CR-CMM
The Cyber Resilience Capability Maturity Model lets you measure, benchmark, and improve resilience across 10 core domains.
About CR-CMM
Inspired by the SOC-CMM (Security Operations Capability Maturity Model) and CTI-CMM (Cyber Threat Intelligence Capability Maturity Model), the CR-CMM provides a structured pathway for organizations to assess and advance their resilience capabilities.
Unlike traditional compliance-focused assessments, CR-CMM emphasizes operational survivability, business continuity, and the ability to adapt and recover from disruptions.
“With a one-hour workshop we pinpointed our biggest resilience gaps...”
— CISO, healthcare sector
10 Core Practices
The foundational domains of cyber resilience capability.
Asset Inventory & Criticality
Comprehensive visibility into organizational assets, their interdependencies, and their criticality to core business functions.
Threat Intelligence Integration
Systematic collection, analysis, and operationalization of threat intelligence to anticipate and prepare for emerging threats.
Vulnerability Management
Continuous identification, prioritization, and remediation of vulnerabilities across the attack surface.
Incident Detection & Response
Automated detection capabilities and well-rehearsed response procedures that minimize dwell time and impact.
Business Continuity Planning
Documented and regularly tested plans to maintain critical operations during and after disruptive events.
Recovery & Restoration
Pre-planned recovery procedures with clear RTOs/RPOs and regularly tested restoration capabilities.
Third-Party Risk Management
Assessment and ongoing monitoring of supply chain and partner risks that could affect organizational resilience.
Security Architecture
Defense-in-depth architecture designed for graceful degradation and minimal blast radius.
Governance & Accountability
Clear ownership, reporting structures, and board-level oversight of resilience initiatives.
Continuous Improvement
Post-incident analysis, lessons learned, and systematic enhancement of resilience capabilities.
Maturity Levels
From ad-hoc responses to predictive optimization.
Initial
Level 1
Ad-hoc responses to incidents. Limited visibility into assets and threats. Reactive posture.
Developing
Level 2
Basic processes documented. Some automation in place. Limited testing and training.
Defined
Level 3
Formalized procedures. Regular testing. Clear governance and accountability structures.
Managed
Level 4
Quantitative metrics in place. Continuous monitoring. Proactive threat hunting.
Optimizing
Level 5
Predictive capabilities. Fully automated response. Continuous improvement driven by data.
Frequently Asked Questions
Common questions about the CR-CMM framework.
What is the CR-CMM?
Who can use the CR-CMM?
How long does an assessment take?
Is the CR-CMM free to use?
How does CR-CMM compare to other maturity models?
Can CR-CMM be integrated with existing frameworks?
How often should an organization reassess?
Where can I learn more about implementation?
Ready to assess your resilience?
Download the complete CR-CMM framework or learn more about implementation.