Cybersecurity Capability Maturity Model (C2M2)

1. INTRODUCTION
2. MODEL ARCHITECTURE
3. USING THE MODEL
4. MODEL DOMAINS

C2M2 focuses on the implementation and management of
cybersecurity practices associated with information, information
technology (IT), and operations technology (OT) assets and the
environments in which they operate. The model can be used to:
strengthen organizations’ cybersecurity capabilities
enable organizations to effectively and consistently evaluate and
benchmark cybersecurity capabilities
share knowledge, best practices, and relevant references across
organizations as a means to improve cybersecurity capabilities
enable organizations to prioritize actions and investments to improve
cybersecurity capabilities

The C2M2 is designed for use with a self-evaluation methodology
and tool for an organization to measure and improve its
cybersecurity program.
C2M2 can be used to guide the development of a new
cybersecurity program.
The C2M2 provides descriptive rather than prescriptive
guidance.
The model content is presented at a high level of abstraction so
that it can be interpreted by organizations of various types,
structures, sizes, and industries.

Maturity Models
A maturity model is a set of characteristics, attributes, indicators, or
patterns that represent capability and progression in a particular
discipline.
Model content typically exemplifies best practices and may incorporate
standards or other codes of practice of the discipline.
A maturity model thus provides a benchmark against which an
organization can evaluate the current level of capability of its practices,
processes, and methods and set goals and priorities for improvement.
Also, when a model is widely used in a particular industry and
assessment results are anonymized and shared, organizations can
benchmark their performance against other organizations.
An industry can determine how well it is performing overall by
examining the capability of its member organizations.
To measure progression, maturity models typically have “scaled levels.”
C2M2 uses a scale of maturity indicator levels (MILs) 0–3

Maturity Models
Having measurable transition states between the levels
enables an organization to use the scale to:
• define its current state
• determine its future, more mature state
• identify the capabilities it must attain to reach that future state

Critical Infrastructure Objectives
Critical infrastructure objectives often transcend the
business or operational objectives for an individual
organization.
The term critical infrastructure objectives can be
interpreted to mean industry objectives, community
objectives, or any other objectives that transcend the
specific business or operational objectives for the
organization but which the organization has a role and
interest in fulfilling.

Enterprise, Organization, and Function
The terms enterprise, organization, and function
identify which part of an entity the text of the model is
referring to.
Function refers to the part of an entity to which the
C2M2 will be applied.
Organization is a higher level administrative unit in
which the function resides (e.g., an operating company).
Enterprise refers to the highest level administrative
unit within an entity using the C2M2 (e.g., a parent
company).

Enterprise, Organization, and Function
Example of the Structure of a Notional Entity

1. Function
In the model, the term function is used as a scoping mechanism;
it refers to the operations of the organization that are being
evaluated based on the model.
It is common for an organization to use the model to evaluate a
subset of its operations.
Selecting the function that will be the focus of a C2M2 evaluation
determines both the specific assets and people to be evaluated.
Together, they constitute the function’s operating environment.

1. Function
Some things to consider when defining the function are:
• its significance to the organization’s mission
• its stakeholders
• its supporting assets
• whether the organization has identifiable ownership (that is, authority) over
its supporting assets
When determining the function, one should try to avoid encompassing
multiple organizations that have substantially different cybersecurity
activities.
For example, if an organization has a subsidiary whose cybersecurity
activities are substantially different from those of headquarters, it is
recommended that the organization perform separate evaluations for the
subsidiary and headquarters.
Combining these units in one evaluation may result in less accurate or
actionable evaluation results for headquarters and the subsidiary.

2. Assets
For the purposes of the model, assets are IT assets, OT assets, and
information assets. Some practices specify particular asset types.
IT and OT assets include both hardware and software, such as
traditional and emerging enterprise IT assets and any industrial control
system (ICS) devices, process control system devices and components,
safety instrumented systems, Internet of things (IoT) devices, industrial
Internet of things (IIoT) devices, supervisory control and data
acquisition (SCADA) system devices and components, network and
communications assets, and assets residing in the cloud.
Information assets are produced and used by IT, OT, and people to
support the delivery of the function.
Examples of information assets include customer data, financial records,
firewall configuration files, security information and event management
(SIEM) log files, historian data, SCADA set points, and configuration
files.
When evaluating whether a practice is performed completely, all forms
of assets that the function relies on should be considered.

