That is definitely the case with the Cybersecurity and Infrastructure Security Agency’s (CISA) Cross-Sector Cybersecurity Performance Goals (CPG 2.0) which has measurable actions for critical infrastructure owners and operators to achieve a foundational level of cybersecurity.
This update incorporates lessons learned, aligns with the most recent National Institute of Standards and Technology (NIST) Cybersecurity Framework revisions, and addresses the most common and impactful threats facing critical infrastructure.
CPGs are a subset of cybersecurity practices, selected through a thorough process of industry, government, and expert consultation. They aim to reduce risks to critical infrastructure operations and the American people.  These voluntary Cross-Sector CPGs strive to help small- and medium-sized organizations kickstart their cybersecurity efforts. They prioritize investment in a limited number of essential actions with high-impact security outcomes.
CPG 2.0 includes a new component focused on the essential role of governance in managing cybersecurity. It emphasizes accountability, risk management, and strategic integration of cybersecurity into day-to-day operations, reinforcing the principle that effective governance is the cornerstone of a resilient cyber posture.
CPGs are a streamlined and outcome-driven cybersecurity series of guides for information technology and operational technology environments and provide:
- Clear, foundational practices aligned with real-world threats.
- Straightforward, outcome-oriented language to aid implementation.
- A baseline for guiding investment, benchmarking progress, and reducing risk in measurable ways.
Click here for more information.