What is a Cybersecurity Maturity Model?
A Cybersecurity Maturity Model is a framework that measures how mature an organisation’s security approach is on an ascending scale of levels, from ad hoc and reactive to managed and continuously improving, so that the organisation can establish where it stands and plan a targeted growth path. A maturity model therefore describes not only which controls exist but above all how well they are embedded: documented, repeatable, measured and improved. Well-known examples are C2M2 from the US Department of Energy, the CMMC programme of the US Department of Defense and the maturity levels in IEC 62443.
In OT environments, a maturity model supports the gradual introduction of cybersecurity, calibrated to process-critical requirements and the risk profile of the installation.
🧠 How does a Cybersecurity Maturity Model work?
A maturity model divides security into domains (such as access management, incident response or supplier risk) and assigns a maturity level to each domain. Every level has concrete characteristics, so an assessor can use evidence (policies, procedures, log files, interviews) to determine where an organisation stands.
The classic five-step scale comes from the Capability Maturity Model (CMM) developed by the Software Engineering Institute in the 1990s, originally intended for software processes:
| Level | Name | Characteristic in cybersecurity |
|---|---|---|
| 1 | Initial (ad hoc) | No formal approach, reactive, dependent on individuals |
| 2 | Repeatable | Basic controls present and partly repeatable, but not consistent |
| 3 | Defined | Processes defined, documented and applied across the organisation |
| 4 | Managed | Performance measured with KPIs and adjusted based on risk |
| 5 | Optimising | Continuous improvement driven by lessons learned and metrics |
Its successor CMMI names the levels Initial, Managed, Defined, Quantitatively Managed and Optimizing. Importantly, by no means every cybersecurity model uses five levels: C2M2 has three (plus zero), IEC 62443-2-4 has four and CMMC has three.
🔍 Which maturity models are widely used?
| Model | Publisher | Scale | Audience |
|---|---|---|---|
| C2M2 (Cybersecurity Capability Maturity Model) v2.1, June 2022 | US Department of Energy | MIL0–MIL3 across 10 domains | Energy sector, but usable by any IT/OT organisation |
| CMMC (Cybersecurity Maturity Model Certification) | US Department of Defense | Level 1–3 | Suppliers to the US defence establishment |
| IEC 62443-2-4 | IEC | ML1–ML4 (Initial, Managed, Defined, Improving) | Integrators and service providers in industrial automation |
| IEC 62443-2-1:2024 | IEC | Maturity model per security programme element | Asset owners running an OT security programme |
| NIST CSF 2.0 | NIST | Tier 1–4 (Partial, Risk Informed, Repeatable, Adaptive) | All sectors |
| COBIT 2019 | ISACA | Capability levels 0–5 | IT governance and audit |
C2M2 is one of the most widely used public models for OT. Version 2.1 has ten domains, including asset, change and configuration management, threat and vulnerability management, situational awareness, third-party risk and cybersecurity architecture. The Department of Energy offers a free self-evaluation tool, in which each practice is scored on a four-point scale: fully, largely, partially or not implemented. The Maturity Indicator Levels run from MIL0 (not performed) through MIL1 (initiated) and MIL2 (performed) to MIL3 (managed).
CMMC is really a certification programme. Level 1 covers 15 basic requirements for Federal Contract Information, Level 2 the 110 requirements of NIST SP 800-171, and Level 3 adds a selection from NIST SP 800-172. Level 1 is an annual self-assessment, Level 2 is either a self-assessment or a certification by an accredited third-party assessor (C3PAO) depending on the contract, and Level 3 is an assessment by the government itself (DIBCAC). The programme rule (32 CFR Part 170) has applied since 16 December 2024, and since 10 November 2025 CMMC has been written into defence contracts through a three-year phased rollout. European suppliers to US defence programmes encounter it through their prime contractors.
🔄 What is the difference between a maturity model and a framework?
A framework such as NIST CSF or ISO 27001 describes what you need to put in place. A maturity model measures how maturely you do it. In practice the two overlap: NIST CSF has Implementation Tiers, but NIST presents them as a measure of the rigour of risk governance and management, not as a mandatory growth path. ISO 27001 has no levels at all: you are either certified or you are not.
| Aspect | Maturity model | Framework (such as NIST CSF or ISO 27001) |
|---|---|---|
| Purpose | Measure maturity and define a growth path | Structure and controls for security |
| Outcome | A level per domain, for example “MIL2 for access management” | Profile, Statement of Applicability or certificate |
| Levels | Core of the model | Absent (ISO 27001) or supporting (CSF Tiers) |
| Use | Gap analysis, roadmap, benchmark | Setting up and accounting for the management system |
Note also the difference from the Security Levels (SL 1–4) in IEC 62443-3-3. A security level states how strongly a system technically resists a given type of attacker. A maturity level states how well the process around it is organised. A system with SL 3 capabilities managed by an ML1 organisation offers little protection in practice.