2. Assets
Assets that are important to the delivery of the function includes assets
that are required for a normal state of operation of the function and output
of the function’s products or services.
Assets within the function that may be leveraged to achieve a threat
objective includes assets that may be used in the pursuit of the tactics or
goals of a threat actor.
Some examples of assets within the function that may be leveraged to
accomplish a threat objective:
• public-facing assets that may serve as an initial access point
• individual systems that would allow lateral movement within an organization’s
• network systems with administrative rights that would enable privilege
escalation
• information such as personally identifiable information that may cause harm to
the organization or its stakeholders if lost, stolen, or disclosed

The model is organized into 10 domains.
Each domain is a logical grouping of cybersecurity
practices.
The practices within a domain are grouped by
objective—target achievements that support the
domain.
Within each objective, the practices are ordered by
maturity indicator levels (MILs).

1. Domains, Objectives, and Practices
The C2M2 includes 342 cybersecurity practices, which are grouped into 10
domains.
For example, the Asset, Change, and Configuration Management domain is a
group of practices that an organization can perform to establish and mature
asset management, change management, and configuration management
capabilities.
The practices within each domain are organized into objectives, which
represent achievements that support the domain.
For example, the Asset, Change, and Configuration Management domain
comprises five objectives:
1. Manage IT and OT Asset Inventory
2. Manage Information Asset Inventory
3. Manage Asset Configuration
4. Manage Changes to Assets
5. Management Activities

1. Domains, Objectives, and Practices
Model and Domain Elements

1. ASSET
2. THREAT
3. RISK
4. ACCESS
5.
SITUATION
6.
RESPONSE
7. 3RD
PARTIES
8.WORKFORC
E
9.
ARCHITECTURE
10. PROGRAM

ASSET
•THREAT
•SITUATION
RISK
•RESPONSE
•ACCESS
PROGRAM
•CYBER ARCHITECTURE
•WORKFORCE
•3RD PARTIES

Domains, Objectives, and Practices
For each domain, the model provides a purpose statement,
which is a high-level summary of the intent of the domain,
followed by introductory notes, which give context for the
domain and introduce its practices.
The purpose statement and introductory notes offer context for
interpreting the practices in the domain.
The purpose statement for each of the 10 domains follows in
the order in which the domains appear in the model.
Next to each of the domain names, a short name is provided
that is used throughout the model.

1. Asset, Change, and Configuration Management
(ASSET)
Manage the organization’s IT and OT assets, including both
hardware and software, and information assets commensurate
with the risk to critical infrastructure and organizational
objectives.
2. Threat and Vulnerability Management (THREAT)
Establish and maintain plans, procedures, and technologies to
detect, identify, analyse, manage, and respond to cybersecurity
threats and vulnerabilities, commensurate with the risk to the
organization’s infrastructure (such as critical, IT, and operational)
and organizational objectives.

3. Risk Management (RISK)
Establish, operate, and maintain an enterprise cyber risk
management program to identify, analyse, and respond to cyber
risk the organization is subject to, including its business units,
subsidiaries, related interconnected infrastructure, and
stakeholders.
4. Identity and Access Management (ACCESS)
Create and manage identities for entities that may be granted
logical or physical access to the organization’s assets. Control
access to the organization’s assets, commensurate with the risk to
critical infrastructure and organizational objectives.

5. Situational Awareness (SITUATION)
Establish and maintain activities and technologies to collect, analyse,
alarm, report, and use operational, security, and threat information,
including status and summary information from the other model
domains, to establish situational awareness for both the organization’s
operational state and cybersecurity state.
6. Event and Incident Response, Continuity of Operations
(RESPONSE)
Establish and maintain plans, procedures, and technologies to detect,
analyse, mitigate, respond to, and recover from cybersecurity events
and incidents, and to sustain operations during cybersecurity incidents,
commensurate with the risk to critical infrastructure and
organizational objectives.

7. Third-Party Risk Management (THIRD-PARTIES)
Establish and maintain controls to manage the cyber risks arising
from suppliers and other third parties, commensurate with the
risk to critical infrastructure and organizational objectives.
8. Workforce Management (WORKFORCE)
Establish and maintain plans, procedures, technologies, and
controls to create a culture of cybersecurity and to ensure the
ongoing suitability and competence of personnel, commensurate
objectives.

9. Cybersecurity Architecture (ARCHITECTURE)
Establish and maintain the structure and behaviour of the
organization’s cybersecurity architecture, including controls,
processes, technologies, and other elements, commensurate with
the risk to critical infrastructure and organizational objectives.
10.Cybersecurity Program Management (PROGRAM)
Establish and maintain an enterprise cybersecurity program that
provides governance, strategic planning, and sponsorship for the
organization’s cybersecurity activities in a manner that aligns
cybersecurity objectives with both the organization’s strategic
objectives and the risk to critical infrastructure.

