Official documents, toolkits, training, and sector resources for C2M2
The authoritative source for all C2M2 domains, objectives, practices, and MIL definitions. Published by U.S. Department of Energy CESER.
Excel-based toolkit from DOE that guides organizations through the self-evaluation process with scoring worksheets, heatmap outputs, and report generation.
Step-by-step guide for C2M2 facilitators on how to run a self-evaluation session: preparation, facilitation techniques, scoring, and reporting.
Official DOE slide deck providing an introduction to C2M2 concepts, use cases, and the self-evaluation process. Useful for executive briefings.
The NIST CSF provides the Identify, Protect, Detect, Respond, Recover functions that underpin many C2M2 domain objectives. C2M2 v2.1 aligns to CSF 1.1; CSF 2.0 adds a Govern function.
Guide for Industrial Control System (ICS) security. Essential companion for C2M2 ASSET and ARCHITECTURE domain practices relating to OT environments.
Comprehensive control catalog. Useful for mapping C2M2 practices to specific security controls when building your SSP or evidence package.
Guidance for conducting risk assessments. Directly supports C2M2 RISK domain practices at MIL 1 and MIL 2.
The E-ISAC provides cybersecurity information sharing, analysis, and situational awareness for the electricity sector. Membership supports C2M2 SITUATION and THREAT domain MIL 3 practices.
Threat intelligence and information sharing for the oil and natural gas sector. Key resource for organizations pursuing C2M2 in the ONG subsector.
Free cybersecurity resources, advisories, vulnerability alerts, and the Known Exploited Vulnerabilities (KEV) catalog. Supports THREAT domain practices.
CISA's ICS-CERT provides advisories and alerts specific to industrial control systems. Essential for OT-focused threat and vulnerability management.
DOE CESER offers training for organizations that want to prepare their own C2M2 facilitators. Check the CESER website for current course offerings and schedules.
INL supports DOE energy sector cybersecurity programs and offers training resources including C2M2-aligned content for OT/ICS environments.
SANS offers ICS410, ICS515, and other courses that build skills directly relevant to C2M2 ASSET, ARCHITECTURE, RESPONSE, and SITUATION domains.