C2M2 Cybersecurity Maturity Assessment

These questions are about how your organisation manages cybersecurity for the services people depend on — never about specific systems or sites. Answer what you know. Anything left as Not sure is excluded from the score rather than counted against you, and the report says which areas that applies to.

Risk management
Are cybersecurity risks to your critical services identified and ranked by their impact?

Critical services are what customers or the public depend on — power, water, fuel, production. Ranked means somebody has decided which risks matter most, not only listed them.

Assets and configuration
Do you keep an inventory of the IT and operational technology (OT) systems your critical services depend on?

Computers, servers and network equipment, and control systems such as SCADA, PLCs or remote terminal units. A maintained spreadsheet counts; a list in somebody's head does not.

Threats and vulnerabilities
Are security weaknesses in your IT and OT systems found and dealt with?

For example, watching vendor security advisories, scanning, and patching — or another protection where patching would disrupt operations.

Identity and access
Is access to your critical IT and OT systems given person by person, only to those who need it, and removed when they leave?

Including vendors and remote access. Shared or default logins on control systems are a common gap.

Incident response and continuity
Is there a plan for responding to a cyber incident that also covers keeping operations running or restarting them safely?

Who is called, who decides, and how operations continue while the incident is handled.

About your organisation

An approximate number is fine.

How we handle your data.