1. Maturity Indicator Levels
 Four aspects of the MILs are important for understanding and applying the model.
1. The maturity indicator levels apply independently to each domain.
a. As a result, an organization using the model may be operating at different MIL ratings in different domains.
b. For example, an organization could be operating at MIL1 in one domain, MIL2 in another domain, and MIL3 in a
third domain.
2. The MILs are cumulative within each domain.
a. To earn a MIL in a given domain, an organization must perform all of the practices in that level and its predecessor
level(s).
b. For example, an organization must perform all of the domain practices in MIL1 and MIL2 to achieve MIL2 in the
domain.
c. Similarly, the organization must perform all practices in MIL1, MIL2, and MIL3 to achieve MIL3.
3. Establishing a target MIL for each domain is an effective strategy for using the model to guide cybersecurity program
improvement.
a. Organizations should become familiar with the practices in the model prior to determining target MILs.
b. Then, they can focus gap analysis activities and improvement efforts on achieving those target levels.
4. Practice performance and MIL achievement need to align with business objectives and the organization’s cybersecurity
program strategy.
a. Striving to achieve the highest MIL in all domains may not be optimal.
b. Companies should evaluate the costs of achieving a specific MIL versus its potential benefits.
c. However, the model was designed so that all companies, regardless of size, should be able to achieve MIL1 across all
domains.

Summary of MIL Characteristics

Approach Progression
The domain-specific objectives and practices describe the progression of
the approach to cybersecurity for each domain in the model.
Approach refers to the completeness, thoroughness, or level of
development of an activity in a domain.
As an organization progresses from one MIL to the next, it will have more
complete or more advanced implementations of the core activities in the
domain.
At MIL1, while only the initial set of practices for a domain is expected, an
organization is not precluded from performing additional practices at
higher MILs.
To achieve MIL1, these initial activities may be performed in an ad hoc
manner, but they must be performed.
If an organization were to start with no capability in managing
cybersecurity, it should focus initially on implementing the MIL1
practices.

Approach Progression
In the context of the model, ad hoc (that is, formed or used for a special purpose
without policy or a plan for repetition) refers to performing a practice in a
manner that depends largely on the initiative and experience of an individual or
team (and team leadership), without much organizational guidance, such as a
prescribed plan, policy, or training.
The quality of the outcome may vary significantly depending on who performs
the practice, when it is performed, the context of the problem being addressed,
the methods, tools, and techniques used, and the priority given a particular
instance of the practice.
With experienced and talented personnel, high-quality outcomes may be achieved
even if practices are ad hoc.
However, at this MIL, lessons learned are typically not captured at the
organizational level, so approaches and outcomes are difficult to repeat or
improve across the organization.
It is important to note that, while documented policies or procedures are not
essential to the performance of a practice in an ad hoc manner, the effective
performance of many practices would result in documented artifacts such as a
documented asset inventory or a documented cybersecurity program strategy.

Management Progression
The management progression describes the extent to which a practice or activity is
ingrained in an organization’s operations (or institutionalized).
The more deeply ingrained an activity, the more likely it is that the organization
will continue to perform the practice over time, the practice will be retained under
times of stress, and the outcomes of the practice will be consistent, repeatable, and
of high quality.
The progression of imbedding an activity in an organization’s operations is described
by a set of practices that can be performed to institutionalize the domain-specific
practices.
These practices are similar across domains and are called the Management
Activities. Table 6 provides an example of the Management Activities in the ASSET
domain.

The C2M2 is meant to be used by an organization to evaluate
its cybersecurity capabilities consistently, to communicate its
capability levels in meaningful terms, and to inform the
prioritization of its cybersecurity investments.
Figure (Potential Approach for Using the Model )summarizes a
potential approach for using the model.
An organization performs an evaluation against the model,
uses that evaluation to identify gaps in capability, prioritizes
those gaps and develops plans to address them, and finally
implements plans to address the gaps.
As plans are implemented, business objectives change, and
the risk environment evolves, the process is repeated.

Potential Approach for Using the Model

Step 1: Perform an Evaluation
Performing a C2M2 self-evaluation provides a measurement of the
implementation of cybersecurity activities within an organization.
A design goal of the model is to enable organizations to complete a
self-evaluation for a single function in one day without extensive
study or preparation.
To begin preparation, the organization first establishes the scope of
the model application, or the function.
Next, the organization should identify IT, OT, and information assets
that are important to the delivery of the function.
The organization should select the appropriate personnel to evaluate
the in scope function against the model practices.
An effective facilitator who is familiar with model content should be
identified to guide the self-evaluation. Participation by stakeholders
from across the organization yields the best results and enables
internal information sharing about the model practices.

