Cybersecurity Maturity Model is geared to cybersecurity program assessment as opposed to a risk or a threat assessment. Maturity models can help you to paint a clear picture of the gap between threat and preparation. One of the most functional and popular tools is the Department of Energys Oil and Natural Gas Subsector Cybersecurity Capability Capability Model (ONG-C2M2) The ONG-M2 comprises the aforementioned maturity model, an evaluation tool, and DOE- facilitated self-evaluations.”]
Source: https://www.csoonline.com/article/3101866/maturity-models-can-compel-your-leadership-to-action.html