Lion Cipher Lab
Assess cyber maturity with the C2M2
- GRC / Compliance
- Advanced
- ~90 min
- Free · no account required
Why it matters
Leadership asks two questions a firewall log can never answer: 'how mature is our cybersecurity program, really?' and 'where do we invest next?' A capability maturity model turns those into a defensible, repeatable answer instead of a gut feeling. The C2M2 -- built by the U.S. Department of Energy but written to be used by any sector -- is one of the most practical: 350-plus practices organized into ten domains, each practice tagged with a Maturity Indicator Level so a self-evaluation produces a concrete 'you are at MIL1 in Asset Management, MIL0 in Threat Management' picture, not a vibe. The…
What you'll learn
- running a Cybersecurity Capability Maturity Model (C2M2) v2.1 self-evaluation end to end for a scenario organization
- scoring practices on the Fully / Largely / Partially / Not Implemented scale with a written justification per answer
- applying the CUMULATIVE Maturity Indicator Level (MIL) rule to derive an achieved MIL per domain
- seeing how a single unmet MIL1 practice caps an entire domain below the next MIL regardless of higher-level work
- turning a domain-by-domain maturity summary into a prioritized, MIL-targeted improvement roadmap sequenced by risk-reduction-per-effort
- distinguishing C2M2 from NIST CSF 2.0 profiles, CMMC certification, and an ISO 27001 conformity audit -- and knowing when to reach for each
Steps in this lab
- What the C2M2 is, in one breath
- Maturity Indicator Levels, and the cumulative rule that is the whole point
- Meet the scenario: Cedar Bluff Regional Water Authority
- Score the ASSET domain (Asset, Change, and Configuration Management)
- Score the THREAT domain (Threat and Vulnerability Management) -- the ceiling trap
- Score the ACCESS and RESPONSE domains
- Derive the achieved MIL per domain (the cumulative math)
- The domain-by-domain maturity summary
- Build the prioritized, MIL-targeted improvement roadmap
- C2M2 vs its neighbors -- and when to reach for each
- The judgment: why the floor beats the average