C2M2 v2.1 maturity assessment: what the scores actually tell you about attack surface exposure
Julian ThorneApril 29, 2026
Key takeaways
C2M2 v2.1 scores across 10 domains and 356 practices -- organizations that self-score consistently rate Situational Awareness (SA) and Event and Incident Response (IR) domains 1 to 2 MIL tiers higher than independent assessors find when they validate evidence.
The C2M2 Maturity Indicator Level (MIL) scale runs from MIL0 to MIL3 -- the gap between MIL1 and MIL2 is not more controls, it is whether the controls are documented, consistently applied, and reviewed. Most critical infrastructure organizations operate between MIL1 and MIL2 in practice while believing they are at MIL2.
C2M2 is the only major framework that explicitly scores the management practices required to sustain controls over time -- organizations that pass NIST CSF reviews but score low on C2M2 management practices have controls that will degrade within 12 to 18 months without active governance.
The Threat and Vulnerability Management (TVM) domain is where external attack surface exposure maps directly to C2M2 scores -- organizations with unmonitored external-facing assets score MIL1 on TVM regardless of how mature their internal vulnerability management process appears.
C2M2 and CMMC address different risk surfaces: CMMC evaluates whether specific controls exist; C2M2 evaluates whether the organizational capability to sustain those controls is mature. An organization can pass a CMMC Level 2 assessment and score MIL1 on C2M2 governance domains.
The most actionable output of a C2M2 gap analysis is not the domain scores -- it is the list of management practice gaps that explain why the same control failures recur across assessment cycles.
TL;DR
C2M2 v2.1 is the framework that tells you why your controls keep failing, not just that they failed. The maturity indicator levels distinguish between organizations that have controls and organizations that have the management infrastructure to keep those controls functioning under operational pressure. For critical infrastructure, that distinction is the difference between a security program and a security posture that holds when something actually goes wrong.
What a C2M2 assessment found that the NIST CSF review missed
A regional electric utility had completed a NIST CSF assessment six months earlier and received a profile showing Tier 3 performance across most function areas. Their security program had been built deliberately over four years. When a C2M2 v2.1 assessment was conducted as part of a DOE voluntary program participation, the Situational Awareness domain scored MIL1. The utility had a SIEM, threat feeds, and an analyst team. The MIL1 score was not about technology.
The SA domain in C2M2 evaluates whether situational awareness activities are performed, whether they are documented and consistently applied, and whether there is a management process to review their effectiveness and adjust them. The utility's analyst team ran threat hunts based on analyst judgment rather than documented hunt hypotheses. Threat feed integration existed but had no documented process for how intelligence was incorporated into detection rules or whether integration was reviewed on a defined cadence. The NIST CSF Tier 3 rating reflected that the capability existed. The C2M2 MIL1 score reflected that the capability was not managed. Both were accurate. They were measuring different things.
What MIL tiers actually measure
C2M2 v2.1 uses Maturity Indicator Levels from MIL0 to MIL3 across 10 domains. The progression is not a volume scale -- it does not measure how many controls exist. It measures the management rigor behind those controls. MIL1 means practices are performed but may be ad hoc. MIL2 means practices are documented and consistently followed. MIL3 means practices are managed -- reviewed, measured, and adjusted based on performance data. The distinction matters operationally: MIL1 organizations have capabilities that depend on specific individuals. MIL2 organizations have capabilities that survive personnel turnover. MIL3 organizations have capabilities that improve over time because the management process generates feedback.
Example
In the Threat and Vulnerability Management domain, a MIL1 organization performs vulnerability scanning. A MIL2 organization has a documented scanning schedule, scope definition, and remediation prioritization process. A MIL3 organization tracks remediation timelines against targets, reviews the process when targets are missed, and adjusts the process based on what the data shows. The difference in actual security outcome between MIL1 and MIL3 TVM is not the scanner -- it is whether the organization knows its mean time to remediate critical vulnerabilities, whether that number is improving, and whether anyone is accountable when it is not.
The 10 C2M2 v2.1 domains are: Asset, Change, and Configuration Management (ASSET); Threat and Vulnerability Management (TVM); Identity and Access Management (IAM); Situational Awareness (SA); Information Sharing and Communications (ISC); Event and Incident Response, Continuity of Operations (IR); Supply Chain and External Dependencies Management (EDM); Workforce Management (WM); Cybersecurity Program Management (CPM); and Configuration Management (CHANGE). Organizations in critical infrastructure typically show the largest MIL gaps in SA, TVM, and EDM -- the domains most directly connected to external attack surface.
