Cross-Sector Cybersecurity Performance Goals

• A baseline set of cybersecurity practices broadly applicable across critical infrastructure with known risk-reduction value.    

• A benchmark for critical infrastructure operators to measure and improve their cybersecurity maturity.    

• A combination of recommended practices for information technology and operational technology owners, including a prioritized set of security practices.    

• Unique from other control frameworks as they consider not only the practices that address risk to individual entities, but also the aggregate risk to the nation.     

Key Updates to the Cross-Sector Cybersecurity Performance Goals

CISA's Cross-Sector CPGs 2.0 have been updated to align to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 functions and the evolving cybersecurity threat landscape. The updated Cross-Sector CPGs 2.0 build upon the foundation established in version 1.0.1. 

• Enhanced Alignment with NIST CSF 2.0: The CPGs have been updated to reflect the latest cybersecurity best practices and frameworks with the addition of the GOVERN function. The GOVERN function regroups existing goals and creates new goals integrating leadership accountability, oversight, and risk management, mirroring NIST CSF 2.0’s new emphasis on organizational governance.
• Goal Consolidation - Streamlining & Cross-Sector Alignment: Operational Technology (OT) & Information Technology (IT) goals from CPG 1.0.1 are addressed holistically through new shared goals. Small- and medium-sized entities can apply one framework across their entire estate, without confusion over domain-specific goals.
• Net-New Goals - Addressing Emerging Gaps & Threats: New goals have been added to address emerging threats and include areas such as cybersecurity oversight, risks associated with managed service providers (MSPs), principle of least privileges, and incident communication procedures.
• Deletions & Intent Preservation:  CPGs 2.0 removes three duplicative goals based on real-world usage data and practitioner feedback. The original goals’ outcomes are now embedded in other goals.
• Methodology & Documentation Enhancements: The CPG 2.0 Report now includes improved Cost, Impact, and Ease of Implementation ratings for each goal. The definitions and logic for each rating are also included in the CPGs 2.0 Report to aid assessors in conducting CPG assessments with a greater degree of repeatable analytic consistency.
• New CSET® Assessment Module: A new CSET module will be available in Q1 2026 for CPG 2.0, inclusive of the new set of goals and implementation scales.  An accompanying updated CPG 2.0 Checklist will also be available at that time.

Sector Specific Goals

CISA is proud to introduce the first sets of Sector-Specific Goals (SSGs) that are tailored for organizations in select critical infrastructure sectors. Developed in partnership with Sector Risk Management Agencies (SRMAs) and sector stakeholders, SSGs address unique requirements in select critical infrastructure sectors, and build upon CISA’s Cross-Sector CPGs.