Personnel selected to participate in the self-evaluation should include operational personnel,
management stakeholders, and any others who could provide useful information on the
organization’s performance of cybersecurity practices in the model.
Through open dialog and consensus, self-evaluation workshop participants decide on an
implementation level for the practices in each domain.
Responses are chosen from a four-point scale:
1. Not Implemented,
2. Partially Implemented,
3. Largely Implemented, or
4. Fully Implemented.
Description of Self-Evaluation Response Options

Responses are recorded using one of the free C2M2 self-
evaluation tools available from the DOE9 or using another tool.
Upon completion of the self-evaluation, a scoring report is
generated that provides summary-level depictions of
performance relative to the model, as well as practice-level
implementation status.
This report provides a point-in-time view of the cybersecurity
posture of the in-scope function.
The report should be reviewed with the self- evaluation
workshop participants, and any discrepancies or questions
should be addressed.
More thorough guidance on using the model, selecting a
facilitator, and scoping the evaluation can be found in the
supporting C2M2 Self-Evaluation Guide.

Step 2: Analyse Identified Gaps
The scoring report from the self-evaluation will identify gaps
in the performance of model practices.
The first analysis step for the organization is to determine
whether these gaps are meaningful and important for the
organization to address.
It is not typically optimal for an organization to strive to
achieve the highest MIL in all domains.
Rather, the organization should determine the level of
practice performance and MIL achievement for each domain
that best enables it to meet its business objectives and
cybersecurity strategy.
The organization should identify its desired capability
profile—a target MIL rating for each domain in the model.
This collection of desired capabilities is the organization’s
target profile.

Step 2: Analyse Identified Gaps
For organizations using the model for the first time, a target
profile is typically identified after the initial self-evaluation.
This gives the organization an opportunity to develop more
familiarity with the model.
Organizations that have more experience with the model
have often identified a target profile before undergoing an
evaluation.
The appropriate organizational stakeholders should select
the target profile.
This might be a single individual with expertise in the
function’s operations and management, but it is likely to be a
collection of individuals.
The target profile can then be examined against the results
from the self-evaluation workshop to identify gaps that are
important to the organization because they represent
differences from the desired capability profile.

Step 3: Prioritize and Plan
After the gap analysis is complete, the organization should prioritize the
actions needed to fully implement the practices that enable achievement of
the desired capability in specific domains.
The prioritization should be done using criteria such as how gaps affect
organizational objectives, the importance of the business objective supported
by the domain, the cost of implementing the necessary practices, and the
availability of resources to implement the practices.
A cost-benefit analysis for gaps and activities can inform the prioritization of
the actions needed.
Next, a plan should be developed to address the selected gaps.
Planning should follow standard organizational planning processes and align
to the strategic objectives of the organization and cybersecurity program.
These plans can span a period of weeks, months, or years, depending on the
extent of improvements needed to close the selected gaps and achieve the
desired capability.
An individual with sufficient authority to carry out the plan should be
identified and assigned as the plan owner.
Regular reviews by organizational leadership should be conducted to
evaluate status, clear obstacles, and identify any necessary course corrections
as implementation progresses.

Step 4: Implement Plans and Periodically
Re-evaluate
Plans developed in the previous step should be
implemented to address the identified gaps.
Model self-evaluations are particularly useful in
tracking implementations and should be conducted
periodically to ensure that desired progress is
achieved.
Re-evaluations should also be considered in response
to major changes in business, technology, market, or
threat environments to ensure that the current profile
matches the organization’s desired state.

Inputs, Activities, and Outputs: Breakdown of Potential Approach

1. Asset, Change, and Configuration Management (ASSET)
Purpose:
Manage the organization’s IT and OT assets, including both hardware and
software, and information assets commensurate with the risk to critical
infrastructure and organizational objectives.
An asset is something of value to an organization.
For the purposes of the model, assets to be considered are IT and OT
hardware and software assets, as well as information essential to operating
the function.
The Asset, Change, and Configuration Management (ASSET) domain
comprises five objectives:
1. Manage IT and OT Asset Inventory
2. Manage Information Asset Inventory
3. Manage Asset Configuration
4. Manage Changes to Assets

1. Asset, Change, and Configuration Management (ASSET)
An inventory of assets that are important to the delivery of the function is an
important resource in managing cyber risk.
Recording important information, such as software version, physical location,
asset owner, and priority, enables many other cybersecurity management
activities.
For example, a robust asset inventory can identify the deployment location of
software that requires patching.
Managing asset configuration involves defining a configuration baseline and
ensuring that assets are configured according to the baseline.
Most commonly, this practice applies to ensuring that similar assets are
configured in the same way.
However, in cases where assets are either unique or must have individual
configurations, managing asset configuration involves controlling the
configuration baseline of the asset when it is deployed for operation and
ensuring that the asset remains configured according to the baseline.

