C2M2 V2.1 Overview Presentation -- July 2023.pptx
- 1. Cybersecurity Capability Maturity Model (C2M2) Version 2.1 Overview
- 2. C2M2 Version 2.1 Overview - 2 - The C2M2 is a free tool to help organizations evaluate their cybersecurity capabilities and optimize their security investments. • Designed for any organization regardless of ownership, structure, size, or industry • Uses a set of 350+ industry-vetted cybersecurity practices focused on both information technology (IT) and operations technology (OT) assets and environments • Results help users prioritize cybersecurity investment decisions based on their risk • Developed in 2012 and maintained through an extensive public-private partnership between the U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response and numerous government, industry, and academic organizations • Recent updates in 2022 reflect new technologies, threats, and practices
- 3. Benefits of Using the C2M2 Planning Evaluating Maturity model structure facilitates cybersecurity program planning and target-setting Enables consistent evaluation of cybersecurity capabilities and tracking of progress over time Prioritizing Reporting Helps companies prioritize actions and investments for cybersecurity improvements C2M2 assessment tools produce views of cybersecurity program status that can be used in reporting - 3 -
- 4. Key Features of the C2M2 Area Description Maturity Model The C2M2 consists of cybersecurity practices that are organized into three progressive levels of cybersecurity maturity. Management Activities Management activities measure the extent to which cybersecurity is ingrained in an organization’s culture. Specificity The C2M2 is descriptive, not prescriptive. Practice statements focus on outcomes that may be implemented through any number of measures. Scoping The C2M2 may be applied to an entire enterprise or to individual parts of the enterprise to enable users to select an appropriate level of granularity. Usability A C2M2 self-evaluation can be completed in one-day using a free tool that securely records results and generates a detailed, graphical report. - 4 -
- 5. What is a Maturity Model? • A Crawl/Walk/Run-style set of characteristics, practices, or processes that represent the progression of capabilities in a particular discipline. • A tool to benchmark current capabilities and identify goals and priorities for improvement. - 5 -
- 6. Model Organized by 10 Domains - 6 - • Domains are logical groupings of cybersecurity practices • Each domain has a short name for ease of reference ASSET Asset, Change, and Configuration Management THREAT Threat and Vulnerability Management RISK Risk Management ACCESS Identity and Access Management SITUATION Situational Awareness RESPONSE Event and Incident Response, Continuity of Operations THIRD-PARTIES Third-Party Risk Management WORKFORCE Workforce Management ARCHITECTURE Cybersecurity Architecture PROGRAM Cybersecurity Program Management
- 7. Model Structure - 7 - Model contains 10 domains Multiple approach objectives in each domain Unique to each domain One per domain Similar in each domain Approach objectives are supported by a progression of practices that are unique to the domain Each management objective is supported by a progression of practices that are similar in each domain and describe institutionalization activities Model Domain Approach Objectives Practices at MIL1 Practices at MIL2 Practices at MIL3 Management Objectives Practices at MIL2 Practices at MIL3
- 8. C2M2 Adoption by Sector Since 2012, DOE has responded to more than 2,400 requests for the C2M2 PDF-Based Self- Evaluation Tool from owners and operators in U.S. critical infrastructure sectors and from international partners. - 8 - C2M2 Tool Requests By U.S. Sector Data current as of March 2023
- 9. C2M2 Version 2.1 Resources Visit energy.gov/c2m2, c2m2.doe.gov, or email [email protected] for more information. - 9 - Model Document Introduces the model practices, key concepts, and how to use the model Self-Evaluation Tools The tool, available on two platforms, offers interactive features and help text, allows users to securely record results, and automatically generates a detailed, graphical report Self-Evaluation Guide Guides users to plan and facilitate a self-evaluation workshop with key participants in their organization Self-Evaluation Workshop Kickoff Presentation Supports planning for a self-evaluation workshop Self-Evaluation Cheat Sheet Offers a placemat-style reference guide for participants during a self- evaluation
- 10. Thank You