← Back to Portal Home
🏫 C2M2 Program Portal

C2M2 Training Case Studies

Sector-specific fictional organizations with realistic IT/OT environments, network diagrams, asset inventories, and security gaps — designed for hands-on C2M2 assessment practice.

8
Available Now
0
In Development
8
Sectors Planned
10
Domains Covered
🎓

How to Use These Case Studies

Each case study presents a fully developed fictional organization in a specific critical infrastructure sector. Students receive a complete organizational profile, IT and OT asset inventory, network architecture diagram, security control gaps, vendor relationships, and an indicative C2M2 domain assessment. The exercise asks students to validate maturity scores, map findings to specific C2M2 practice IDs, build a prioritized remediation roadmap, and work through scenario injects that simulate realistic cyber incidents. One case study per sector will be developed — covering all eight sectors from the C2M2 framework overview.

📈 Case Study Development Progress

⚡ Electric Utilities
✓ Complete
💧 Water & Wastewater
✓ Complete
🛢️ Oil & Natural Gas
✓ Complete
🏭 Industrial / OT
✓ Complete
🏥 Healthcare
✓ Complete
🏦 Financial Services
✓ Complete
🏛️ Government
✓ Complete
🔭 Research Institutions
✓ Complete
Available Now — 8 of 8 Sectors
Electric Utilities

Muskingum Valley Electric Cooperative

MVEC — Rural Ohio Distribution Co-op

A small rural electric distribution cooperative in three Ohio counties operating substations, AMI infrastructure, and GE e-terra SCADA. MVEC has zero dedicated cybersecurity staff, no MFA deployment, default relay passwords, and significant IT/OT architecture gaps — making it an ideal baseline C2M2 assessment target for electric sector students.

Service Area14,620 meters · 3 counties
Employees34 FTE
Annual Revenue$18.4 million
Key OT SystemGE e-terra SCADA
C2M2 Score RangeMIL 0–1 across all domains
RegulationNERC CIP (Low Impact)
SCADA Substations AMI RTUs Default Credentials No MFA NERC CIP 3 Scenario Injects
🏫 Open Case Study
💧
Water & Wastewater

Clearwater Valley Water Authority

CVWA — Harrington County, Virginia

A regional water and wastewater authority serving 138,000 residents across three Virginia counties. CVWA operates a 12 MGD surface water treatment plant, an 8 MGD wastewater plant, a standalone groundwater facility, and 18 remote lift stations — with a single IT coordinator managing all IT and OT systems and critical gaps including default credentials, an EOL historian bridging IT/OT networks, and no incident response plan.

Population Served138,000 · 3 counties
Employees87 FTE
Annual Revenue$24.2 million
Key OT SystemIgnition SCADA / AVEVA PI
C2M2 Score RangeMIL 0–1 across all domains
RegulationAWIA 2018 / Virginia DEQ
Ignition SCADA WTP / WWTP Lift Stations PLCs / RTUs Default Credentials EOL Systems AWIA 2018 3 Scenario Injects
🏫 Open Case Study
🛢️
Oil & Natural Gas

Lone Star Midstream LLC

LSML — Midland Basin, West Texas / SE New Mexico

847-mile natural gas gathering & transmission pipeline across the Permian Basin. Zero dedicated cybersecurity staff, MIL 0–1 baseline across most domains. Default credentials on 5 field RTUs, partial IT/OT segmentation, and TSA SD-02C partially compliant — an ideal scenario for pipeline sector C2M2 assessment practice.

Pipeline Miles847 mi Gathering & Transmission
Employees112 FT + 18 Contractors
Annual Revenue$94.2 Million
Key OT SystemEmerson Ovation SCADA
C2M2 Score RangeMIL 0–1 (most domains)
RegulationTSA SD-02C · DOT PHMSA
Emerson Ovation Fisher ROC RTUs ControlLogix PLCs Default Credentials Partial IT/OT Segmentation TSA SD-02C 5 Scenario Injects
🏫 Open Case Study
🧪
Industrial / OT

Meridian Specialty Chemicals Inc.

MSCI — Baton Rouge, Louisiana Chemical Corridor

Mid-size specialty chemical manufacturer with DCS/batch process controls, CFATS Tier 3 obligations, and a Safety Instrumented System. Zero dedicated cybersecurity staff, Windows XP DCS workstation, utilities PLCs on a flat corporate network, and an unknown internet-facing batch server port — an ideal scenario for ICS/OT C2M2 assessment in a manufacturing environment.

