CISA Cybersecurity Performance Goals (CPG) 2.0

Why does it matter?

The CPGs answer three questions CISA says organizations ask: which practices reduce risk the most, how to prioritize them, and how to explain their value to leadership. Each of the 34 goals states an outcome, a recommended action, the risk it addresses and its ratings, so a small team can start from a short ranked list instead of a full control catalog.

Key benefits include:

• A short, rated list

Each goal is rated Low, Moderate or High for cost and impact and Simple, Moderate or Complex for ease of implementation.

• Budget-based cost ratings

Cost is measured against the annual security budget: Low is under 5 percent, Moderate is 5 to 15 percent and High is over 15 percent.

• Governance in the list

The Govern function (goals 1.A to 1.E) puts responsibilities, oversight and incident planning in the set that executives and boards read.

• One set for IT and OT

Version 2.0 folds the OT-only goals of v1.0.1 into universal goals, so one list covers the whole estate.

• Mapped to NIST CSF 2.0

Every goal maps to a CSF 2.0 subcategory, such as GV.OV-03 for goal 1.B, so organizations already using the CSF need no extra work to apply the relevant goals.

How does it work?

CPG 2.0 has 34 goals under the six NIST CSF 2.0 functions: Govern (1.A to 1.E), Identify (2.A to 2.E), Protect (3.A to 3.S), Detect (4.A and 4.B), Respond (5.A and 5.B) and Recover (6.A). Each goal lists its outcome, recommended action, risk addressed, scope, CSF 2.0 reference, additional NIST references (SP 800-53 Rev. 5 and SP 800-82 Rev. 3 controls), cost, impact, ease of implementation and support resources.

The CPG worksheet has four steps: perform an initial self-evaluation, identify and prioritize gaps by cost, impact and ease, invest and execute, and review progress after 12 months. Ease is Simple if the goal can be done in a few months with minimal expertise, Moderate at 4 to 8 months and Complex at about a year or longer. The worksheet is on CISA.gov and in the CPG assessment module of CISA's Cyber Security Evaluation Tool (CSET).

In SmartSuite, teams hold each CPG 2.0 goal as a record with its CSF function, ratings, owner and status, link the evidence for it, turn gaps into tracked projects and report coverage by function.

Key Elements

• Govern (1.A to 1.E)

New in 2.0: cybersecurity responsibilities (1.A), cybersecurity oversight (1.B), incident response plans (1.C), supply chain incident reporting and vulnerability disclosure (1.D) and risks from managed service providers (1.E).

• Identify (2.A to 2.E)

Managing organizational assets (2.A), mitigating known vulnerabilities (2.B), independent validation of cybersecurity controls (2.C), a vulnerability disclosure process (2.D) and documenting network topology (2.E).

• Protect (3.A to 3.S)

Nineteen goals, including changing default passwords (3.A), minimum password strength (3.B), multifactor authentication (3.F), least privilege (3.H), network segmentation (3.I), strong encryption (3.K), backups (3.O), log collection (3.Q) and securing internet-facing devices (3.S).

• Detect, Respond and Recover

Malicious code detection (4.A) and identifying adverse events (4.B), incident communication (5.A) and incident reporting (5.B) procedures, and executing the incident recovery plan (6.A).

• Rating system

Impact definitions mirror the NIST Risk Management Framework categories Low, Moderate and High. CISA notes the cost, impact and ease guidance applies mainly to IT, not necessarily to OT systems.

• Worksheet and checklist

The CPG List is paired with a checklist and a worksheet for tracking current and future state and for communicating priorities and trade-offs to executives.

• Sector-Specific Goals

CISA works with sector risk management agencies on additional voluntary goals; chemical, energy, financial services, healthcare and information technology versions are published.

What does it cover?

The CPGs apply across all critical infrastructure sectors, for both IT and OT, and CISA's FAQ says organizations of all sizes will find value in them. CISA's design target is small and medium entities starting a program. CISA states they are not comprehensive, not a risk management or full cybersecurity program, not mandated by CISA and not a maturity model, because the goals are not tiered into maturity levels.

What are its objectives?

CPG 2.0 sets a minimum baseline that reduces risk to critical infrastructure operations and the people who depend on them.

Select practices with demonstrated value against commonly observed threats and adversary techniques.

Keep each goal clear, actionable and easy to define.

Keep goals affordable and practical for small and medium entities.

Cover IT and OT with one set of goals.

Add governance so leadership owns cybersecurity outcomes.

Let organizations show progress to leadership through the worksheet and the 12-month review.

Framework in Context

CPG 2.0 is a prioritized subset aligned to NIST CSF 2.0, and CISA positions it as a quick-start that organizations can apply before or alongside the full CSF. CISA's report notes organizations may already meet many goals through the CSF or ISA/IEC 62443, and each goal cites related NIST SP 800-53 Rev. 5 and SP 800-82 Rev. 3 controls. The Sector-Specific Goals build on the cross-sector goals.

Common Framework Mappings

Organizations map the CPGs to the frameworks they already run so one set of controls and evidence serves the goals, the full NIST CSF 2.0 and any regulatory baseline they report against.

Mapped frameworks include:

NIST CSF 2.0

CIS Controls v8.1

MITRE ATT&CK

NIST 800-53 Rev.5

NIST 800-171 Rev. 3

NIST 800-207 ZTA

ISO 27001:2022

SOC 2