may be ad hoc. MIL2 (Performed) adds documented practices and adequate resources. MIL3 (Managed) adds policy direction, assigned responsibility, adequately skilled personnel and tracking of effectiveness. Levels are assessed separately for each domain.

The 10 C2M2 v2.1 domains are Asset, Change, and Configuration Management; Threat and Vulnerability Management; Risk Management; Identity and Access Management; Situational Awareness; Event and Incident Response, Continuity of Operations; Third-Party Risk Management; Workforce Management; Cybersecurity Architecture; and Cybersecurity Program Management. Each domain has approach objectives unique to it plus a Management Activities objective.

A C2M2 self-evaluation is usually run as a facilitated workshop using the free PDF or HTML tools from the Department of Energy. Participants rate each practice as fully, largely, partially or not implemented, and the tool calculates a MIL for each domain. The Department of Energy says an evaluation can be completed in one day. Results feed a gap analysis, prioritised actions and an implementation plan.

C2M2 v2.1 was updated to improve alignment with the NIST Cybersecurity Framework version 1.1 and NIST SP 800-53, and the Department of Energy describes it as a scalable way to implement the CSF. It overlaps heavily with ISO 27001 controls on access, assets, incidents and suppliers, but C2M2 measures maturity through self-evaluation, whereas ISO 27001 leads to an independent certification.

Yes, on request. C2M2 v2.1 is mapped in OneClickComply's control library and is available on request rather than enabled by default. Once enabled, your C2M2 objectives use the same controls, automated evidence, policies and monitoring as your other frameworks. OneClickComply helps you prepare and evidence practices; C2M2 has no certification, and maturity levels come from your own self-evaluation.