Manufacturing Capacity4 Batch Reactor Trains · 2 Distillation Columns
Employees340 FT + 45 Contractors
Annual Revenue$187.3 Million
Key OT SystemHoneywell Experion PKS DCS
C2M2 Score RangeMIL 0–1 (most domains)
RegulationCFATS Tier 3 · EPA RMP · OSHA PSM
Honeywell Experion DCS Batch Reactors Safety Manager SIS CFATS Tier 3 Flat Network Gap Windows XP OT 5 Scenario Injects
🏫 Open Case Study
🏥
Healthcare

Valley Regional Medical Center

VRMC — Fairview, Pennsylvania

A 350-bed nonprofit regional hospital and Level III Trauma Center with Epic EHR, 1,240+ IoMT devices, and no dedicated CISO. Features HIPAA Security Rule gaps, ransomware vulnerabilities, unpatched infusion pumps with a known CVE, and a flat medical device network. Covers HIPAA, HITECH, FDA medical device cybersecurity, and patient safety implications of cyber incidents.

Licensed Beds350 · Level III Trauma
Employees1,820 FTE
Annual Revenue$342 Million
IoMT Devices1,240+ networked clinical devices
C2M2 Score RangeMIL 0–2 across domains
RegulationHIPAA · HITECH · FDA · CMS
Epic EHR IoMT / Medical Devices HIPAA Security Rule Ransomware Risk Infusion Pump CVE No CISO 3 Scenario Injects
🏫 Open Case Study
🏦
Financial Services

Lakewood Community Bank

LCB — Lakewood, Ohio (Cuyahoga County)

A $620M-asset OCC-chartered community bank with 7 branches, 14 ATMs, and Jack Henry Silverlake core banking. No dedicated CISO, 9 ATMs on Windows 7 EOL, wire transfer dual-control gaps, unreviewed fintech integrations, and FFIEC CAT assessed at Baseline — making it an ideal C2M2 assessment scenario for financial services sector students covering GLBA, PCI DSS, and fraud risk.

Total Assets$620 Million · OCC Charter
Employees185 FTE
Annual Revenue$28.4 million
Core SystemJack Henry Silverlake
C2M2 Score RangeMIL 0–1 across all domains
RegulationFFIEC CAT · GLBA · PCI DSS
Core Banking ATM Network FFIEC CAT GLBA Safeguards PCI DSS Wire Fraud Risk Windows 7 ATMs 3 Scenario Injects
🏫 Open Case Study
🏛️
Government

Harmon County IT Department

HCIT — Millhaven, Ohio (Fictional Mid-Size County Government)

A 94,200-resident county government operating 911 emergency dispatch, law enforcement systems (CJIS), election infrastructure, courts, health services, and public finance — all with 9 IT staff and no CISO. Features two EOL domain controllers, an unpatched 911 CAD server, an election management system air-gap violation, shared domain admin credentials, and CJIS non-compliance. Covers MS-ISAC membership, IRS Pub 1075, HIPAA, FBI CJIS Security Policy, and election security — an ideal county government C2M2 scenario.

Population Served94,200 Residents · 542 sq mi
Employees822 FTE County-Wide
Annual IT Budget$1.84 Million (2.1%)
Key SystemsTyler Munis · Zetron 911 CAD · Dominion EMS
C2M2 Score RangeMIL 0–2 (mixed across domains)
RegulationCJIS · HIPAA · IRS Pub 1075 · EAC/HAVA
911 / CAD CJIS Compliance Election Security IRS Pub 1075 MS-ISAC Member EOL Infrastructure 5 Scenario Injects
🏫 Open Case Study
🔭
Research Institutions

Allegheny Research University

ARU — Westbrook, Pennsylvania (R1 Research University)

An R1 research university with $185M in annual research expenditure, handling CUI under NIST SP 800-171, ITAR-controlled export data, NIH/HIPAA research data, and DoD contracts requiring CMMC Level 2. Features an HPC cluster with internet-exposed SSH, a CUI data commingling violation, an active ITAR deemed export issue, decentralized IT governance with 24 departmental admins, and an SPRS score of −87. Covers the tension between academic openness and federal cybersecurity compliance.

Students / Staff18,400 Students · 3,633 FTE
Research Budget$185M Annual Expenditure
Operating Budget$685 Million
Key SystemsHPC Cluster · GCC High · Ellucian Banner
C2M2 Score RangeMIL 0–2 (mixed; WORKFORCE at MIL 0)
RegulationNIST 800-171 · CMMC L2 · ITAR · FERPA · HIPAA
CUI / NIST 800-171 CMMC Level 2 EAR / ITAR HPC Cluster Nation-State Threats Decentralized IT SPRS −87 3 Scenario Injects
🏫 Open Case Study