(ASSET)
Managing changes to assets includes analysing requested changes to
ensure they do not introduce unacceptable vulnerabilities into the
operating environment, ensuring all changes follow the change
management process, and identifying unauthorized changes.
Change control applies to the entire asset lifecycle, including
requirements definition, testing, deployment and maintenance, and
retirement from operation.

(ASSET)
a. Objectives and Practices

Purpose:
Establish and maintain plans, procedures, and technologies to detect,
identify, analyse, manage, and respond to cybersecurity threats and
vulnerabilities, commensurate with the risk to the organization’s
infrastructure (such as critical, IT, and operational) and organizational
objectives.
A cybersecurity threat is defined as any circumstance or event with the
potential to adversely impact organizational operations (including mission,
functions, image, or reputation), resources, or other organizations through IT,
OT, or communications infrastructure via unauthorized access, destruction,
disclosure, modification of information, or denial of service.
Threats to information, IT, OT, and communication infrastructure assets vary
and may include malicious actors, malware (such as viruses and worms) and
distributed denial-of-service (DDoS) attacks.
A cybersecurity vulnerability is a weakness or flaw in IT, OT, communications
systems or devices, procedures, or internal controls that could be exploited by
a threat.

The Threat and Vulnerability Management (THREAT) domain comprises
three objectives:
1. Reduce Cybersecurity Vulnerabilities
2. Respond to Threats and Share Threat Information
Threat identification and response begins with collecting useful threat
information from reliable sources, interpreting that information in the context
of the organization and function, and responding to threats that have the
means, motive, and opportunity to affect the delivery of services.
A threat profile includes characterization of likely intent, capability, and
target of threats to the function.
The threat profile can be used to guide the identification of specific threats,
the risk analysis process described in the Risk Management domain, and the
building of the operational and cyber status described in the Situational
Awareness domain.

Reducing cybersecurity vulnerabilities begins with collecting and
analysing vulnerability information.
Vulnerability discovery may be performed using automatic scanning
tools, network penetration tests, cybersecurity exercises, and audits.
Vulnerability analysis should consider the vulnerability’s local impact
(the potential effect of the vulnerability on the exposed asset) as well as
the importance of the asset to the delivery of the function.
Vulnerabilities may be addressed by implementing mitigating controls,
monitoring threat status, applying cybersecurity patches, replacing
outdated equipment, or performing other activities.

Purpose:
Establish, operate, and maintain an enterprise cyber risk
management program to identify, analyse, and respond to cyber risk
the organization is subject to, including its business units,
subsidiaries, related interconnected infrastructure, and stakeholders.
Cyber risk is defined as the possibility of harm or loss due to
unauthorized access, use, disclosure, disruption, modification, or
destruction of IT, OT, or information assets.
Cyber risk is one component of the overall risk environment and feeds
into an organization’s enterprise risk management strategy and
program.
Cyber risk cannot be completely eliminated, but it can be managed
through informed decision-making processes.

The Risk Management (RISK) domain comprises five objectives:
1. Establish and Maintain Cyber Risk Management Strategy and Program
2. Identify Cyber Risk
3. Analyse Cyber Risk
4. Respond to Cyber Risk
Managing cyber risk involves framing, identifying and assessing, responding to
(accepting, avoiding, mitigating, transferring), and monitoring risks in a manner that
aligns with the needs of the organization.
Key to performing these activities is a common understanding of the cyber risk
management strategy.
A cyber risk management strategy provides direction for analysing and prioritizing cyber
risk and defines risk tolerance.
The cyber risk management strategy may include a risk analysis methodology, risk
monitoring strategy, and a description of how the cyber risk program will be governed.
The cyber risk management strategy should align with the enterprise risk management
strategy to ensure that cyber risk is managed in a manner that is consistent with the
organization’s mission and business objectives.

Risks are identified, categorized, and prioritized in a way that helps the
organization consistently respond to and monitor risks.
A risk register - a list of identified risks and associated attributes - also
facilitates this process.
Consolidation of risks into categories enables the organization to develop a
risk register that is reflective of the current risk environment and can be
managed effectively with available resources.
Other domains in the model (Situational Awareness, Event and Incident
Response, Continuity of Operations, and Cybersecurity Architecture) refer to
risk practices and illustrate how the practices in the model are strengthened
as they connect through a cyber risk management program.
And information generated through activities in the Threat and Vulnerability
Management and Third-Party Risk Management domains is used to update
cyber risks and identify new risks.

