CISA CPG
CISA Cross-Sector Cybersecurity Performance Goals — CISA (US Department of Homeland Security)
Also known as: Cross-Sector Cybersecurity Performance Goals, CPG, CPGs, Cross-Sector CPGs
At a glance
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Critical infrastructure organizations of every size, and especially small and medium-sized ones, as a voluntary baseline of high-impact cybersecurity practices for IT and OT. source
- How it is assessed
- Organizations self-assess progress; CISA has no plans to audit entities against them. source
- Written by
- CISA (DHS) publishes the goals; they are voluntary and CISA says it has no plans to audit entities against them. source
- Last change
- None recorded yet
The short, voluntary baseline CISA wrote for critical-infrastructure owners too small or too specialised to adopt a full framework: a prioritised set of practices chosen for their effect against known attacker techniques, each mapped to the NIST Cybersecurity Framework and rated for cost and ease of implementation. Sector risk management agencies build their sector-specific goals on it, which is what turns a voluntary list into a question an auditor asks.
Recent changes
No changes recorded yet — we are watching, and nothing has been published.
Key dates
No upcoming datesVersion history
-
CPG 2.0 Major versionCurrent
Aligned to NIST CSF 2.0 with a new Govern function covering leadership accountability, oversight and risk management. source
More
- Separate OT and IT goals from 1.0.1 were merged into shared goals.
- New goals cover cybersecurity oversight, managed service provider risk, least privilege and incident communication; three duplicative goals were removed.
- Each goal now has Cost, Impact and Ease of Implementation ratings.
-
CPG 1.0.1 Revision
March 2023 update that reorganised the goals to align with the NIST CSF functions (Identify, Protect, Detect, Respond, Recover), following feedback after the first release. source
-
CPG 1.0 Major version
First release of the Cross-Sector Cybersecurity Performance Goals, developed under a 2021 national security memorandum with NIST and the interagency community. source
Who it applies to
The CPGs are a voluntary resource for all critical infrastructure organizations.
- Voluntary resource
- The CPGs are a voluntary resource for all critical infrastructure organizations and are meant to be most useful to small and medium-sized entities. source source
- Baseline and benchmark
- They are a baseline and a benchmark for IT and OT owners, chosen for known risk-reduction value and for aggregate risk to the nation. source
- Sector-Specific Goals
- Sector-Specific Goals (SSGs), developed with sector risk management agencies, build on them for sectors such as chemical, energy, financial services, healthcare and IT. source
How compliance is assessed
Organizations self-assess progress; CISA has no plans to audit entities against them.
- Self-assessment
- The goals are written to be measurable so organizations can self-assess progress; CISA has no plans to audit entities against them. source
- CSET module
- With CPG 2.0, CISA announced a new assessment module in its CSET tool and an updated checklist for the first quarter of 2026. source
- Ratings
- The CPG 2.0 report defines its ratings to make assessments more consistent. source
Enforcement and penalties
The CPGs are voluntary, and CISA has no plans to audit entities against them.
- Voluntary
- The performance goals are voluntary, and CISA has no plans to audit entities based on them. source
Documents
Frequently asked questions
What is the latest version of the CISA CPGs?
CPG 2.0, released 11 December 2025. It replaced CPG 1.0.1 (March 2023), which had updated the first release of October 2022. source
Are the CISA Cybersecurity Performance Goals mandatory?
No. They are voluntary, and CISA has no plans to audit entities against them. source
What changed in CPG 2.0?
It adds a Govern function to match NIST CSF 2.0 and merges separate IT and OT goals. New goals cover oversight, managed service providers, least privilege and incident communication, three duplicative goals were removed, and each goal is rated for cost, impact and ease of implementation. source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to CISA CPG (RSS)