What it covers. The CPGs are a voluntary set of baseline cybersecurity practices published by CISA for critical infrastructure owners and operators of all sizes. They focus on a prioritised subset of measures with high impact on reducing common risks, aligned with the NIST Cybersecurity Framework, and cover areas such as account security, device security, data security, governance, vulnerability management, supply chain and incident response.
In practice. Organisations use the CPGs as a practical baseline or a gap analysis tool, particularly where resources are limited. Typical actions include multi-factor authentication, asset inventory, patching of known exploited vulnerabilities, logging, backups and incident response planning. Evidence includes a self-assessment against each goal and a plan for closing gaps.
Common gaps. The goals are a minimum, not a full programme, yet are sometimes treated as sufficient. Operational technology environments often lag behind IT in meeting them.