Purpose:
Create and manage identities for entities that may be granted logical or
physical access to the organization’s assets. Control access to the
organization’s assets, commensurate with the risk to critical infrastructure
and organizational objectives.
For the purposes of this domain, access control applies to logical access to
assets used in the delivery of the function, physical access to assets relevant
to the function, and automated access control systems (logical or physical)
relevant to the function.
Improper access management practices can lead to unauthorized use,
disclosure, destruction, or modification, as well as unnecessary exposure to
cyber risks.
The Identity and Access Management (ACCESS) domain comprises four
objectives:
1. Establish and Maintain Identities
2. Control Logical Access
3. Control Physical Access

Establishing and maintaining identities begins with the provisioning
and deprovisioning (removing available identities when they are no
longer required) of identities to entities.
Entities may include individuals (internal or external to the organization)
as well as devices, systems, or processes that require access to assets. In
some cases, organizations may need to use shared identities.
Management of shared identities may require compensatory measures to
ensure an appropriate level of security.
Maintenance of identities includes traceability (ensuring that all known
identities are valid) as well as deprovisioning.
Controlling logical and physical access includes determining access
requirements, granting access to assets based on those requirements, and
revoking access when it is no longer required.

Logical and physical access requirements are associated with each asset
or assets within a given area, and provide guidance for the types of
entities or individuals allowed to access the asset, the limits of allowed
access and, for logical access, authentication parameters.
For example, the logical access requirements for a specific asset might
allow remote access by a vendor only during specified and planned
maintenance intervals and might also require multifactor authentication
for such access.
At higher maturity indicator levels, more scrutiny is applied to the access
being granted. Logical and physical access is granted only after
considering risk to the function, and regular reviews of access are
conducted.

Purpose:
Establish and maintain activities and technologies to collect, monitor,
analyse, alarm, report, and use operational, security, and threat
information, including status and summary information from the other
model domains, to establish situational awareness for both the
organization’s operational state and cybersecurity state.
Situational awareness involves developing near-real-time knowledge of a
dynamic operating environment.
In part, this is accomplished through the logging and monitoring of IT, OT,
and communication infrastructure assets essential for the delivery of the
function.
It is equally important to maintain knowledge of relevant, current
cybersecurity events external to the enterprise.
Once an organization develops situational awareness, it can align predefined
states of operation to changes in the operating environment.
The ability to shift from one predefined state to another can enable faster and
more effective response to cybersecurity events or changes in the threat
environment.

The Situational Awareness (SITUATION) domain comprises four objectives:
1. Perform Logging
2. Perform Monitoring
3. Establish and Maintain Situational Awareness
Logging should be enabled based on an asset’s potential impact to the function.
For example, the greater the potential impact of a compromised asset, the more data
an organization might collect about the asset.
Monitoring and analysing data collected in logs and through other means enables the
organization to understand the function’s operational and cybersecurity status.
Effectively communicating the operational, security, and threat status to relevant
decision makers is the essence of situational awareness (sometimes referred to as a
common operating picture).
While many situational awareness implementations may include visualization tools,
such as dashboards, maps, and other graphical displays, they are not necessarily
required to achieve the goal.

(RESPONSE)
Purpose:
Establish and maintain plans, procedures, and technologies to detect,
analyse, mitigate, respond to, and recover from cybersecurity events and
incidents and to sustain operations during cybersecurity incidents,
commensurate with the risk to critical infrastructure and organizational
objectives.
A cybersecurity event in a system or network is any observable occurrence
that is related to a cybersecurity requirement (confidentiality, integrity, or
availability of assets).
A cybersecurity incident is an event or series of events that significantly
affects or could significantly affect critical infrastructure or organizational
assets and services and requires the organization (and possibly other
stakeholders) to respond in some way to prevent or limit adverse impacts.

6. Event and Incident Response, Continuity of
Operations (RESPONSE)
Escalating cybersecurity events involves applying the criteria
discussed in the Detect Cybersecurity Events objective to determine
when an event should be escalated and when an incident should be
declared.
Both cybersecurity events and cybersecurity incidents should be
managed according to a response plan.
Cybersecurity events and declared incidents may trigger external
obligations, including reporting to regulatory bodies or notifying
customers.
Correlating multiple cybersecurity events and incidents and other
records may uncover systemic problems within the environment.

