本文へ移動
cccskills
無料GitHub で公開

cisa-cpg

Knowledge base from CISA Cross-Sector Cybersecurity Performance Goals 2.0. Use for prioritized IT/OT baseline cyber goals aligned to NIST CSF 2.0 (including GOVERN), critical-infrastructure hygiene, MSP/supply-chain expectations, and board-friendly outcome language. Covers CPG 2.0 goals only; does not replace full CSF programs, sector-specific goals (SSGs), or CSET tooling detail.

インストール方法を見る

含まれるファイル(11)

  • SKILL.md5.7 KB
  • chapters/ch01-cpg-purpose-and-2-0-changes.md3.7 KB
  • chapters/ch02-govern-and-identify-goals.md3.6 KB
  • chapters/ch03-protect-goals.md4.3 KB
  • chapters/ch04-detect-respond-recover-goals.md3.0 KB
  • chapters/ch05-it-ot-implementation-and-prioritization.md4.0 KB
  • cheatsheet.md2.1 KB
  • glossary.md2.3 KB
  • LICENSE1.1 KB
  • PACK.yaml1.6 KB
  • patterns.md2.8 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

<!-- argument-hint: [topic, function, or chapter number] -->

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

Source: CISA CPG 2.0 (US Government work, public domain) | Chapters: 5

When to use

Reach for this pack when selecting or assessing a prioritized baseline of cybersecurity practices for critical infrastructure IT and OT — especially to align investments to CISA’s highest-yield goals, map goals to CSF 2.0 Functions (including GOVERN), brief executives on foundational hygiene, or plan first-mile controls (identity, segmentation, backups, logging, IR readiness) before a full framework build-out.

Prerequisites: none — plain Markdown; no MCP server, API key, or licence tier needed at runtime.

How to Use This Skill

  • Without arguments — load the core frameworks below.
  • With a topic — ask about GOVERN/IDENTIFY/PROTECT/DETECT/RESPOND/RECOVER goals, IT vs OT implementation, prioritization, MFA, segmentation, MSP risk, or 2.0 changes.
  • With a chapter — ask for ch01 through ch05.

Supporting files: glossary.md, patterns.md, cheatsheet.md.

Core Frameworks & Mental Models

What CPGs are

A streamlined, outcome-driven baseline of cybersecurity protections for IT and OT environments across U.S. critical infrastructure. They help organizations pick high-impact practices, prioritize scarce resources, and communicate value to senior leaders.

CSF 2.0 alignment

Goals are grouped under six Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER. Version 2.0 adds GOVERN and renumbers/consolidates prior goals; former OT-only items fold into universal goals for blended environments.

Goal card pattern

Each goal states an outcome plus recommended actions — usable by practitioners and non-technical stakeholders.

Representative goal map (2.0)

FunctionExample goals
GOVERN1.A responsibilities; 1.C IR plans; 1.D supply-chain reporting; 1.E MSP risk
IDENTIFY2.A/B assets; 2.C/D independent validation; 2.E network topology
PROTECT3.A–3.S identity, MFA, segmentation, training, encryption, backups, logging, edge hardening
DETECT4.A malicious code detection; 4.B adverse events
RESPOND5.A communications; 5.B reporting
RECOVER6.A execute recovery plan

Using CPGs

  • Floor, not ceiling: prioritized subset, not complete assurance.
  • Remap any 1.x trackers before claiming 2.0 coverage.
  • Pair short overview materials with the full report when implementing.
  • Sector-specific goals may extend the cross-sector set.

Chapter Index

#SectionKey content
ch01Purpose and 2.0 ChangesWhy CPGs exist; GOVERN addition; consolidations
ch02GOVERN + IDENTIFYAccountability, IR plans, MSP/supply chain, assets, topology
ch03PROTECTIdentity, MFA, segmentation, backups, logging, edge security
ch04DETECT/RESPOND/RECOVERMalware/events, communications/reporting, recovery execution
ch05IT/OT ImplementationPrioritization, OT constraints, investment framing

Topic Index

  • Adverse event identification → ch04
  • Asset inventory → ch02
  • Backups and restoration → ch03, ch04
  • Board / executive communication → ch01, ch05
  • Change management → ch03
  • CPG 2.0 changes from 1.x → ch01
  • Default passwords / credential hygiene → ch03
  • Encryption → ch03
  • GOVERN function → ch01, ch02
  • Incident communications / reporting → ch04
  • Incident response plans → ch02, ch04
  • Independent control validation → ch02
  • Internet-facing device security → ch03
  • IT vs OT implementation → ch05
  • Logging → ch03
  • Malicious code detection → ch04
  • Managed service provider (MSP) risk → ch02
  • MFA → ch03
  • Network segmentation → ch03, ch05
  • Network topology documentation → ch02
  • Prioritization / where to start → ch01, ch05
  • Privileged vs user accounts → ch03
  • Recovery plan execution → ch04
  • Sector-specific goals (SSGs) → ch05
  • Supply chain incident / vulnerability disclosure → ch02
  • Training → ch03

Supporting Files

  • glossary.md — CPG / CSF terms with chapter references
  • patterns.md — implementation patterns (When/How/Trade-offs)
  • cheatsheet.md — decision rules, goal map, tells & smells

Scope & Limits

This pack covers CISA Cross-Sector Cybersecurity Performance Goals Version 2.0 (report dated December 2025 in the extracted source; aligned to NIST CSF 2.0 including GOVERN) as synthesized reference notes. Combined source_pages = 38 (36-page main report + 2-page slick sheet overview). No separate CPG 2.0 “controls-list” PDF was available at build; the main report holds the full goal inventory. Does not cover: full NIST CSF 2.0 catalog; sector-specific goals in depth; CSET product UI; legal interpretation of NSM-5; or organization-specific compliance scoring. US Government public domain work. No source-material download link is published.