What independent C2M2 assessments find versus self-assessment
Assessment base: Vulnox assessment data, 2024-2025, critical infrastructure and regulated industry environments using C2M2 v2.1 for cybersecurity maturity evaluation
Self-assessed SA and IR domain scores overstate maturity by one to two MIL tiers
The Situational Awareness and Incident Response domains are the most consistently inflated in self-assessments. Organizations score themselves at MIL2 based on the presence of SIEM platforms, threat feeds, and IR plans. Independent assessment finds MIL1 because the management practices that define MIL2 -- documented processes, consistent application, review cadence -- are absent. The technology exists. The operational discipline to manage it does not. This pattern is consistent enough that it should be treated as a prior assumption when reviewing a self-assessed C2M2 score in these domains.
A C2M2 score submitted to a regulator or used for internal resource allocation that was generated through self-assessment without evidence validation is an optimistic estimate, not a measured posture. The resource allocation and risk decisions built on it are built on the wrong baseline.
Supply chain and external dependencies (EDM) domain is consistently the lowest independently scored domain
The EDM domain requires organizations to identify and manage cybersecurity risks from third-party dependencies -- including vendors, service providers, and operational technology suppliers. In assessments, this domain scores lower than any other across critical infrastructure environments. The pattern is not that organizations have no vendor management process. It is that the process addresses contract compliance and service levels rather than cybersecurity risk. Vendor cybersecurity posture is assessed at onboarding and rarely revisited. Operational technology vendors with persistent remote access to control systems are frequently not included in the vendor risk inventory at all.
The EDM gap is directly exploitable. An attacker who cannot penetrate the utility directly can identify the SCADA vendor with persistent remote access and work backwards from there. The C2M2 EDM score is a proxy for how visible that attack path is to the organization.
Organizations at MIL2 in most domains frequently have MIL0 in CPM
The Cybersecurity Program Management domain evaluates whether there is organizational infrastructure to sustain the other nine domains -- executive sponsorship, program objectives, resource allocation, and performance measurement. Organizations that have invested in technical security controls often have MIL2 or MIL3 scores in IAM or TVM while scoring MIL0 or MIL1 in CPM because security is managed as an IT function rather than a program with defined objectives and accountability at leadership level. The consequence is that technical maturity is fragile: it depends on individual contributors and budget cycles rather than organizational commitment.
A C2M2 remediation roadmap that focuses on technical domains without addressing CPM is building on an unstable foundation. Controls that are not anchored in a managed program degrade when the people who built them leave or when budget pressure arrives.
Higher NIST CSF tier ratings do not predict higher C2M2 scores
Common belief
Organizations that have completed NIST CSF assessments and achieved Tier 3 or Tier 4 profiles reasonably expect to score well on C2M2. The frameworks cover similar ground -- both address risk management, threat intelligence, incident response, and supply chain. An organization at NIST CSF Tier 3 should be at C2M2 MIL2 or better across most domains. That assumption is wrong often enough to be operationally misleading.
What we found
In assessments where Vulnox evaluated organizations that had recent NIST CSF profiles, the C2M2 domain scores in SA and TVM were lower than the NIST CSF profile would predict in the majority of cases. The NIST profile accurately described the organization's strategic orientation. The C2M2 scores accurately described the operational implementation. The gap between strategic intent and operational practice is exactly what C2M2 is designed to surface.
NIST CSF tiers describe risk management approach at an organizational level -- how cybersecurity risk is integrated into organizational decision-making. C2M2 MIL levels describe practice maturity at a domain level -- how consistently specific security activities are performed, documented, and managed. An organization can have mature risk governance (NIST CSF Tier 3) and inconsistent operational practices (C2M2 MIL1) because the framework measures are orthogonal, not hierarchical. The organization understands why security matters and has executive support. It does not have documented processes for how its SOC analysts triage alerts. Both statements can be true simultaneously.
C2M2 versus NIST CSF versus CMMC: what each one actually measures
C2M2 v2.1
Measures organizational capability maturity -- not just whether controls exist, but whether management practices exist to sustain them. The MIL progression explicitly models the difference between ad hoc and managed. Designed for critical infrastructure with a specific focus on operational technology environments alongside IT.
Use C2M2 when you need to understand why controls keep failing across assessment cycles, or when you need to evaluate whether a security program will hold up under operational stress. C2M2 tells you about sustainability, not just current state.
