DOE C2M2
356 source review items; explicit supporting and external test coverage
All available frameworksWhat the app checks
Technical checks run for the selected scope, available connectors and credentials. Results provide evidence for review; missing data is not a pass.
Explicit requirement-to-test mappings
| Requirement | Collector / test | What it checks or supports |
|---|---|---|
| ASSET-1a | WINDOWS / WIN-INVENTORY-COVERAGE-001 | Partial supporting observation only. Verify asset population, actual operation, timing, exceptions and reviewer conclusions. No automatic framework determination. |
Framework-specific tools and manual work
Rate C2M2 practices is a manual, evidence-backed self-evaluation of 356 practices for a named business function. Record owners and rationale, set target MIL 0-3 for each domain, and review cumulative current-versus-target results. Unknown MIL1 practices keep maturity unknown; this is not an automated maturity scan.
Review imported or exported evidence before attaching it to the assessment. Local inspection does not automatically change server records or assessor decisions.
What requires manual review
Confirm scope and applicability, review the requirement guidance, collect policies and records, conduct interviews or observations where needed, and assess evidence relevance and freshness. Record owners, rationale, workpaper conclusions and remediation. An assessor makes the final decision; a technical pass does not approve the whole framework.
Select the business function and target maturity by domain. Generic evidence readiness is not a C2M2 maturity score. Use the practice-rating worksheet and evaluation report for cumulative MIL calculations; IT/OT observations support human-rated practices. Official public U.S. government source; ITAF evidence actions added. No government endorsement. Referenced third-party publications are not bundled.
Where it is available
This preparation framework is listed in the C32 Professional/MSP application catalog. Free retains its ISO assessment limits. Availability of a framework is separate from the extent of automated scanning.
Coverage shown here comes from the application’s C32 requirement and mapping catalogs.