C2M2

No changes recorded yet — we are watching, and nothing has been published.

1. 2022-06-30 DOE released C2M2 Version 2.1
2. 2022-02-10 Public comment period on C2M2 Version 2.0 closed
3. 2021-11-24 DOE requested public comment on C2M2 Version 2.0 in the Federal Register

1. 2022-06-30
   C2M2 Version 2.1 RevisionCurrent

   Improved alignment with the NIST Cybersecurity Framework and revised practices after the Federal Register comment process on Version 2.0. source

   More

   • Practices were reworded for clarity, duplicates removed and new practices added.
   • The objectives of the Workforce Management domain were reordered.
   • Updated HTML-based and PDF-based self-evaluation tools were released with it.
2. —
   C2M2 Version 2.0 (July 2021) Major version

   Version 2.0, dated July 2021, was opened for public comment through the Federal Register until 10 February 2022. source

A voluntary maturity model that any organisation can use, built for the energy sector and its IT and OT environments.

Who can use it

Developed by the US energy industry, but any entity of any size, type or industry can use the model. source

Structure

Version 2.1 contains 356 cybersecurity practices grouped into 10 domains, from asset, change and configuration management to cybersecurity program management. source

Maturity levels

Four cumulative maturity indicator levels, MIL0 to MIL3; an organisation achieves a level by performing all practices up to and including it. source

IT and OT

The guidance addresses cybersecurity practices for information technology and operational technology assets and their environments. source

Not regulation

The guidance is not part of any regulatory framework, is not intended for regulatory use and does not alter compliance requirements. source

Organisations evaluate themselves with DOE's free tools; DOE facilitates no-cost self-evaluations for US energy sector organisations.

Self-evaluation tools

DOE offers an HTML-based self-evaluation tool at c2m2.doe.gov and a PDF-based tool on request. source

Facilitated sessions

DOE facilitates voluntary, no-cost C2M2 and NIST CSF self-evaluations for US energy sector organisations and never collects or shares self-evaluation data. source

CMMC users

DOE publishes C2M2-CMMC supplemental guidance (January 2024) for C2M2 users subject to CMMC. source

No enforcement: the model is guidance outside any regulatory framework.

Regulatory use

DOE states the guidance is not part of any regulatory framework and is not intended for regulatory use; compliance requirements are not altered by the model. source

1. Standard Cybersecurity Capability Maturity Model, Version 2.1 (June 2022)
2. Template C2M2 HTML-based self-evaluation tool
3. Guidance C2M2 V2.1 Practice and Help Text (Excel)
4. Guidance C2M2 Self-Evaluation Guide
5. Guidance C2M2-CMMC Supplemental Guidance

1. NIST CSF

   The NIST CSF is a cross-sector outcome framework; C2M2 is a maturity model whose Version 2.1 was aligned with CSF 1.1 and adds maturity indicator levels.

2. CERT-RMM

   CERT-RMM is SEI's broader operational resilience maturity model; C2M2 is DOE's cybersecurity maturity model focused on IT and OT practices.

3. NERC CIP

   NERC CIP standards are mandatory for the bulk electric system; C2M2 is a voluntary self-evaluation model with no regulatory use.

4. CMMC

   CMMC is a certification requirement for defense contractors; DOE publishes supplemental guidance for C2M2 users subject to it.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to C2M2 (RSS)