NIST CSF 2.0
Provides a flexible taxonomy for describing and communicating cybersecurity risk management. Tier ratings are organizational self-designations, not independently validated scores. Does not specify how practices should be managed or what evidence demonstrates consistent operation.
Use NIST CSF for communicating cybersecurity posture to executives and boards, for aligning with regulatory expectations that reference it, and for initial program scoping. It does not provide the operational specificity needed to identify why specific capabilities are immature.
CMMC Level 2
Evaluates whether 110 specific NIST SP 800-171 practices are implemented with evidence of consistent operation. C3PAO-verified. Applies specifically to defense industrial base contractors protecting CUI. Does not evaluate management program maturity or the organizational infrastructure behind controls.
An organization can achieve CMMC Level 2 certification and score MIL1 on C2M2 governance domains because CMMC verifies control implementation and C2M2 verifies whether the organization has the management infrastructure to keep those controls working. They are complementary, not redundant.
Where C2M2 gap analyses miss
Scoring management practices without validating evidence
The MIL2 threshold requires that practices are documented and consistently followed. In self-assessments, organizations frequently score MIL2 based on the existence of documentation rather than evidence of consistent application. A documented vulnerability management process that has not been followed consistently for the past 12 months is a MIL1 capability with MIL2 documentation. Independent validation asks for records of process execution, not just process documents. The difference between the two is where self-assessment and independent assessment scores diverge most.
External attack surface as a TVM input
The TVM domain in C2M2 is typically assessed against internal vulnerability management practices -- scan coverage, remediation timelines, prioritization methodology. The external attack surface -- internet-facing assets, forgotten subdomains, exposed management interfaces, third-party systems with network connectivity to OT environments -- is rarely integrated into TVM domain evidence. An organization with mature internal vulnerability management and an unmonitored external attack surface has a TVM gap that the standard assessment methodology will not surface unless external exposure is explicitly included in scope.
Operational technology environments scored separately from IT
C2M2 was designed with operational technology environments in mind, and the framework explicitly applies to both IT and OT systems. In practice, assessments of critical infrastructure organizations frequently evaluate IT systems in detail and OT environments at a high level because OT access for assessment purposes is more operationally constrained. The result is a domain score that reflects IT maturity and underrepresents OT gaps. For energy, water, and manufacturing environments, the OT assessment gap is the more consequential one.
CPM domain treated as administrative overhead
The Cybersecurity Program Management domain is frequently deprioritized in remediation roadmaps because its gaps are governance and organizational rather than technical. Organizations that have invested in technical controls are tempted to improve TVM and IAM scores while leaving CPM gaps unaddressed. CPM gaps do not produce immediate, visible vulnerabilities. They produce conditions where technical controls degrade over 18 to 24 months because there is no organizational infrastructure to maintain them. Skipping CPM remediation is the structural reason organizations score similarly on consecutive C2M2 assessments despite investing in technical improvements between cycles.
Where C2M2 adoption and enforcement is heading
DOE and TSA will require C2M2-based self-assessments as a condition of critical infrastructure incentive programs and regulatory safe harbors within 24 months, making C2M2 scores part of the regulatory record for electric utilities, pipelines, and water systems.
The DOE has already used C2M2 in voluntary programs and referenced it in cybersecurity guidance for the energy sector. The direction of travel in critical infrastructure regulation is toward maturity-based frameworks rather than pure control checklists, because control checklists do not evaluate whether organizations can sustain security under operational stress. C2M2 is the only widely-adopted framework that measures that dimension. Regulatory programs that want to distinguish between organizations with genuine capability and organizations with compliant documentation will find C2M2 structurally useful.
Confidence: highA DOE or TSA rulemaking or incentive program issued before 2027 that references C2M2 scores as a qualification criterion or reporting requirementThe EDM domain will become the leading source of C2M2 audit findings within the next two years as threat actors increasingly target OT vendor remote access pathways rather than direct network intrusion, making supply chain dependency visibility a first-order security requirement.
The attack pattern of compromising vendors with persistent access to critical infrastructure targets rather than attacking the infrastructure directly is well-documented and increasing. C2M2 EDM scores currently reflect that most organizations have not built the vendor visibility required to detect or limit this exposure. As regulators and auditors focus on supply chain risk following publicized incidents, EDM will receive the same scrutiny that IR and TVM currently receive.