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Signpost (not a knowledge pack) for the automotive standards landscape: ISO 26262, ASPICE, SAE J3016, UNECE R155, UNECE R156, and the NHTSA vehicle set. Contains NO source content: designation, edition, owner, status, and an official catalogue URL only. Use when you need to identify or locate an automotive standard. Most are paywalled or carry no redistribution grant and cannot be packaged; the one open path is the nhtsa-vehicle pack.

日本語の概要は準備中です。原文の説明を表示しています。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月9日 更新

Knowledge base from DAFMAN 63-119 (15 April 2021), Mission-Oriented Test Readiness Certification. Use for continuous MOTRC replacing single-point OTRR thinking: framework/applicability, Certification Official vs PM roles, review cycle and exit criteria, certification memo/decertify gates, DT&E/contractor evidence, ITT integration and cyber resiliency, and the 31-template matrix. DAF T&E readiness process only—does not replace DoDI 5000.89, AFI 99-103, or multi-service lead policies.

日本語の概要は準備中です。原文の説明を表示しています。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月9日 更新

Knowledge base from the DoD Systems Engineering Guidebook (OUSD R&E, February 2022). Use for the DoD SE process model — the 16 SE processes (8 technical management + 8 technical) mapped to ISO/IEC/IEEE 15288, the event-driven technical reviews and audits across the Major Capability Acquisition life cycle (ASR, SRR, SFR, PDR, CDR, SVR/FCA, PRR, PCA), the Systems Engineering Plan (SEP), risk/issue/opportunity management, TPMs and leading indicators, system-of-systems and digital engineering, and the 24 design considerations (RAM, system safety, HSI, system security engineering, MOSA, supportability, etc.). Acquisition-program oriented: thin on detailed cost estimating, contracting law, and non-DoD or commercial life cycles.

日本語の概要は準備中です。原文の説明を表示しています。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月9日 更新

Knowledge pack from 'Towards Digital Engineering: The Advent of Digital Systems Engineering' (Huang et al., Old Dominion University, arXiv:2002.11672, 2020). Use when reasoning about digital engineering, the DoD Digital Engineering Strategy and its five goals, the Authoritative Source of Truth, digitalization vs. digitization, digital augmentation, digitalized models, provenance, unique identification, and the four-level (vision/strategy/action/foundation) DSE research framework. Covers the conceptual/vision layer of the field. SCOPE LIMITS: this is a single ~28-page vision paper, not a methods handbook — it is thin on step-by-step procedures, tooling, case studies, and quantitative evaluation, and it predates 2020 so it does not cover later digital-engineering standards or recent AI/LLM advances. Use the sebok pack for established SE canon and MBSE depth.

日本語の概要は準備中です。原文の説明を表示しています。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月9日 更新

Knowledge base from the DoD Digital Engineering Strategy (2018, OUSD/ODASD(SE)). Use for the Department of Defense's five digital engineering goals — (1) formalize the development, integration, and use of models; (2) provide an enduring authoritative source of truth; (3) incorporate technological innovation; (4) establish supporting infrastructure and environments; (5) transform the culture and workforce — plus their focus areas, the document-to-model and design-build-test→model-analyze-build shifts, model formalisms/provenance, governance and access control of the authoritative source of truth, and the coordinate→plan→pilot→sustain rollout. A vision-and-policy strategy, deliberately non-prescriptive. Does NOT provide a how-to method, tool tutorials, MBSE/SysML mechanics, or implementation-plan content; thin on metrics, acquisition-policy detail, and step-by-step procedure. Excludes the CAC-gated Digital Engineering Body of Knowledge (DEBoK).

日本語の概要は準備中です。原文の説明を表示しています。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月9日 更新

dod-mosa

無料

Knowledge base from the OUSD(R&E) guidebook Implementing a MOSA in DoD Programs (Feb 2025). Use for the Modular Open Systems Approach as a DoD acquisition + design discipline: the statutory/regulatory basis (10 U.S.C. 4401–4403, FY2017/FY2021 NDAA, DFARS), the five OUSD(R&E) pillars, the plan→modularize→identify→define→standardize interface lifecycle, technical levers (WBS/MIL-STD-881F taxonomy, standards profiling, API-first software, COTS/cybersecurity), MOSA assessment metrics and tools (PART/OAAT/KOSS/SEAM/MAUT), technology-change and DMSMS management, roadmaps, MOSA across the six AAF pathways, and contracting/IP/data-rights mechanics. SCOPE LIMITS: this is U.S. DoD weapon-system acquisition policy, not a general open-architecture or interface-standards reference — it names standards (FACE, OMS, DISR) without reproducing them, is light on detailed engineering of any specific standard, and does not cover the underlying SE processes (use dau-se-guidebook / nasa-npr-7123) or general systems-engineering theory (use sebok).

日本語の概要は準備中です。原文の説明を表示しています。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月9日 更新

jgsystemsconsulting のスキルをすべて見る

このスキルの問題を報告する