Cybersecurity
Maturity
Models

A maturity model provides a set of indicators that represent capability and progression in a particular discipline. A maturity model provides a benchmark against which an organization can evaluate its current level of performance and, if warranted, set programmatic goals and priorities for improvement. The underlying principle is that not all organizations need to have the same maturity in a given discipline. Organizations facing high risks and with available resources typically require a more mature program than organizations that are facing low risk or are just starting to develop their capability.

Icon images showing the progression from crawl to walk to run

The human mobility analogy in a maturity model is the process of first learning to crawl, then walk, and then run. Young children don’t jump from crawlers to runners overnight, they need to develop their muscles and coordination over time and with practice to achieve their mobility goals. Similarly, organizations need to first develop a core capability that provides some level of performance before they work to grow their capabilities in a thoughtful, systematic manner.

PNNL scientists and researchers have developed a robust portfolio of maturity models that are free and available for many organizations to use. Our core models focus on cybersecurity applications, but some focus on other programmatic issues, such as energy infrastructure resilience, chemical facility security, supply chain security and the secure design and development of software. Though the primary audience for these tools is the energy sector many of these tools are applicable to multiple sectors.

For example, a cybersecurity maturity model assesses the maturity of an organization’s cybersecurity program and identifies areas that could be improved to address the continually evolving cyber threat environment. This type of model helps organizations improve their cybersecurity posture, develop a roadmap that prioritizes improvements, and helps subject matter experts communicate effectively with senior management to obtain support for risk-based cybersecurity improvements.

Maturity models can used regardless of size, type, or industry of the organizations. The models can focus on a broad area of interest (e.g., cybersecurity or resilience capabilities) across an entire organization, they can examine programmatic capabilities at a single facility, or they focus on a component of process operations.

Maturity models in PNNL’s portfolio are based on the Cybersecurity Capability Maturity Model (C2M2) framework. The C2M2 framework was developed through a public-private partnership effort sponsored by the U.S. Department of Energy. Work on the C2M2 began in 2012 and was conducted to improve electricity subsector cybersecurity capabilities and to better understand the cybersecurity posture of the electric power grid. Today the C2M2 and other PNNL maturity models are available for online access on the model’s webpage. The on-line versions of the models are provided as HTML-based software tools. The tools are designed to be easy to use and provide security and privacy for users. Extensive training materials are provided on each model’s “Resources” webpages and typically includes a general model user guide, guidance on how to organize and facilitate a self-assessment, and a step-by-step instruction manual for the tools.

Security and privacy are important features of our online tools and were a “must have” specified by our industry partners. All data entered by the user and all model output reports are generated and stored on the user’s computer. No user data are ever communicated to the model server. If a user requests an off-line version of our tools, our team will provide that product.

The models are used by thousands of people across a diverse range of countries around the globe. We can use website traffic analysis tools to determine the frequency with which our tools and support products are accessed and other generic information, but no information can be acquired about specific users and the information they enter into the tools.

We invite organizations to access and make use of our maturity models (summarized below) to assess their programmatic maturity in a variety of areas. We value user feedback on the models. You can share your feedback and comments with the PNNL cybersecurity team.