(RESPONSE)
Responding to cybersecurity incidents requires the organization to have a process
to limit the impact of cybersecurity incidents to its functional and organizational
units.
The process should describe how the organization manages all phases of the
incident lifecycle, such as triage, handling, communication, coordination, and
closure.
Conducting lessons-learned reviews as a part of cybersecurity event and incident
response and continuity of operations helps the organization eliminate the
exploited vulnerability that led to the incident.
Planning for continuity involves the necessary activities to sustain the function in
the event of an interruption, such as a severe cybersecurity incident or a disaster.
Ensuring that continuity plans address potential cybersecurity incidents requires
consideration of known cyber threats and identified categories of cyber risk.
Continuity plan testing should include cybersecurity incident scenarios to ensure
that plans will function as intended during such incidents.

(RESPONSE)

Purpose:
Establish and maintain controls to manage the cyber risks arising from suppliers
and other third parties, commensurate with the risk to critical infrastructure and
organizational objectives.
As the interdependencies among infrastructures, operating partners, suppliers, and
service providers increase, establishing and maintaining a comprehensive
understanding of key relationships and managing their associated cyber risks are
essential for the secure, reliable, and resilient delivery of the function.
The model classifies third-party dependencies as external parties on which the
delivery of the function depends, including operating partners.
These relationships may vary in importance because the function may have a greater
reliance on specific third parties, particularly if a third party has access to, control of,
or custody of an asset.
Third parties include entities such as suppliers, vendors, service providers,
infrastructure dependencies (e.g., telecommunications, water), and governmental
organizations (e.g., emergency response services, federal partners).

Supply chain risk is a noteworthy example of a supplier dependency.
The cybersecurity characteristics of products and services vary widely.
Without proper risk management, they pose serious threats, including
software of unknown provenance and counterfeit (possibly malicious)
hardware.
Organizations’ requests for proposal often give suppliers of high-
technology systems, devices, and services only rough specifications,
which may lack adequate requirements for security and quality
assurance.
The autonomy organizations often give to their individual business
units further increases the risk, unless procurement activities are
constrained by plan or policy to include cybersecurity requirements.

The Third-Party Risk Management (THIRD-PARTIES) domain comprises three objectives:
1. Identify and Prioritize Third Parties
2. Manage Third-Party Risk
Identifying third parties involves establishing and maintaining a comprehensive
understanding of the key external relationships required for the delivery of the function.
After identification, third parties should be prioritized to determine which third-party
dependencies are most critical to the delivery of the function.
Prioritization criteria should consider the risk to the function that is introduced by third-
party relationships.
Managing third-party risk includes approaches such as independent testing, code review,
scanning for vulnerabilities, and reviewing demonstrable evidence from the vendor that a
secure software development process has been followed.
Contracts binding the organization to a relationship with a partner or vendor for products
or services should be reviewed and approved for cyber risk mitigation, such as contract
language that establishes vendor responsibilities for meeting or exceeding specified
cybersecurity standards or guidelines.
Service level agreements can specify monitoring and audit processes to verify that vendors
and service providers meet cybersecurity and other performance measures.

Purpose:
Establish and maintain plans, procedures, technologies, and controls to
create a culture of cybersecurity and to ensure the ongoing suitability
and competence of personnel, commensurate with the risk to critical
infrastructure and organizational objectives.
As organizations increasingly adopt advanced digital technology, it is a challenge
to enhance the skill sets of their existing workforce and hire personnel with the
appropriate level of cybersecurity experience, education, and training.
Organizations’ reliance on advanced technology for digital communications and
control continues to grow, and workforce issues are a crucial aspect of
successfully addressing cybersecurity and risk management for these systems.
Collective bargaining agreements may challenge some aspects of the practices in
this domain as written, so organizations may need to implement alternative
practices that meet the intent of the model practices and align with those
agreements.

The Workforce Management (WORKFORCE) domain comprises five objectives:
1. Assign Cybersecurity Responsibilities
2. Develop Cybersecurity Workforce
3. Implement Workforce Controls
4. Increase Cybersecurity Awareness
An important aspect of assigning cybersecurity responsibilities is ensuring adequacy and
redundancy of coverage.
For example, specific workforce roles with significant cybersecurity responsibilities are
often easy to determine, but they can be challenging to maintain.
It is vital to develop plans for key cybersecurity workforce roles such as system
administrators to provide appropriate training, testing, redundancy, and evaluations of
performance.
Cybersecurity responsibilities are not restricted to traditional IT roles; for example,
engineers, control room operators, and field technicians may have cybersecurity
responsibilities.

Developing the cybersecurity workforce includes training and recruiting
to address identified skill gaps.
For example, hiring practices should ensure that recruiters and
interviewers are aware of cybersecurity workforce needs.
Also, personnel (and contractors) should receive periodic security
awareness training to reduce their vulnerability to social engineering and
other threats.
The effectiveness of training and awareness activities should be
evaluated, and improvements should be made as needed.
Implementing workforce controls includes personnel vetting, such as
background checks, with extra vetting performed for positions that have
access to assets needed to deliver an essential service.

