OT DEFENSEREVIEW

Intelligence for systems that move the physical world.

Voluntary use across energy and other organizations · voluntary capability-maturity model

Department of Energy Cybersecurity Capability Maturity Model Version 2.1

C2M2 supports evaluation and improvement of cybersecurity capabilities across domains such as risk, assets, access, threat and vulnerability, situational awareness, response, continuity, third parties, workforce, architecture, and program management.

PublishedVoluntary by itself

What the authority record establishes

C2M2 supports evaluation and improvement of cybersecurity capabilities across domains such as risk, assets, access, threat and vulnerability, situational awareness, response, continuity, third parties, workforce, architecture, and program management.

Voluntary by itself

The exact official title, issuing body, jurisdiction, version or application record, and linked source define the scope of this page. Readers should not transfer the authority's status to a commercial product or infer transaction-, patient-, system-, site-, or organization-specific applicability from this summary.

Why it matters to this market

It helps frame program and operating-capability evidence without turning a product feature into a maturity score.

Affected operating stages

  • Assess
  • Prioritize
  • Plan
  • Implement
  • Measure
  • Improve

Capabilities to examine

Asset Criticality And Operational Context

Ask how the system or service identifies the controlling source and version, applies customer-specific interpretation, handles exceptions, preserves human judgment, and retains evidence for asset criticality and operational context.

Vulnerability And Exposure Correlation

Ask how the system or service identifies the controlling source and version, applies customer-specific interpretation, handles exceptions, preserves human judgment, and retains evidence for vulnerability and exposure correlation.

Privileged Access, Credential, And Identity Governance

Ask how the system or service identifies the controlling source and version, applies customer-specific interpretation, handles exceptions, preserves human judgment, and retains evidence for privileged access, credential, and identity governance.

Anomaly And Behavioral Detection

Ask how the system or service identifies the controlling source and version, applies customer-specific interpretation, handles exceptions, preserves human judgment, and retains evidence for anomaly and behavioral detection.

Incident Response And Recovery Support

Ask how the system or service identifies the controlling source and version, applies customer-specific interpretation, handles exceptions, preserves human judgment, and retains evidence for incident response and recovery support.

Compliance Mapping And Control Evidence

Ask how the system or service identifies the controlling source and version, applies customer-specific interpretation, handles exceptions, preserves human judgment, and retains evidence for compliance mapping and control evidence.

Cyber-Risk Quantification And Executive Reporting

Ask how the system or service identifies the controlling source and version, applies customer-specific interpretation, handles exceptions, preserves human judgment, and retains evidence for cyber-risk quantification and executive reporting.

Multi-Site Sensor, Data, And Policy Management

Ask how the system or service identifies the controlling source and version, applies customer-specific interpretation, handles exceptions, preserves human judgment, and retains evidence for multi-site sensor, data, and policy management.

Device And Product Software-Supply-Chain Risk

Ask how the system or service identifies the controlling source and version, applies customer-specific interpretation, handles exceptions, preserves human judgment, and retains evidence for device and product software-supply-chain risk.

Affected buyer audiences

  • energy organizations
  • OT leaders
  • risk teams
  • executives

Implementation questions

  • Which entities, products, populations, transactions, systems, sites, or jurisdictions are actually within scope?
  • What is binding, what is guidance, and what is a technical or consensus standard?
  • Which publication, adoption, effective, application, transition, and enforcement dates differ?
  • Who owns legal, clinical, quality, regulatory, policy, or operational interpretation?
  • How will a source revision affect open work and historical decisions?

Interpretation boundary

A tool or consultant mapping cannot establish an organization's C2M2 practice implementation or maturity.