The Cross-Sector Cybersecurity Performance Goals are CISA's voluntary baseline of cybersecurity practices for critical infrastructure organizations of all sizes. The current version, CPGs 2.0, adds a Govern function aligned with NIST CSF 2.0 and merges IT and OT goals. They are not a law or a certification.
What they are
Per CISA, the CPGs are recommended practices that focus on reducing the likelihood and impact of known risks and adversary techniques. They are meant to help especially small and medium organizations begin with a limited set of high-impact actions.
The page calls them voluntary. Nothing in the text we reviewed says you are audited against them. Treat them as a checklist you can adopt, not as a compliance regime.
What is new in 2.0
CISA highlights these new or updated goal areas:
- Cybersecurity oversight
- Risks from managed service providers
- Principle of least privilege
- Incident communication procedures
It also added a GOVERN function to align with NIST CSF 2.0, and combined IT and OT goals into shared goals. The page does not state a total number of goals, so check the current document before quoting a figure.
Sector specific goals
CISA lists sector-specific goals for Chemical, Energy, Financial Services, Healthcare and IT. They build on the cross-sector set. If you are in one of those sectors, read both. The sector list itself is in our guide to the 16 sectors.
How to use them
- Download the current goals and assign an owner to each area.
- Score yourself honestly: done, partly done, not done.
- Pick the three gaps that most reduce the chance of a bad day. Default credentials, remote access and backups usually top the list.
- Report progress to leadership on a regular schedule, which also satisfies the new oversight theme.
- Revisit after each incident or major change.
How the goals relate to other frameworks
Because the goals align with NIST CSF 2.0, work you do on one maps well to the other. If you already follow CSF, you probably meet many goals. If you follow neither, the CPGs are a smaller place to start than a full framework. Keep evidence, such as screenshots, tickets and policy dates, so that you can answer a buyer or regulator later.
Making the goals useful to leadership
A scorecard works better than a long report. Show each goal area with a status, an owner and a next date. Add one line on what would change the status. Leadership can then see movement over time, and you can show that oversight, one of the named 2.0 themes, is actually happening.
Avoid turning the exercise into a race for green cells. A goal marked partly done with a clear plan is more honest than one marked done with no evidence.
Quick check
Are the CPGs mandatory?
CISA describes them as voluntary. Separate laws or contracts may impose their own requirements, so check those independently.
Can I get certified against the CPGs?
The page we reviewed does not describe a certification. Do not claim one.
Safeguard can help with the evidence side, through compliance and evidence automation and policy gates for software delivery, though it does not make you compliant with any framework by itself.
Sources
Last reviewed: 19 October 2026.
