본문으로 건너뛰기
cccskills
무료GitHub에 공개

cisa-cpg

Knowledge base from CISA Cross-Sector Cybersecurity Performance Goals 2.0. Use for prioritized IT/OT baseline cyber goals aligned to NIST CSF 2.0 (including GOVERN), critical-infrastructure hygiene, MSP/supply-chain expectations, and board-friendly outcome language. Covers CPG 2.0 goals only; does not replace full CSF programs, sector-specific goals (SSGs), or CSET tooling detail.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

설치 방법 보기

포함된 파일(11)

  • SKILL.md5.7 KB
  • chapters/ch01-cpg-purpose-and-2-0-changes.md3.7 KB
  • chapters/ch02-govern-and-identify-goals.md3.6 KB
  • chapters/ch03-protect-goals.md4.3 KB
  • chapters/ch04-detect-respond-recover-goals.md3.0 KB
  • chapters/ch05-it-ot-implementation-and-prioritization.md4.0 KB
  • cheatsheet.md2.1 KB
  • glossary.md2.3 KB
  • LICENSE1.1 KB
  • PACK.yaml1.6 KB
  • patterns.md2.8 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

<!-- argument-hint: [topic, function, or chapter number] -->

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

Source: CISA CPG 2.0 (US Government work, public domain) | Chapters: 5

When to use

Reach for this pack when selecting or assessing a prioritized baseline of cybersecurity practices for critical infrastructure IT and OT — especially to align investments to CISA’s highest-yield goals, map goals to CSF 2.0 Functions (including GOVERN), brief executives on foundational hygiene, or plan first-mile controls (identity, segmentation, backups, logging, IR readiness) before a full framework build-out.

Prerequisites: none — plain Markdown; no MCP server, API key, or licence tier needed at runtime.

How to Use This Skill

  • Without arguments — load the core frameworks below.
  • With a topic — ask about GOVERN/IDENTIFY/PROTECT/DETECT/RESPOND/RECOVER goals, IT vs OT implementation, prioritization, MFA, segmentation, MSP risk, or 2.0 changes.
  • With a chapter — ask for ch01 through ch05.

Supporting files: glossary.md, patterns.md, cheatsheet.md.

Core Frameworks & Mental Models

What CPGs are

A streamlined, outcome-driven baseline of cybersecurity protections for IT and OT environments across U.S. critical infrastructure. They help organizations pick high-impact practices, prioritize scarce resources, and communicate value to senior leaders.

CSF 2.0 alignment

Goals are grouped under six Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER. Version 2.0 adds GOVERN and renumbers/consolidates prior goals; former OT-only items fold into universal goals for blended environments.

Goal card pattern

Each goal states an outcome plus recommended actions — usable by practitioners and non-technical stakeholders.

Representative goal map (2.0)

FunctionExample goals
GOVERN1.A responsibilities; 1.C IR plans; 1.D supply-chain reporting; 1.E MSP risk
IDENTIFY2.A/B assets; 2.C/D independent validation; 2.E network topology
PROTECT3.A–3.S identity, MFA, segmentation, training, encryption, backups, logging, edge hardening
DETECT4.A malicious code detection; 4.B adverse events
RESPOND5.A communications; 5.B reporting
RECOVER6.A execute recovery plan

Using CPGs

  • Floor, not ceiling: prioritized subset, not complete assurance.
  • Remap any 1.x trackers before claiming 2.0 coverage.
  • Pair short overview materials with the full report when implementing.
  • Sector-specific goals may extend the cross-sector set.

Chapter Index

#SectionKey content
ch01Purpose and 2.0 ChangesWhy CPGs exist; GOVERN addition; consolidations
ch02GOVERN + IDENTIFYAccountability, IR plans, MSP/supply chain, assets, topology
ch03PROTECTIdentity, MFA, segmentation, backups, logging, edge security
ch04DETECT/RESPOND/RECOVERMalware/events, communications/reporting, recovery execution
ch05IT/OT ImplementationPrioritization, OT constraints, investment framing

Topic Index

  • Adverse event identification → ch04
  • Asset inventory → ch02
  • Backups and restoration → ch03, ch04
  • Board / executive communication → ch01, ch05
  • Change management → ch03
  • CPG 2.0 changes from 1.x → ch01
  • Default passwords / credential hygiene → ch03
  • Encryption → ch03
  • GOVERN function → ch01, ch02
  • Incident communications / reporting → ch04
  • Incident response plans → ch02, ch04
  • Independent control validation → ch02
  • Internet-facing device security → ch03
  • IT vs OT implementation → ch05
  • Logging → ch03
  • Malicious code detection → ch04
  • Managed service provider (MSP) risk → ch02
  • MFA → ch03
  • Network segmentation → ch03, ch05
  • Network topology documentation → ch02
  • Prioritization / where to start → ch01, ch05
  • Privileged vs user accounts → ch03
  • Recovery plan execution → ch04
  • Sector-specific goals (SSGs) → ch05
  • Supply chain incident / vulnerability disclosure → ch02
  • Training → ch03

Supporting Files

  • glossary.md — CPG / CSF terms with chapter references
  • patterns.md — implementation patterns (When/How/Trade-offs)
  • cheatsheet.md — decision rules, goal map, tells & smells

