Security Maturity Models for Ukraine's Critical Infrastructure

Cyber security maturity models provide structured frameworks for assessing an organization's security capabilities against defined levels of sophistication, consistency, and effectiveness. They operationalize "how good is our security?" into measurable criteria across domains including governance, risk management, identity, detection, response, and recovery. For Ukraine's international partners and government oversight bodies, maturity models provide a consistent vocabulary for assessing progress, identifying gaps, and directing assistance investments.

The Cybersecurity Capability Maturity Model (C2M2)

The Cybersecurity Capability Maturity Model (C2M2), developed by the US Department of Energy, was designed specifically for critical infrastructure operators. C2M2 organizes cybersecurity practices into 10 domains—Asset, Change, and Configuration Management; Identity and Access Management; Threat and Vulnerability Management; Situational Awareness; Information Sharing and Communications; Event and Incident Response; Supply Chain and External Dependencies; Workforce; Cybersecurity Program Management—with practices at each domain scored on a 0-3 maturity indicator level (MIL) scale.

MIL 0 indicates the capability is not performed. MIL 1 indicates initiated capabilities—some elements are performed but without consistent processes or documentation. MIL 2 indicates performed capabilities—practices are consistently implemented across the organization. MIL 3 indicates managed capabilities—practices are formally governed, monitored, and improved through management review. C2M2's critical infrastructure focus makes it more directly applicable to Ukrainian energy, water, and transportation operators than general-purpose IT maturity frameworks.

Adapting C2M2 for Ukraine's Wartime Context

Standard C2M2 assessments assume peacetime commercial operations. Adapting the framework for Ukrainian wartime conditions requires accounting for factors not addressed in the original model: the increased frequency and sophistication of actual threat events compared to typical critical infrastructure; the physical access limitations created by active conflict; the simultaneous cyber and kinetic attack scenarios; and the integration requirements with military and government emergency management functions. International assessors working in Ukraine have developed adapted scoring guidance that adjusts MIL thresholds for elements where wartime conditions create genuine operational constraints that would otherwise score as immaturity.

Maturity Assessment Results by Sector (2022-2024)

NIST Cybersecurity Framework Application

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five functions: Identify, Protect, Detect, Respond, Recover. While less structured than C2M2 in its maturity progression, NIST CSF's simplicity makes it more accessible for smaller organizations and provides a common vocabulary compatible with US government program reporting requirements. Ukrainian government agencies receiving CISA assistance have been assessed against NIST CSF current profiles and worked toward target profiles that define the desired security state to be achieved through the assistance program.

International Assessment Findings

Multiple international organizations—CISA, ENISA, NATO CCDCOE, and bilateral government teams—have conducted maturity assessments of Ukrainian critical infrastructure operators. While specific findings are not publicly reported, aggregate themes from public SSSCIP reporting and partner communications include consistent identification of three cross-sector gaps: asset inventory completeness (organizations cannot identify all assets, creating detection blind spots); supply chain security (vendor and software supply chain risk management practices remain immature); and OT security (operational technology security lags IT security across almost all assessed organizations, with OT-specific tools and skills in shorter supply).

Maturity as a Donor Accountability Mechanism

Annual maturity assessment against consistent frameworks has become a key donor accountability mechanism for international assistance programs. When the US, EU, or other donors invest in Ukrainian cybersecurity capacity, maturity score improvement provides a measurable outcome metric. A program targeting energy sector security ideally shows C2M2 average MIL improvements across assessed operators, with specific domain improvements reflecting the particular interventions funded. This evidence-based accountability strengthens the case for continued investment and enables optimization of assistance program design based on observed maturity improvement patterns.

FAQ

What is the difference between C2M2 and CMMI?

CMMI (Capability Maturity Model Integration) is a process improvement framework originally developed for software development organizations, later extended to services and acquisitions. C2M2 is a cybersecurity-specific adaptation inspired by CMMI's maturity level structure but with domains and practices specifically designed for critical infrastructure cybersecurity. C2M2 was developed by the US Department of Energy and Electricity Subsector Coordinating Council specifically for energy sector application.

How are maturity assessments conducted without revealing sensitive information about vulnerabilities?

Maturity assessments focus on process maturity and capability existence rather than specific technical configurations. Assessors examine governance documents, interview personnel, observe processes, and review system inventories without necessarily penetrating systems or requiring disclosure of specific vulnerability data. Results are typically classified or restricted to limit adversary access to organizational weakness profiles while enabling internal improvement programs and donor oversight.

Why does supply chain management consistently score low in Ukrainian assessments?

Supply chain security is a relatively new domain even in mature Western organizations—most organizations globally have under-developed practices in this area. For Ukraine specifically, the legacy of Soviet economic integration with Russia created supply chain dependencies (particularly in OT components and industrial software) that were difficult to assess and have required systematic replacement programs still in progress. The M.E.Doc/NotPetya attack created acute awareness of supply chain risk but implementing comprehensive supply chain security programs takes years.

What maturity level should Ukrainian critical infrastructure target?

C2M2 MIL 2 (Performed, with consistent organizational implementation) is typically cited as the minimum acceptable level for critical infrastructure cybersecurity, with MIL 3 (Managed, with governance and continuous improvement) as the target for highest-risk operators. Ukraine's 2024 averages showing 1.9 for energy large operators approaching MIL 2 and 2.3 for financial sector exceeding MIL 2 represent genuine progress from 2022 baselines, with continued investment required to achieve and sustain MIL 3 target state.

How does maturity model assessment differ from a penetration test?

Maturity model assessment evaluates whether organizational capabilities exist and how consistently they are applied—it measures the program, not the technical defenses. Penetration testing evaluates whether technical defenses actually prevent or detect simulated attacks—it measures the walls, not the planning. Both are valuable and complementary: an organization could have mature processes but still have technical vulnerabilities, or have strong technical defenses built without mature processes (creating fragility). Comprehensive security evaluation uses both approaches.

Sources

1. US Department of Energy — "Cybersecurity Capability Maturity Model (C2M2) Version 2.1," energy.gov
2. NIST — "Cybersecurity Framework Version 2.0," nist.gov 2024
3. SSSCIP Ukraine — "Critical Infrastructure Cybersecurity Maturity Assessment Program," 2023
4. ENISA — "Critical Infrastructure Cybersecurity Maturity Report: Eastern Europe," 2022-2023
5. Carnegie Mellon SEI — "CMMI Development v2.0 Model Overview," sei.cmu.edu