Confidence: highC2M2 assessment aggregate data or regulatory audit summaries showing EDM as a top-three finding domain by 2027
Why most organizations are doing C2M2 assessments in the wrong order
The standard C2M2 engagement sequence is: assess all ten domains, score everything, build a remediation roadmap ordered by score gaps. That sequence produces a long roadmap with equal weight given to technical and management domains and typically results in organizations investing in technical domain improvements while CPM and EDM gaps remain unaddressed because they are less legible to technical teams. The more effective sequence is to assess CPM first, determine whether the organizational infrastructure exists to sustain improvements, and address structural program gaps before investing in technical domain maturity. Technical controls implemented without a managed program behind them produce temporary score improvements that revert by the next assessment cycle.
Counterargument
The counterargument is that regulators and leadership want to see technical domain improvements and that CPM improvements are harder to demonstrate than TVM or IAM score changes. That is accurate. The practical response is to sequence CPM improvements in parallel with the first technical domain improvements rather than last, so that by the time the second assessment cycle arrives there is organizational infrastructure to show alongside the technical gains.
One analysis to run before the first domain scoring session
Before starting a C2M2 domain assessment, map your external-facing assets against your TVM domain scope definition. If the TVM assessment will be conducted against internal systems only, your lowest-hanging external attack surface gaps will not appear in the domain scores and will not appear in the remediation roadmap. The organizations that use C2M2 most effectively are the ones that treat external exposure as a TVM input before the assessment starts, not a separate exercise that runs in parallel without connecting to maturity scores.
Further Reading
Gap Analysis
gap analysis workflowDigital Footprint
digital footprint analysisNIST Cybersecurity Framework 2.0
NIST Cybersecurity FrameworkCompliance Gap Analysis Guide
compliance gap analysis guideNational Vulnerability Database Home
National Vulnerability Database
Frequently Asked Questions
What do C2M2 v2.1 Maturity Indicator Levels actually measure?
C2M2 MIL levels measure management rigor, not control volume. MIL1 means practices are performed but may be ad hoc. MIL2 means practices are documented and consistently followed. MIL3 means practices are reviewed, measured, and adjusted based on performance data. The progression describes whether controls are sustainable under operational pressure, not whether they exist.
How do C2M2 v2.1 scores compare to NIST CSF tier ratings?
NIST CSF tiers describe organizational risk management approach at a strategic level. C2M2 MIL scores describe operational practice maturity at a domain level. An organization can be NIST CSF Tier 3 and C2M2 MIL1 in Situational Awareness simultaneously -- the frameworks measure different things and higher NIST CSF ratings do not reliably predict higher C2M2 scores.
Which C2M2 v2.1 domains are most commonly underscored in self-assessments?
Situational Awareness (SA) and Event and Incident Response (IR) are consistently scored 1 to 2 MIL tiers higher in self-assessments than independent assessors find when validating evidence. The gap is not technology -- it is the absence of documented management processes behind the technology that defines the MIL2 threshold.
What is the C2M2 Supply Chain and External Dependencies domain and why does it matter?
The EDM domain evaluates whether organizations identify and manage cybersecurity risks from third-party dependencies including vendors with remote access to operational technology systems. It consistently scores lowest in independent assessments of critical infrastructure organizations. The gap is directly exploitable: attackers targeting critical infrastructure increasingly compromise vendors with persistent OT access rather than attacking directly.
Can an organization pass CMMC Level 2 and still score low on C2M2?
Yes. CMMC Level 2 verifies that 110 specific controls are implemented with evidence. C2M2 evaluates whether the organizational management infrastructure exists to sustain those controls over time. An organization can have all controls in place for a CMMC assessment and score MIL1 on C2M2 governance domains because the frameworks measure different dimensions of the same security program.
What is the most common C2M2 finding across critical infrastructure assessments?
The Cybersecurity Program Management (CPM) domain is where the most structurally significant gaps appear -- organizations with mature technical controls frequently score MIL0 or MIL1 on CPM because security is managed as an IT function rather than as a program with defined objectives and executive accountability. CPM gaps predict which organizations will show similar scores on their next assessment cycle despite investing in technical improvements.
How should external attack surface be incorporated into a C2M2 gap analysis?
External-facing assets should be mapped against the TVM domain scope before scoring begins. C2M2 TVM assessments conducted against internal systems only will not surface unmonitored external exposure. Organizations with mature internal vulnerability management and unmonitored external attack surface have a TVM gap that standard assessment methodology will miss unless external asset visibility is explicitly included in scope.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.