Skip to content
cccskills
FreePublished on GitHub

cisa-cpg

Knowledge base from CISA Cross-Sector Cybersecurity Performance Goals 2.0. Use for prioritized IT/OT baseline cyber goals aligned to NIST CSF 2.0 (including GOVERN), critical-infrastructure hygiene, MSP/supply-chain expectations, and board-friendly outcome language. Covers CPG 2.0 goals only; does not replace full CSF programs, sector-specific goals (SSGs), or CSET tooling detail.

The English summary is being prepared. Showing the original description.

See how to install

Files included (11)

  • SKILL.md5.7 KB
  • chapters/ch01-cpg-purpose-and-2-0-changes.md3.7 KB
  • chapters/ch02-govern-and-identify-goals.md3.6 KB
  • chapters/ch03-protect-goals.md4.3 KB
  • chapters/ch04-detect-respond-recover-goals.md3.0 KB
  • chapters/ch05-it-ot-implementation-and-prioritization.md4.0 KB
  • cheatsheet.md2.1 KB
  • glossary.md2.3 KB
  • LICENSE1.1 KB
  • PACK.yaml1.6 KB
  • patterns.md2.8 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

<!-- argument-hint: [topic, function, or chapter number] -->

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

Source: CISA CPG 2.0 (US Government work, public domain) | Chapters: 5

When to use

Reach for this pack when selecting or assessing a prioritized baseline of cybersecurity practices for critical infrastructure IT and OT — especially to align investments to CISA’s highest-yield goals, map goals to CSF 2.0 Functions (including GOVERN), brief executives on foundational hygiene, or plan first-mile controls (identity, segmentation, backups, logging, IR readiness) before a full framework build-out.

Prerequisites: none — plain Markdown; no MCP server, API key, or licence tier needed at runtime.

How to Use This Skill

  • Without arguments — load the core frameworks below.
  • With a topic — ask about GOVERN/IDENTIFY/PROTECT/DETECT/RESPOND/RECOVER goals, IT vs OT implementation, prioritization, MFA, segmentation, MSP risk, or 2.0 changes.
  • With a chapter — ask for ch01 through ch05.

Supporting files: glossary.md, patterns.md, cheatsheet.md.

Core Frameworks & Mental Models

What CPGs are

A streamlined, outcome-driven baseline of cybersecurity protections for IT and OT environments across U.S. critical infrastructure. They help organizations pick high-impact practices, prioritize scarce resources, and communicate value to senior leaders.

CSF 2.0 alignment

Goals are grouped under six Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER. Version 2.0 adds GOVERN and renumbers/consolidates prior goals; former OT-only items fold into universal goals for blended environments.

Goal card pattern

Each goal states an outcome plus recommended actions — usable by practitioners and non-technical stakeholders.

Representative goal map (2.0)

FunctionExample goals
GOVERN1.A responsibilities; 1.C IR plans; 1.D supply-chain reporting; 1.E MSP risk
IDENTIFY2.A/B assets; 2.C/D independent validation; 2.E network topology
PROTECT3.A–3.S identity, MFA, segmentation, training, encryption, backups, logging, edge hardening
DETECT4.A malicious code detection; 4.B adverse events
RESPOND5.A communications; 5.B reporting
RECOVER6.A execute recovery plan

Using CPGs

  • Floor, not ceiling: prioritized subset, not complete assurance.
  • Remap any 1.x trackers before claiming 2.0 coverage.
  • Pair short overview materials with the full report when implementing.
  • Sector-specific goals may extend the cross-sector set.

Chapter Index

#SectionKey content
ch01Purpose and 2.0 ChangesWhy CPGs exist; GOVERN addition; consolidations
ch02GOVERN + IDENTIFYAccountability, IR plans, MSP/supply chain, assets, topology
ch03PROTECTIdentity, MFA, segmentation, backups, logging, edge security
ch04DETECT/RESPOND/RECOVERMalware/events, communications/reporting, recovery execution
ch05IT/OT ImplementationPrioritization, OT constraints, investment framing

Topic Index

  • Adverse event identification → ch04
  • Asset inventory → ch02
  • Backups and restoration → ch03, ch04
  • Board / executive communication → ch01, ch05
  • Change management → ch03
  • CPG 2.0 changes from 1.x → ch01
  • Default passwords / credential hygiene → ch03
  • Encryption → ch03
  • GOVERN function → ch01, ch02
  • Incident communications / reporting → ch04
  • Incident response plans → ch02, ch04
  • Independent control validation → ch02
  • Internet-facing device security → ch03
  • IT vs OT implementation → ch05
  • Logging → ch03
  • Malicious code detection → ch04
  • Managed service provider (MSP) risk → ch02
  • MFA → ch03
  • Network segmentation → ch03, ch05
  • Network topology documentation → ch02
  • Prioritization / where to start → ch01, ch05
  • Privileged vs user accounts → ch03
  • Recovery plan execution → ch04
  • Sector-specific goals (SSGs) → ch05
  • Supply chain incident / vulnerability disclosure → ch02
  • Training → ch03

Supporting Files

  • glossary.md — CPG / CSF terms with chapter references
  • patterns.md — implementation patterns (When/How/Trade-offs)
  • cheatsheet.md — decision rules, goal map, tells & smells

