Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Cybersecurity Program Management
  4. >Cybersecurity Program Management - Objective 1
  5. >C2M2-PROGRAM-1G
C2M2-PROGRAM-1GActive

The cybersecurity program strategy identifies any applicable compliance requirements that must be satisfied by the program (for example, NERC CIP, TSA Pipeline Security Guidelines, PCI DSS, ISO, DoD CMMC)

Statement

The cybersecurity program strategy identifies any applicable compliance requirements that must be satisfied by the program (for example, NERC CIP, TSA Pipeline Security Guidelines, PCI DSS, ISO, DoD CMMC)

Location

Domain
Cybersecurity Program Management
Objective
Cybersecurity Program Management - Objective 1

Practice Details

Identifier
C2M2-PROGRAM-1G
Domain
Cybersecurity Program Management
Objective
Objective 1
Maturity Level
MIL-2

Help Text

Compliance requirements are typically imposed on the organization by local, state, or federal governments. Different compliance requirements may apply to some but not all assets in-scope for the cybersecurity program. The cybersecurity program should be aware of what compliance requirements must be fulfilled by the program and the scope of each requirement. Listing compliance requirements in the cybersecurity program strategy helps ensure that cybersecurity program stakeholders know what they are held accountable for. For example, a strategy might include a statement that compliance to PCI DSS is required by the cybersecurity program. Organizations should consider the differences in legal and regulatory requirements within the areas in which they operate and how they may conflict with global IT, enterprise-wide IT, or cybersecurity controls. Some examples of compliance requirements that organizations may need to satisfy include: · North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Standards · Transportation Security Administration (TSA) Pipeline Security Guidelines · Payment Card Industry Data Security Standards (PCI DSS) · International Organization for Standardization (ISO) · Department of Defense Cybersecurity Maturity Model Certification (DoD CMMC) · California Consumer Privacy Act (CCPA) · Health Insurance Portability and Accountability Act of 1996 (HIPAA) · State- and local-level cybersecurity and privacy laws

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: PROGRAM-1a, PROGRAM-1b, PROGRAM-1c, PROGRAM-1d, PROGRAM-1e, PROGRAM-1f, PROGRAM-1g, PROGRAM-1h.

AESCSF
AESCSF-PROGRAM-1gequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Cybersecurity Program Management - Objective 1
Cybersecurity Program Management - Objective 18 controls
C2M2-PROGRAM-1AThe organization has a cybersecurity program strategy, which may be developed and managed in an ad hoc mannerC2M2-PROGRAM-1BThe cybersecurity program strategy defines goals and objectives for the organization’s cybersecurity activitiesC2M2-PROGRAM-1CThe cybersecurity program strategy and priorities are documented and aligned with the organization’s mission, strategic objectives, and risk to critical infrastructureC2M2-PROGRAM-1DThe cybersecurity program strategy defines the organization’s approach to provide program oversight and governance for cybersecurity activitiesC2M2-PROGRAM-1EThe cybersecurity program strategy defines the structure and organization of the cybersecurity programC2M2-PROGRAM-1FThe cybersecurity program strategy identifies standards and guidelines intended to be followed by the programC2M2-PROGRAM-1GThe cybersecurity program strategy identifies any applicable compliance requirements that must be satisfied by the program (for example, NERC CIP, TSA Pipeline Security Guidelines, PCI DSS, ISO, DoD CMMC)C2M2-PROGRAM-1HThe cybersecurity program strategy is updated periodically and according to defined triggers, such as business changes, changes in the operating environment, and changes in the threat profile (THREAT-2e)