The Cybersecurity and Infrastructure Security Agency has released version 2.0 of its Cross-Sector Cybersecurity Performance Goals, or CPGs, an updated guidance for integrating cybersecurity within an organization’s daily operations.
The Potomac Officers Club’s 2026 Cyber Summit on May 21 will bring together cybersecurity experts from across government and industry to discuss some of the most pressing cyber issues and opportunities today. Get your tickets here.
CISA said Thursday that the document reflects three years of operational insights and contains best practices collected from industry and government leaders and cybersecurity experts.
“Over the past year, CISA has engaged extensively with hundreds of stakeholders across both the public and private sectors to ensure the updated goals reflect real-world challenges and operational realities,” Acting CISA Director Madhu Gottumukkala stated. “Version 2.0 demonstrates our commitment to listening to and incorporating partner feedback to deliver practical, outcome-driven guidance that organizations can act on.”
The Cross-Sector CPGs align with the National Institute of Standards and Technology Cybersecurity Framework 2.0.
What Is the CPG Version 2.0?
The updated goals expand the agency’s current guidance on account and device security, data protection, governance, vulnerability management, supply chain risk, and incident response and recovery.
The Cross-Sector CPG 2.0 introduces a section on the role of organizational leadership. CISA also consolidated operational and information technology into universal goals and added measures addressing emerging threats to eliminate silos in the new guidance.
The document also adds new goals for third-party risk, zero trust architecture and incident communication.
According to Gottumukkala, the CPGs apply to all critical infrastructure sectors.
Are CISA’s Cross-Sector CPGs Effective?
The updated guidance comes almost a year after CISA published its Cybersecurity Performance Goals Adoption Report. The agency found that, based on its analysis of 7,791 critical infrastructure organizations enrolled in its vulnerability scanning service, cybersecurity has improved in the sector since the implementation of CPG in 2022.
The report found a decline in known exploited vulnerabilities, or KEVs, and Secure Sockets Layer misconfigurations.