Scope & Limits

This pack covers CISA Cross-Sector Cybersecurity Performance Goals Version 2.0 (report dated December 2025 in the extracted source; aligned to NIST CSF 2.0 including GOVERN) as synthesized reference notes. Combined source_pages = 38 (36-page main report + 2-page slick sheet overview). No separate CPG 2.0 “controls-list” PDF was available at build; the main report holds the full goal inventory. Does not cover: full NIST CSF 2.0 catalog; sector-specific goals in depth; CSET product UI; legal interpretation of NSM-5; or organization-specific compliance scoring. US Government public domain work. No source-material download link is published.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Signpost (not a knowledge pack) for the automotive standards landscape: ISO 26262, ASPICE, SAE J3016, UNECE R155, UNECE R156, and the NHTSA vehicle set. Contains NO source content: designation, edition, owner, status, and an official catalogue URL only. Use when you need to identify or locate an automotive standard. Most are paywalled or carry no redistribution grant and cannot be packaged; the one open path is the nhtsa-vehicle pack.

The English summary is being prepared. Showing the original description.

jgsystemsconsulting/jgs-se-knowledge-packs8Updated Oct 15, 2026

Signpost (not a knowledge pack) for the avionics development assurance standards landscape: RTCA DO-178C / EUROCAE ED-12C and its supplements (DO-330/ED-215, DO-331/ED-218, DO-332/ED-217, DO-333/ED-216); RTCA DO-254 / EUROCAE ED-80; SAE ARP4754B and ARP4761A; and the free regulator documents that recognise them (FAA AC 20-115D, AC 20-152A, Order 8110.49A; EASA AMC 20-115D and AMC 20-152A). Contains no source content: each row carries only the designation, title, edition, owner, redistributability status, and the owner's URL. Use when you need to identify, cite, or locate an avionics standard; paywalled rows point to the owner, free rows point to the regulator text, and the FAA rows also name the in-repo faa-8110-49 pack.

The English summary is being prepared. Showing the original description.

jgsystemsconsulting/jgs-se-knowledge-packs8Updated Oct 15, 2026

Knowledge base from DAFMAN 63-119 (15 April 2021), Mission-Oriented Test Readiness Certification. Use for continuous MOTRC replacing single-point OTRR thinking: framework/applicability, Certification Official vs PM roles, review cycle and exit criteria, certification memo/decertify gates, DT&E/contractor evidence, ITT integration and cyber resiliency, and the 31-template matrix. DAF T&E readiness process only—does not replace DoDI 5000.89, AFI 99-103, or multi-service lead policies.

The English summary is being prepared. Showing the original description.

jgsystemsconsulting/jgs-se-knowledge-packs8Updated Oct 15, 2026

Knowledge base from the DoD Systems Engineering Guidebook (OUSD R&E, February 2022). Use for the DoD SE process model — the 16 SE processes (8 technical management + 8 technical) mapped to ISO/IEC/IEEE 15288, the event-driven technical reviews and audits across the Major Capability Acquisition life cycle (ASR, SRR, SFR, PDR, CDR, SVR/FCA, PRR, PCA), the Systems Engineering Plan (SEP), risk/issue/opportunity management, TPMs and leading indicators, system-of-systems and digital engineering, and the 24 design considerations (RAM, system safety, HSI, system security engineering, MOSA, supportability, etc.). Acquisition-program oriented: thin on detailed cost estimating, contracting law, and non-DoD or commercial life cycles.

The English summary is being prepared. Showing the original description.

jgsystemsconsulting/jgs-se-knowledge-packs8Updated Oct 15, 2026

Knowledge pack from 'Towards Digital Engineering: The Advent of Digital Systems Engineering' (Huang et al., Old Dominion University, arXiv:2002.11672, 2020). Use when reasoning about digital engineering, the DoD Digital Engineering Strategy and its five goals, the Authoritative Source of Truth, digitalization vs. digitization, digital augmentation, digitalized models, provenance, unique identification, and the four-level (vision/strategy/action/foundation) DSE research framework. Covers the conceptual/vision layer of the field. SCOPE LIMITS: this is a single ~28-page vision paper, not a methods handbook — it is thin on step-by-step procedures, tooling, case studies, and quantitative evaluation, and it predates 2020 so it does not cover later digital-engineering standards or recent AI/LLM advances. Use the sebok pack for established SE canon and MBSE depth.

The English summary is being prepared. Showing the original description.

jgsystemsconsulting/jgs-se-knowledge-packs8Updated Oct 15, 2026

Knowledge base from the DoD Digital Engineering Strategy (2018, OUSD/ODASD(SE)). Use for the Department of Defense's five digital engineering goals — (1) formalize the development, integration, and use of models; (2) provide an enduring authoritative source of truth; (3) incorporate technological innovation; (4) establish supporting infrastructure and environments; (5) transform the culture and workforce — plus their focus areas, the document-to-model and design-build-test→model-analyze-build shifts, model formalisms/provenance, governance and access control of the authoritative source of truth, and the coordinate→plan→pilot→sustain rollout. A vision-and-policy strategy, deliberately non-prescriptive. Does NOT provide a how-to method, tool tutorials, MBSE/SysML mechanics, or implementation-plan content; thin on metrics, acquisition-policy detail, and step-by-step procedure. Excludes the CAC-gated Digital Engineering Body of Knowledge (DEBoK).

The English summary is being prepared. Showing the original description.

jgsystemsconsulting/jgs-se-knowledge-packs8Updated Oct 15, 2026

See all skills by jgsystemsconsulting

Report a problem with this skill