Scope & Limits

This pack covers CISA Cross-Sector Cybersecurity Performance Goals Version 2.0 (report dated December 2025 in the extracted source; aligned to NIST CSF 2.0 including GOVERN) as synthesized reference notes. Combined source_pages = 38 (36-page main report + 2-page slick sheet overview). No separate CPG 2.0 “controls-list” PDF was available at build; the main report holds the full goal inventory. Does not cover: full NIST CSF 2.0 catalog; sector-specific goals in depth; CSET product UI; legal interpretation of NSM-5; or organization-specific compliance scoring. US Government public domain work. No source-material download link is published.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

Signpost (not a knowledge pack) for the automotive standards landscape: ISO 26262, ASPICE, SAE J3016, UNECE R155, UNECE R156, and the NHTSA vehicle set. Contains NO source content: designation, edition, owner, status, and an official catalogue URL only. Use when you need to identify or locate an automotive standard. Most are paywalled or carry no redistribution grant and cannot be packaged; the one open path is the nhtsa-vehicle pack.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

jgsystemsconsulting/jgs-se-knowledge-packs82026년 10월 15일 업데이트

Signpost (not a knowledge pack) for the avionics development assurance standards landscape: RTCA DO-178C / EUROCAE ED-12C and its supplements (DO-330/ED-215, DO-331/ED-218, DO-332/ED-217, DO-333/ED-216); RTCA DO-254 / EUROCAE ED-80; SAE ARP4754B and ARP4761A; and the free regulator documents that recognise them (FAA AC 20-115D, AC 20-152A, Order 8110.49A; EASA AMC 20-115D and AMC 20-152A). Contains no source content: each row carries only the designation, title, edition, owner, redistributability status, and the owner's URL. Use when you need to identify, cite, or locate an avionics standard; paywalled rows point to the owner, free rows point to the regulator text, and the FAA rows also name the in-repo faa-8110-49 pack.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

jgsystemsconsulting/jgs-se-knowledge-packs82026년 10월 15일 업데이트

Knowledge base from DAFMAN 63-119 (15 April 2021), Mission-Oriented Test Readiness Certification. Use for continuous MOTRC replacing single-point OTRR thinking: framework/applicability, Certification Official vs PM roles, review cycle and exit criteria, certification memo/decertify gates, DT&E/contractor evidence, ITT integration and cyber resiliency, and the 31-template matrix. DAF T&E readiness process only—does not replace DoDI 5000.89, AFI 99-103, or multi-service lead policies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

jgsystemsconsulting/jgs-se-knowledge-packs82026년 10월 15일 업데이트

Knowledge base from the DoD Systems Engineering Guidebook (OUSD R&E, February 2022). Use for the DoD SE process model — the 16 SE processes (8 technical management + 8 technical) mapped to ISO/IEC/IEEE 15288, the event-driven technical reviews and audits across the Major Capability Acquisition life cycle (ASR, SRR, SFR, PDR, CDR, SVR/FCA, PRR, PCA), the Systems Engineering Plan (SEP), risk/issue/opportunity management, TPMs and leading indicators, system-of-systems and digital engineering, and the 24 design considerations (RAM, system safety, HSI, system security engineering, MOSA, supportability, etc.). Acquisition-program oriented: thin on detailed cost estimating, contracting law, and non-DoD or commercial life cycles.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

jgsystemsconsulting/jgs-se-knowledge-packs82026년 10월 15일 업데이트

Knowledge pack from 'Towards Digital Engineering: The Advent of Digital Systems Engineering' (Huang et al., Old Dominion University, arXiv:2002.11672, 2020). Use when reasoning about digital engineering, the DoD Digital Engineering Strategy and its five goals, the Authoritative Source of Truth, digitalization vs. digitization, digital augmentation, digitalized models, provenance, unique identification, and the four-level (vision/strategy/action/foundation) DSE research framework. Covers the conceptual/vision layer of the field. SCOPE LIMITS: this is a single ~28-page vision paper, not a methods handbook — it is thin on step-by-step procedures, tooling, case studies, and quantitative evaluation, and it predates 2020 so it does not cover later digital-engineering standards or recent AI/LLM advances. Use the sebok pack for established SE canon and MBSE depth.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

jgsystemsconsulting/jgs-se-knowledge-packs82026년 10월 15일 업데이트

Knowledge base from the DoD Digital Engineering Strategy (2018, OUSD/ODASD(SE)). Use for the Department of Defense's five digital engineering goals — (1) formalize the development, integration, and use of models; (2) provide an enduring authoritative source of truth; (3) incorporate technological innovation; (4) establish supporting infrastructure and environments; (5) transform the culture and workforce — plus their focus areas, the document-to-model and design-build-test→model-analyze-build shifts, model formalisms/provenance, governance and access control of the authoritative source of truth, and the coordinate→plan→pilot→sustain rollout. A vision-and-policy strategy, deliberately non-prescriptive. Does NOT provide a how-to method, tool tutorials, MBSE/SysML mechanics, or implementation-plan content; thin on metrics, acquisition-policy detail, and step-by-step procedure. Excludes the CAC-gated Digital Engineering Body of Knowledge (DEBoK).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

jgsystemsconsulting/jgs-se-knowledge-packs82026년 10월 15일 업데이트

jgsystemsconsulting의 스킬 모두 보기

이 스킬의 문제 신고