Cybersecurity Capability Maturity Model (C2M2)

What is the Cybersecurity Capability Maturity Model?

The Cybersecurity Capability Maturity Model (C2M2) is a framework developed by the United States Department of Energy. It was initially published in 2012 and most recently updated in 2022. It is a voluntary framework designed to help organizations evaluate their cybersecurity capabilities and optimize security investments. C2M2 defines practices across 10 cybersecurity domains and measures progression within each domain using maturity level indicators.

Who is the intended audience?

The C2M2 model was developed by the Department of Energy alongside asset owners and operators in the electricity, oil, and natural gas industries. However, it is intended for organizations across all sectors and is leveraged today within the energy, manufacturing, healthcare, financial services, and other sectors.

Where can I find more information?

The following resources can be found on the U.S. Department of Energy website:

• Cybersecurity Capability Maturity Model v2.1 (.pdf)
• C2M2 Self Evaluation Guide (.pdf)
• C2M2 Model Practices (.xlsx)

How can runZero help me with these controls?

The following illustrates how runZero aligns with each of the 10 domains of C2M2 v2.1. Where Strong alignment is noted, runZero can play a significant role in helping an organization implement safeguards. Where Partial alignment is noted, runZero can play a complementary role in helping an organization implement safeguards.