Key Facts
- Regulator
- U.S. Department of Energy, Office of Cybersecurity, Energy Security, and Emergency Response (CESER)
- Latest version
- C2M2 Version 2.1
- Effective
- 30 June 2022
- Official text
- www.energy.gov ↗
What is C2M2?
C2M2 is the Cybersecurity Capability Maturity Model, a voluntary self-evaluation model from the U.S. Department of Energy that helps organisations measure their cybersecurity capabilities across both IT and operational technology (OT). Developed by the U.S. energy industry, it can be used by any organisation of any size, type or industry.
The current version is C2M2 Version 2.1. The model draws on a set of industry-vetted cybersecurity practices and groups them by objective, so an organisation can see which capabilities it has in place and how well they are established. The official page is on the U.S. Department of Energy site.
C2M2 is a maturity model, not a control catalogue to be certified against. It tells you where you are on a scale. It does not hand you a pass or a fail.
Why it matters
Someone senior asks how mature your cybersecurity really is. The honest answer is usually an opinion, backed by a list of tools. C2M2 replaces the opinion with a structured scale and a set of named practices, so the answer can be repeated next year and compared.
Three things make it useful:
- It covers IT and OT. Plant, control and operational systems sit inside the same evaluation as the corporate network. Many frameworks treat them as an afterthought.
- It comes with tools. DOE publishes the model document and self-evaluation tools, and supports no-cost self-evaluations for U.S. energy sector organisations.
- It shows progression. Maturity is measured on a scale of maturity indicator levels, so a board can see movement rather than a static checklist.
A maturity score nobody acts on is a number, not a programme.
Who it applies to
C2M2 applies to any entity. It was developed by the U.S. energy industry, but DOE states that any organisation, regardless of size, type or industry, can use it. In practice it suits operators of energy and other critical infrastructure, and any organisation with OT assets that wants a structured view of its capability.
The obligation is voluntary. C2M2 is a self-evaluation model that organisations choose to use: DOE presents it as a tool, not a legal requirement, and no regulator we have found requires a C2M2 score. DOE also publishes supplemental guidance for C2M2 users who are subject to the Cybersecurity Maturity Model Certification (CMMC).
ISO 27001 is a management system standard that an accredited body can certify, while C2M2 is a self-evaluation scale. A firm with an ISO 27001 certificate can use C2M2 as a maturity lens, but it does not replace the certificate, and the closer relative is the NIST Cybersecurity Framework, covered below.
The UK position
A UK firm rarely meets C2M2. No UK law or regulator names it, and it carries no legal mandate in the United States either. A UK organisation can still use it by choice, since DOE opens the model to any entity, but nothing in the UK asks for it.
Key requirements
C2M2 has no requirements in the legal sense. It has a structure, and you evaluate yourself against it.
The model contains more than 350 cybersecurity practices, grouped by objective into 10 logical domains. A domain is a structured set of practices focused on one subject area. Within each domain, practices are organised into objectives, and each practice has a maturity indicator level.
The ten domains are:
- Asset, change and configuration management
- Cybersecurity architecture
- Cybersecurity program management
- Event and incident response, continuity of operations
- Identity and access management
- Risk management
- Situational awareness
- Third-party risk management
- Threat and vulnerability management
- Workforce management
Version 2.1 keeps the overall structure of Version 1.1 (2014). It added the Cybersecurity architecture domain, renamed the Dependencies domain as Third-party risk management, and folded Information sharing into Threat and vulnerability management and Situational awareness. A domain list that names Information sharing or Dependencies describes the older model.
To measure progression, C2M2 uses a scale of maturity indicator levels. You evaluate each practice, and the results show where a domain is strong and where it lags. A balanced profile is not the aim. The right level in each domain depends on the risk the domain carries for you.
A self-evaluation is only as good as the evidence behind each answer.
Mapping to the NIST Cybersecurity Framework
The NIST National Cybersecurity Center of Excellence (NCCoE) and DOE CESER developed bidirectional mappings between C2M2 and the NIST Cybersecurity Framework (CSF). They let users of either framework see their results in the context of the other. The published mappings use C2M2 Version 2.1 and CSF Version 1.1. DOE says mappings to CSF Version 2.0 are coming.
Frequently asked questions
C2M2 assigns every practice a maturity indicator level (MIL). DOE's model page shows three: MIL1 (initiated), MIL2 (performed) and MIL3 (managed). An organisation that implements the C2M2 practices within a MIL achieves that level, and because practices are grouped by domain, a C2M2 result reads as a level for each of the 10 domains rather than one overall score.
No. C2M2 is a voluntary self-evaluation model, and DOE presents it as a tool organisations choose to use, not a legal requirement. C2M2 can still become a contractual expectation when a customer, partner or group parent asks for a C2M2 result, so check supplier questionnaires and contracts before assuming it never applies to you.
DOE CESER released C2M2 Version 2.1 on 30 June 2022, after real-world testing of Version 2.0. It added practices, some of them for closer alignment with the NIST Cybersecurity Framework, reordered practices so they progress more clearly across maturity indicator levels, and clarified language. Since Version 1.1 in 2014, about two-thirds of the C2M2 practices have been revised.
The NIST Cybersecurity Framework describes cybersecurity outcomes, while C2M2 describes practices and grades how mature they are. The two complement each other: DOE's mappings tie C2M2 Version 2.1 practices to CSF Version 1.1 subcategories, so a C2M2 self-evaluation also shows an organisation where it stands against the CSF outcomes it maps to.
Yes, by choice. DOE opens C2M2 to any entity, regardless of size, type or industry, and its HTML self-evaluation tool is hosted on DOE's own C2M2 site. DOE's facilitated support is aimed at U.S. energy sector organisations, so a UK organisation should expect to run a C2M2 self-evaluation in-house or with its own adviser.