For example, system administrators typically have the ability to change configuration
settings, modify or delete log files, create new accounts, and change passwords on
critical systems, and specific measures are taken for protection of these systems from
accidental or malicious behaviour by this category of personnel.
Increasing the cybersecurity awareness of the workforce is as important as technological
approaches for improving the cybersecurity of the organization.
The threat of a cyber attack to an organization often starts with gaining some foothold
into a company’s IT or OT systems, for example, by gaining the trust of an unwary
employee or contractor who then introduces media or devices into the organization’s
networks.
The organization should share information with its workforce on methods and
techniques to identify suspicious behaviour, avoid spam and spear phishing, and
recognize social engineering attacks to avoid providing information about the
organization to potential adversaries.
For example, an internal website could provide information about new threats and
vulnerabilities in the industry. If no information on threats, vulnerabilities, and best
practices is shared with the workforce, personnel may become lax about security
processes and procedures.

Purpose:
Establish and maintain the structure and behaviour of the
organization’s cybersecurity architecture, including controls,
processes, technologies and other elements, commensurate
objectives.
Establishing a cybersecurity architecture involves identifying
cybersecurity requirements for the organization’s assets and
designing appropriate controls to protect them.
The cybersecurity architecture serves as a reference to guide how
cybersecurity is to be implemented to meet the objectives of the
cybersecurity program strategy.

The Cybersecurity Architecture (ARCHITECTURE) domain
comprises six objectives:
1. Establish and Maintain Cybersecurity Architecture Strategy and
Program
2. Implement Network Protections as an Element of the
Cybersecurity Architecture
3. Implement IT and OT Asset Security as an Element of the
Cybersecurity Architecture
4. Implement Software Security as an Element of the Cybersecurity
Architecture
5. Implement Data Security as an Element of the Cybersecurity
Architecture

The cybersecurity architecture helps an organization plan for how security is to be
engineered in a way that transcends point solutions for individual assets such as
identity management or access control.
It enables reasoning about the security of critical applications and data in terms of
known architectural controls to, for example, detect, resist, react to, and recover
from attacks.
Such tactics include segmentation, choice of hosting solutions, cryptographic
controls, and audit trails, and they can be allied with availability controls such as
monitoring, rollback, and redundancy.
To be effective, the cybersecurity architecture must be sufficiently documented so
that it can be communicated to stakeholders.
It must also be governed such that those responsible for the cybersecurity
architecture are included in planning and decision-making processes when
changes to the organization, IT systems, or OT systems are being considered.
In this way, changes to the organization can be reviewed to address security
concerns and align with the organization’s cyber risk tolerance.

10. Cybersecurity Program Management (PROGRAM)
Purpose:
Establish and maintain an enterprise cybersecurity program that
provides governance, strategic planning, and sponsorship for the
organization’s cybersecurity activities in a manner that aligns
cybersecurity objectives with both the organization’s strategic
objectives and the risk to critical infrastructure.
A cybersecurity program is an integrated group of activities designed and
managed to meet cybersecurity objectives for the organization or the
function.
A cybersecurity program may be implemented at either the organization or
the function level, but a higher level implementation and enterprise
viewpoint may benefit the organization by integrating activities and
leveraging resource investments across the entire enterprise.

10. Cybersecurity Program Management (PROGRAM)
The Cybersecurity Program Management (PROGRAM) domain comprises three objectives:
1. Establish Cybersecurity Program Strategy
2. Sponsor Cybersecurity Program
The cybersecurity program strategy is established as the foundation for the program. In its
simplest form, the program strategy should include a list of cybersecurity objectives and a plan
to meet them.
At higher levels of maturity, the program strategy will be more complete and include priorities, a
governance approach, structure and organization for the program, and more involvement by
senior management in the design of the program.
Sponsorship is important for implementing the program in accordance with the strategy.
The fundamental form of sponsorship is to provide resources (people, tools, and funding). More
advanced forms of sponsorship include visible involvement by senior leaders and designation of
responsibility and authority for the program.
Further, sponsorship includes organizational support for establishing and implementing policies
or other organizational directives to guide the program.

10.Cybersecurity Program Management (PROGRAM)

Cybersecurity Capability Maturity Model (C2M2)

More Related Content

What's hot (20)

Similar to Cybersecurity Capability Maturity Model (C2M2) (20)

More from Maganathin Veeraragaloo (20)

Recently uploaded (20)

Cybersecurity Capability Maturity Model (C2M2)