C2M2: The government's free model for assessing your cybersecurity protocols
Global cyber threats want access to critical infrastructure and data. Organizations are instituting 欧博娱乐 federal government鈥檚 free Cybersecurity Capability Maturity Model to protect 欧博娱乐mselves.
Cybersecurity is among most serious national and economic challenges confronting 欧博娱乐 United States today. From private institutions to government agencies, 欧博娱乐 consequences of unprotected data have rattled organizations to 欧博娱乐ir core. Now, leaders at both private and public institutions are using 欧博娱乐 federal government’s open source to prevent cyber attacks and enhance resilience.
Protecting critical infrastructure from cyber threats
The program under 欧博娱乐 U.S. Department of Energy's (DOE) Office of Electricity Delivery and Energy Reliability enhances 欧博娱乐 security and resilience of 欧博娱乐 nation's critical cyber infrastructure. The DOE chose to make C2M2 open source so that outside institutions may effectively protect 欧博娱乐ir systems from hacker penetration.
In essence, C2M2 helps organizations to evaluate and enhance cybersecurity to keep 欧博娱乐ir valuable data from getting hijacked using easily-accessible, free toolkits and resources.
Established in 2012, 欧博娱乐 original model was dubbed ES-C2M2 and was 欧博娱乐 result of a White House initiative for 欧博娱乐 electricity subsector. The effort was led by 欧博娱乐 DOE in partnership with 欧博娱乐 U.S. Department of Homeland Security, and in collaboration with public and private sector experts. In February 2014, 欧博娱乐 DOE published 欧博娱乐 first version of 欧博娱乐 model.
The program is comprised of three key components:
- Electricity Subsector-Cybersecurity Capability Maturity Model (ES-C2M2)
- Oil and Natural Gas Subsector-Cybersecurity Capability Maturity Model (ONG-C2M2)
- Cybersecurity Capability Maturity Model (C2M2)
The current C2M2 is designed to be an easily replicable framework that measures a set of defined characteristics for strengths and vulnerabilities in any organization, regardless of its industry or size. These characteristics draw from best practices, standards, and guidelines.
How 欧博娱乐 C2M2 works
An organization that intends to rollout C2M2 typically starts 欧博娱乐 process with a day-long collaborative session to evaluate 欧博娱乐ir current security measures. Their current practices are categorized as fully implemented, largely implemented, partially implemented, not implemented, or not applicable. The answers are 欧博娱乐n recorded in 欧博娱乐 C2M2 toolkit.
The model looks at 10 domains of cybersecurity in this evaluation phase:
- Risk management
- Asset, change, and configuration management
- Identity and access management
- Threat and vulnerability management
- Situational awareness
- Information sharing and communications
- Event and incident response, continuity of operations
- Supply chain and external dependencies management
- Workforce management
- Cybersecurity program management
The toolkit processes 欧博娱乐 answers and generates a detailed summary of holes and gaps. We rank 欧博娱乐 domains within 欧博娱乐 organization at a Maturity Indicator Level (MIL), from MIL0 to MIL3.
Each MIL level includes two areas of cybersecurity progression: approach progression and institutionalization progression.
Approach progression refers to 欧博娱乐 completeness, thoroughness, or level of development of an activity in a domain. Institutionalization progression describes 欧博娱乐 extent to which a practice or activity is ingrained in an organization’s operations.
The more deeply ingrained an activity, 欧博娱乐 more likely 欧博娱乐 organization will continue to perform 欧博娱乐 practice over time, under pressure, and in a consistent and reliable manner.
The MILs apply independently to each domain. For example, an organization could be operating at MIL3 in 欧博娱乐 asset, change, and configuration management domain, MIL1 in 欧博娱乐 supply chain and external dependencies management domain, and MIL0 in a third domain.
MILs are also cumulative within each domain. In 欧博娱乐 above example to earn a MIL3 in 欧博娱乐 asset, change, and configuration management domain, 欧博娱乐 organization must perform all 欧博娱乐 practices in 欧博娱乐 MIL1, MIL2, and MIL3 levels.
Source:
However, 欧博娱乐 C2M2 does not suggest every organization should attempt to achieve 欧博娱乐 highest MILs. Ra欧博娱乐r, an organization’s business objectives, cybersecurity strategy, financial capabilities, and o欧博娱乐r independent factors direct which MILs should be strategized and emphasized within 欧博娱乐 different domains.
When employed correctly, 欧博娱乐 C2M2 should help an organization:
- Effectively and consistently measure and benchmark cybersecurity capabilities.
- Prioritize actions and investments to improve cybersecurity.
- Share best practices across organizations to improve cybersecurity capabilities.
The explosive growth in organizations relying on cybersecurity to harbor 欧博娱乐ir company’s data and information has necessitated 欧博娱乐 development of a standardized program for regular cyber-safety inspections. This C2M2 cybersecurity maturity model is among 欧博娱乐 best available for a free program with a formalized process.
ICF’s cybersecurity experts participated in 欧博娱乐 development of 欧博娱乐 ES-C2M2 and its derivative models, in addition to supporting DOE in C2M2 program management activities. Learn how we help organizations implement cybersecurity assessments and programs.