SUPPLEMENTARY INFORMATION:

The C2M2 helps organizations evaluate and improve their cybersecurity capabilities, considering their specific risk environment. The model is a voluntary tool, tailored specifically for the energy industry, that enables companies to set targets, evaluate and benchmark their cybersecurity capabilities, and use the results to prioritize actions and investments. It is scalable for a company of any size, and is designed to evaluate practice in both the information technology (IT) and operational technology (OT) environments.

DOE originally developed the C2M2 with input from energy industry partners in 2012, and released an updated Version 1.1 in 2014, with separate versions targeted for the electricity and oil and natural gas subsectors. Version 2.0, released July 2021, is designed for use across the energy sector, and can be used by other critical infrastructure sectors as well.

The Version 2.0 update was guided by input from the Energy Sector C2M2 Working Group, which DOE formed with the Electricity and Oil & National Gas Subsector Coordinating Councils. The update better addresses new technologies like cloud, mobile, and artificial intelligence, and evolving threats such as ransomware and supply chain risks.

While the structure of the model remains the same, this update resulted in some key changes:

• Revisions to two-thirds of model practices—including substantive changes and clarifications—along with additions, deletions, and combining of practices
• Addition of a Cybersecurity Architecture domain focused on planning, designing, and managing the cybersecurity control environment
• Significant updates to the Risk Management domain to incorporate leading risk management practices and enhance coordination between cyber and enterprise risk management
• Refresh of the Dependencies domain, now called the Third-Party Risk Management domain, to ensure the model effectively addresses third-party IT and OT cybersecurity risks, like sensitive data in the cloud and vendors with privileged access, as well as build supply chain security into organizational culture
• Integration of Information Sharing domain activities into the Threat and Vulnerability Management and Situational Awareness domains
• Addition of help text for each practice to improve clarity and consistency in how practices are applied

DOE requests public comment on the C2M2 to inform the C2M2 Working Group as it develops future model updates. Specifically, DOE seeks input on the following items:

• The usefulness of C2M2 practices in evaluating and improving cybersecurity program capabilities
• The applicability of practice language to the IT and OT environments in use by energy sector organizations
• The readability of and ability to understand practice language
• The completeness of cybersecurity domains, objectives, and practices included within the C2M2

The effectiveness of guidance documentation (e.g., model introduction sections, domain introductions, and appendices) in conveying model concepts, architecture, and how to use the model

• Any other potential improvements to the C2M2 documentation or practices contained therein

For more information on the C2M2, or to review the model document, visit www.energy.gov/​c2m2.

Confidential Business Information: Pursuant to 10 CFR 1004.11, any person submitting information that he or she believes to be confidential and exempt by law from public disclosure should submit via email two well-marked copies: One copy of the document marked “confidential” including all the information believed to be confidential, and one copy of the document marked “non-confidential” with the information believed to be confidential deleted. DOE will make its own determination about the confidential status of the information and treat it according to its determination.

Signing Authority

This document of the Department of Energy was signed on November 18, 2021, by Fowad Muneer, Acting Deputy Assistant Secretary for the Cybersecurity for Energy Delivery Systems Division, pursuant to delegated authority from the Secretary of Energy. That document with the original signature and date is maintained by DOE. For administrative purposes only, and in compliance with requirements of the Office of the Federal Register, the undersigned DOE Federal Register Liaison Officer has been authorized to sign and submit the document in electronic format for publication, as an official document of the Department of Energy. This administrative process in no way alters the legal effect of this document upon publication in the Federal Register .