[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cisa\u002Fcpg":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cisa","cpg","CPGs","Cross-Sector Cybersecurity Performance Goals (CPGs)",46,"US Cybersecurity and Infrastructure Security Agency (CISA)","**What it covers.** The CPGs are a voluntary set of baseline cybersecurity practices published by CISA for critical infrastructure owners and operators of all sizes. They focus on a prioritised subset of measures with high impact on reducing common risks, aligned with the NIST Cybersecurity Framework, and cover areas such as account security, device security, data security, governance, vulnerability management, supply chain and incident response.\n\n**In practice.** Organisations use the CPGs as a practical baseline or a gap analysis tool, particularly where resources are limited. Typical actions include multi-factor authentication, asset inventory, patching of known exploited vulnerabilities, logging, backups and incident response planning. Evidence includes a self-assessment against each goal and a plan for closing gaps.\n\n**Common gaps.** The goals are a minimum, not a full programme, yet are sometimes treated as sufficient. Operational technology environments often lag behind IT in meeting them.",null,"https:\u002F\u002Fwww.cisa.gov\u002Fcross-sector-cybersecurity-performance-goals","Read the goals at CISA","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"chinese-state-sponsored-tools-target-critical-infrastructure-via-botnets-and-spear-phishing","Chinese State-Sponsored Tools Target Critical Infrastructure via Botnets and Spear Phishing","2026-10-09T10:21:16.232+00:00",{"slug":23,"title":24,"published_at":25},"fbi-dismantles-chinese-state-sponsored-hacking-infrastructure-targeting-us-critical-systems","FBI Dismantles Chinese State-Sponsored Hacking Infrastructure Targeting US Critical Systems","2026-10-09T00:20:22.236+00:00",{"slug":27,"title":28,"published_at":29},"anthropic-launches-ai-powered-critical-infrastructure-open-source-security-program","Anthropic Launches AI-Powered Critical Infrastructure & Open Source Security Program","2026-10-08T22:20:51.641+00:00",{"slug":31,"title":32,"published_at":33},"iranian-attacks-expose-critical-gaps-in-us-water-system-cyber-defenses","Iranian Attacks Expose Critical Gaps in US Water System Cyber Defenses","2026-10-05T12:21:27.185+00:00",{"slug":35,"title":36,"published_at":37},"ai-in-critical-infrastructure-demands-rigorous-oversight-and-visibility","AI in Critical Infrastructure Demands Rigorous Oversight and Visibility","2026-09-29T20:20:24.121+00:00",{"slug":39,"title":40,"published_at":41},"needymantis-malware-enables-persistent-nation-state-access-across-critical-sectors","NeedyMantis Malware Enables Persistent Nation-State Access Across Critical Sectors","2026-09-29T16:21:02.533+00:00",{"slug":43,"title":44,"published_at":45},"salt-typhoon-breach-spurs-senate-action-on-telecom-cybersecurity","Salt Typhoon Breach Spurs Senate Action on Telecom Cybersecurity","2026-09-24T21:21:28.177+00:00",{"slug":47,"title":48,"published_at":49},"underfunded-water-systems-left-exposed-to-nation-state-cyber-threats","Underfunded Water Systems Left Exposed to Nation-State Cyber Threats","2026-09-24T12:22:01.222+00:00",{"slug":51,"title":52,"published_at":53},"ai-powered-defense-for-critical-infrastructure-lessons-from-ukraines-daybreak-program","AI-Powered Defense for Critical Infrastructure: Lessons from Ukraine's Daybreak Program","2026-09-23T21:20:52.905+00:00",{"slug":55,"title":56,"published_at":57},"ai-cyber-defense-act-targets-critical-infrastructure-gaps-after-water-facility-attacks","AI-Cyber Defense Act Targets Critical Infrastructure Gaps After Water Facility Attacks","2026-09-22T22:20:50.106+00:00",{"slug":59,"title":60,"published_at":61},"foreign-hackers-alter-ot-settings-at-colorado-water-utilities","Foreign Hackers Alter OT Settings at Colorado Water Utilities","2026-09-21T12:21:33.387+00:00",{"slug":63,"title":64,"published_at":65},"us-cyber-strategy-leaves-military-linked-civil-infrastructure-exposed","US Cyber Strategy Leaves Military-Linked Civil Infrastructure Exposed","2026-09-17T12:20:38.607+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",28,{"slug":73,"name":74,"problem":75,"stories":76},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",17,{"slug":78,"name":79,"problem":80,"stories":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",13,{"slug":83,"name":84,"problem":85,"stories":86},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",9,{"slug":88,"name":89,"problem":90,"stories":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":92,"name":93,"problem":94,"stories":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,[97,103,109,114,120,126,130,135],{"family":98,"item":99,"code":100,"title":101,"together":102},"nist-sp","800-82","SP 800-82","SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security",35,{"family":104,"item":105,"code":106,"title":107,"together":108},"cis","12","Control 12","Network Infrastructure Management",31,{"family":104,"item":110,"code":111,"title":112,"together":113},"13","Control 13","Network Monitoring and Defense",29,{"family":115,"item":116,"code":117,"title":118,"together":119},"nist-csf","pr-ac","PR.AC-1","Identity Management, Authentication and Access Control (CSF 1.1)",22,{"family":121,"item":122,"code":123,"title":124,"together":125},"nerc-cip","cip-005","CIP-005","CIP-005: Electronic Security Perimeter(s)",18,{"family":104,"item":127,"code":128,"title":129,"together":76},"7","Control 7","Continuous Vulnerability Management",{"family":104,"item":131,"code":132,"title":133,"together":134},"4","Control 4","Secure Configuration of Enterprise Assets and Software",12,{"family":136,"item":137,"code":138,"title":139,"together":140},"nist-800-53","ir-4","IR-4","Incident Handling",11]