# DOE Cybersecurity Capability Maturity Model v2.1

Framework id: `doe_c2m2`. Maturity Model. Publisher: U.S. Department of Energy (DOE). Version: 2.1 (2022). Region: USA. Mapping licence: CC BY-SA 4.0.
Source text: https://www.energy.gov/ceser/cybersecurity-capability-maturity-model-c2m2

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (10, average coverage 84%)
- ACCESS Identity and Access Management: AC-02, AC-03, AC-05, AC-06, AC-07, AC-17, IA-02, IA-03, IA-04, IA-05, IA-08, IA-12 (88%)
- ARCHITECTURE Cybersecurity Architecture: SC-07, SC-32, AC-04, PL-08, SA-08, SC-46, SA-17 (78%)
- ASSET Asset, Change, and Configuration Management: CM-02, CM-03, CM-05, CM-06, CM-07, CM-08, CM-09, PM-05 (85%)
- PROGRAM Cybersecurity Program Management: PM-01, PM-02, PM-03, PM-04, PM-06, PM-09, PM-14, PL-01, PL-02 (88%)
- RESPONSE Event and Incident Response, Continuity of Operations: IR-01, IR-02, IR-03, IR-04, IR-05, IR-06, IR-08, CP-01, CP-02, CP-04, CP-09, CP-10 (85%)
- RISK Risk Management: RA-01, RA-02, RA-03, RA-07, PM-09, PM-28 (85%)
- SITUATION Situational Awareness: AU-02, AU-03, AU-06, SI-04, CA-07, SC-48, IR-05 (80%)
- THIRD Third-Party Risk Management: SA-04, SA-09, SR-01, SR-02, SR-03, SR-05, SR-06, PM-30 (80%)
- THREAT Threat and Vulnerability Management: RA-02, RA-03, RA-05, RA-07, RA-09, PM-15, PM-16, SI-02, SI-05 (82%)
- WORKFORCE Workforce Management: AT-01, AT-02, AT-03, AT-04, PS-01, PS-02, PS-03, PS-04, PS-06, PS-07, PM-13 (85%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=doe_c2m2
- Control-to-clause mappings as JSON: /api/v1/frameworks/doe_c2m2?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/doe-c2m2.json
- Page for people: /frameworks/doe-c2m2/