🏭 What does maturity look like in an OT environment?
An illustrative growth path for a production site:
- Level 1: ad hoc OT management, no access control on PLCs, no logging, no clear picture of which devices exist
- Levels 2–3: patch management, backups and access control introduced, first per installation and later as a documented standard
- Level 4: complete asset inventory, SIEM and network monitoring with OT protocol awareness, incident response tested in a tabletop exercise
- Level 5: automatic detection of anomalous behaviour (anomaly detection), OT-focused threat intelligence and structured lessons learned
Maturity rarely grows evenly. Many industrial companies score high on physical security and change management, but low on detection and vulnerability management. A profile per domain makes that imbalance visible.
🔧 How do you carry out a maturity assessment?
- Choose the model - C2M2 for a broad OT scan, IEC 62443-2-1 if you already work with IEC 62443, NIST CSF if the organisation already uses it on the IT side.
- Define the scope - one site, one Purdue zone or the whole chain; record which systems are included.
- Gather evidence - workshops with OT, IT and process operations, supplemented by documents and spot checks. Self-assessment without evidence leads to inflated scores.
- Set target levels - not every domain needs the highest level. The target follows from the risk assessment and the criticality of the process.
- Build a roadmap - prioritise the largest gaps between current and target levels and schedule them, ideally aligned with maintenance shutdowns.
- Repeat periodically - an annual reassessment makes progress measurable for management and auditors.
In the Netherlands this is topical because of the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026 as the Dutch implementation of NIS2. The act does not prescribe a maturity model, but it does require appropriate, risk-based measures and involvement of the management body. A repeated maturity assessment is a practical way to demonstrate that duty of care.
🔐 What does a maturity model deliver for security?
- Priorities - investment goes to the domains with the highest risk, not to whatever happens to be visible
- Coherence - the model supports defence in depth, zero trust and least privilege as a programme rather than isolated projects
- Supplier assessment - ask integrators for their IEC 62443-2-4 level and so reduce supply chain risk
- Link to standards - results can be mapped to NIST SP 800-53, ISO 27001 and COBIT
- Budget and governance - a measurable level supports risk management, board decision-making and reporting to regulators, from NIS2 in Europe to FISMA for US federal agencies
A maturity model is not an end in itself, but a tool for structural growth and risk-driven policy. Steering towards a higher score instead of lower risk misses the point.
❓ Frequently asked questions
Which cybersecurity maturity model is best suited to OT?
For OT environments, C2M2 is one of the most widely used public maturity models, because it explicitly covers IT and OT assets and comes with a free self-evaluation tool. Organisations already working with IEC 62443 often choose the maturity model from IEC 62443-2-1. More important than the choice itself is applying the same model consistently over time.
Is a cybersecurity maturity model mandatory under NIS2?
NIS2 and the Dutch Cybersecurity Act do not mandate any specific maturity model. They do require appropriate, risk-based security measures and oversight by the management body. A maturity assessment is therefore a common tool for demonstrating that the duty of care is taken seriously.
What is the difference between CMMC and C2M2?
CMMC (Cybersecurity Maturity Model Certification) is a certification programme of the US Department of Defense that is contractually mandatory for its suppliers, with three levels. C2M2 is a voluntary self-assessment model from the US Department of Energy, with Maturity Indicator Levels MIL0 to MIL3. CMMC is about contractual requirements, C2M2 about internal improvement.
Which maturity level should an organisation aim for?
A cybersecurity maturity model works best with a target level per domain, derived from the risk assessment. For critical processes a defined and measured level (3 to 4 on a five-point scale) is common; aiming for the highest level everywhere is rarely cost-effective.
How long does a maturity assessment take?
A C2M2 self-evaluation of a single OT site is designed as a facilitated one-day workshop with the relevant disciplines, or as a series of 60- to 90-minute sessions when held online. An independent assessment with document review and spot checks typically takes several weeks. A roadmap is drawn up afterwards.
📌 In summary
A Cybersecurity Maturity Model makes the maturity of an organisation’s security approach measurable per domain and turns the gap between current and target levels into a concrete growth path. For OT, C2M2 and the maturity levels in IEC 62443 are among the most widely used models; they help direct investment without over-investing or under-protecting.