CISA Cybersecurity Performance Goals (CPG)

Why it Matters

CISA Cybersecurity Performance Goals help organizations focus on essential security practices to mitigate cyber risks and bolster overall resilience.

Key benefits include:

• Strengthen cybersecurity governance

Enable organizations to establish clear security objectives, roles, and priorities that enhance program accountability and strategic direction.

• Enhance operational resilience

Reduce the likelihood and impact of cyber incidents by establishing reliable baseline controls for critical assets and services.

• Improve regulatory and standards alignment

Facilitate alignment with industry-recognized frameworks and support ongoing compliance with regulatory and contractual cybersecurity obligations.

• Support continuous risk management

Encourage regular risk assessments and progress reviews to adapt controls based on evolving threats and organizational needs.

• Increase audit readiness

Document clear cyber objectives and measurable progress, making it easier to demonstrate security program effectiveness during internal and external assessments.

How it Works

The CISA Cybersecurity Performance Goals (CPG) framework establishes a set of prioritized cybersecurity practices structured around key security objectives and cross-industry requirements. It organizes these practices into essential security controls and technical safeguards mapped to critical governance domains, risk management principles, and regulatory expectations. The framework is designed tobe actionable and measurable, providing a baseline of cybersecurity performance applicable across industries, with controls grouped in areas such as identity protection, device management, protective technology, and incident response.

In practice, organizations utilize the CISA CPGs by implementing the recommended security controls within their operational environments. They conduct risk assessments to identify gaps, monitor compliance with performance goals, strengthen governance, and enhance their overall security posture. Frequent evaluations and ongoing monitoring help track progress toward achieving the CPGs, while periodic assessments support regulatory compliance and continuous improvement of security practices.

SmartSuite enables organizations to operationalize the CISA CPGs through pre-built control libraries, integrated risk registers, policy governance tools, and evidence collection features. Compliance tracking modules and remediation workflows simplify management of corrective actions, while reporting dashboards provide real-time visibility into performance against security goals and regulatory obligations.

Key Elements

• Network Security Safeguards

Defines protections for network infrastructure, covering segmentation, perimeter defenses, and secure communications.

• Access Management Principles

Describes the foundational requirements for controlling user and system privileges and authentication mechanisms.

• Vulnerability Management Processes

Specifies methods for identifying, assessing, and addressing security flaws and exposures.

• Incident Response Capabilities

Outlines structured approaches to preparing for and managing cybersecurity incidents and breaches.

• Supply Chain Risk Oversight

Establishes criteria for evaluating third-party risks and ensuring vendor security practices.

• Performance Monitoring Metrics

Organizes measurement and review mechanisms for tracking progress against cybersecurity goals.

• Governance and Policy Integration

Structures oversight functions and policy development within the cybersecurity program.

Framework Scope

CISA Cybersecurity Performance Goals (CPG) is adopted by critical infrastructure operators, public entities, and private sector organizations responsible for safeguarding key information systems and industrial control environments. It is typically integrated during initiatives to enhance baseline security postures, guide risk management, and support compliance assessments within evolving threat landscapes.

Framework Objectives

CISA Cybersecurity Performance Goals (CPG) provides foundational objectives to guide organizations in managing cybersecurity risk and strengthening security posture.

Strengthen governance and oversight of cybersecurity and risk management processes

Enhance protection of critical data and information systems from cyber threats

Support compliance with regulatory requirements and industry security standards

Improve operational resilience to minimize the impact of potential cyber incidents

Enable effective risk management and measurement through defined security controls

Promote continuous improvement in data protection and incident response capabilities CISA Cybersecurity Performance Goals (CPG) align with and map to existing frameworks such as the NIST Cybersecurity Framework, CIS Critical Security Controls, NIST SP 800-53 and NIST SP 800-207 (Zero Trust), offering prioritized objectives. Organizations adopt CPGs for regulatory alignment, governance, risk reduction, and to drive operational security improvements or federal compliance efforts.

Common Framework Mappings

Organizations map CISA Cybersecurity Performance Goals (CPG) to established frameworks to ensure consistent controls, simplify audits, enable regulatory alignment, and use existing mappings and threat and control taxonomies for risk management.

Mapped frameworks include:

CIS Critical Security Controls

ISO/IEC 27001

MITRE ATT&CK

NIST Cybersecurity Framework

NIST SP 800-171

NIST SP 800-207

NIST SP 800-53

SOC 2